Common Weakness Enumeration
CWE-912
Allowed-with-ReviewHidden Functionality
Abstraction: Class · Status: Incomplete
The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.
146 vulnerabilities reference this CWE, most recent first.
CVE-2021-24867 (GCVE-0-2021-24867)
Vulnerability from cvelistv5 – Published: 2022-02-21 10:45 – Updated: 2024-08-03 19:49
VLAI
EPSS
VEX
Title
Backdoored Plugins & Themes from AccessPress Themes
Summary
Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion
Severity
No CVSS data available.
CWE
- CWE-912 - Hidden Functionality
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://wpscan.com/vulnerability/9c76bada-fa32-4c… | x_refsource_MISC |
| https://jetpack.com/2022/01/18/backdoor-found-in-… | x_refsource_MISC |
Impacted products
93 products
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T19:49:13.412Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Frontend Post WordPress Plugin \u2013 AccessPress Anonymous Post",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.8.0*",
"status": "affected",
"version": "2.8.0",
"versionType": "custom"
},
{
"lessThan": "2.8.1",
"status": "affected",
"version": "2.8.1",
"versionType": "custom"
}
]
},
{
"product": "AccessPress Custom CSS",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.1*",
"status": "affected",
"version": "2.0.1",
"versionType": "custom"
},
{
"lessThan": "2.0.2",
"status": "affected",
"version": "2.0.2",
"versionType": "custom"
}
]
},
{
"product": "AccessPress Custom Post Type",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.8*",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
},
{
"lessThan": "1.0.9",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
}
]
},
{
"product": "Social Auto Poster",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.1.3*",
"status": "affected",
"version": "2.1.3",
"versionType": "custom"
},
{
"lessThan": "2.1.4",
"status": "affected",
"version": "2.1.4",
"versionType": "custom"
}
]
},
{
"product": "AccessPress iFeeds",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "4.0.3*",
"status": "affected",
"version": "4.0.3",
"versionType": "custom"
},
{
"lessThan": "4.0.4",
"status": "affected",
"version": "4.0.4",
"versionType": "custom"
}
]
},
{
"product": "PI Button",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "3.3.3*",
"status": "affected",
"version": "3.3.3",
"versionType": "custom"
},
{
"lessThan": "3.3.4",
"status": "affected",
"version": "3.3.4",
"versionType": "custom"
}
]
},
{
"product": "AccessPress Social Counter",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.9.1*",
"status": "affected",
"version": "1.9.1",
"versionType": "custom"
},
{
"lessThan": "1.9.2",
"status": "affected",
"version": "1.9.2",
"versionType": "custom"
}
]
},
{
"product": "AccessPress Social Icons",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.8.2*",
"status": "affected",
"version": "1.8.2",
"versionType": "custom"
},
{
"lessThan": "1.8.3",
"status": "affected",
"version": "1.8.3",
"versionType": "custom"
}
]
},
{
"product": "AccessPress Social Login Lite \u2013 Social Login WordPress Plugin",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "3.4.7*",
"status": "affected",
"version": "3.4.7",
"versionType": "custom"
},
{
"lessThan": "3.4.8",
"status": "affected",
"version": "3.4.8",
"versionType": "custom"
}
]
},
{
"product": "AccessPress Social Share",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "4.5.5*",
"status": "affected",
"version": "4.5.5",
"versionType": "custom"
},
{
"lessThan": "4.5.6",
"status": "affected",
"version": "4.5.6",
"versionType": "custom"
}
]
},
{
"product": "TAuto Poster",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.4.5*",
"status": "affected",
"version": "1.4.5",
"versionType": "custom"
},
{
"lessThan": "1.4.6",
"status": "affected",
"version": "1.4.6",
"versionType": "custom"
}
]
},
{
"product": "WP TFeed",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.6.7*",
"status": "affected",
"version": "1.6.7",
"versionType": "custom"
},
{
"lessThan": "1.6.8",
"status": "affected",
"version": "1.6.8",
"versionType": "custom"
}
]
},
{
"product": "Effectively Add \u0026 Customize Free Icons For WordPress Menus \u2013 WP Menu Icons Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.9",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
}
]
},
{
"product": "AP Companion",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.7",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
}
]
},
{
"product": "Easiest Contact Form for WordPress \u2013 AP Contact Form",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.6*",
"status": "affected",
"version": "1.0.6",
"versionType": "custom"
},
{
"lessThan": "1.0.7",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
}
]
},
{
"product": "Testimonial WordPress Plugin \u2013 AP Custom Testimonial",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.4.6*",
"status": "affected",
"version": "1.4.6",
"versionType": "custom"
},
{
"lessThan": "1.4.7",
"status": "affected",
"version": "1.4.7",
"versionType": "custom"
}
]
},
{
"product": "Mega Menu Plugin for WordPress \u2013 AP Mega Menu",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "3.0.5*",
"status": "affected",
"version": "3.0.5",
"versionType": "custom"
},
{
"lessThan": "3.0.6",
"status": "affected",
"version": "3.0.6",
"versionType": "custom"
}
]
},
{
"product": "Pricing Table Builder \u2013 AP Pricing Tables Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"changes": [
{
"at": "1.1.3",
"status": "unaffected"
}
],
"lessThan": "1.1.3*",
"status": "affected",
"version": "1.1.3",
"versionType": "custom"
}
]
},
{
"product": "Responsive Notification Bar Plugin for WordPress \u2013 Apex Notification Bar Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.4*",
"status": "affected",
"version": "2.0.4",
"versionType": "custom"
},
{
"lessThan": "2.0.5",
"status": "affected",
"version": "2.0.5",
"versionType": "custom"
}
]
},
{
"product": "Form Store to DB",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.9*",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
},
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.1.0",
"versionType": "custom"
}
]
},
{
"product": "Comments Disable \u2013 AccessPress",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.7*",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
},
{
"lessThan": "1.0.8",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
}
]
},
{
"product": "CTA plugin for WordPress \u2013 Easy Side Tab",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.7*",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
},
{
"lessThan": "1.0.8",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
}
]
},
{
"product": "WordPress Backend Customizer \u2013 Everest Admin Theme Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.7*",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
},
{
"lessThan": "1.0.8",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
}
]
},
{
"product": "Ultimate Coming Soon, Maintenance Mode Plugin for WordPress \u2013 Everest Coming Soon Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.0*",
"status": "affected",
"version": "1.1.0",
"versionType": "custom"
},
{
"lessThan": "1.1.1",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
}
]
},
{
"product": "Free WordPress Plugin To Display Like/Dislike Comment Rating \u2013 Everest Comment Rating Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.4*",
"status": "affected",
"version": "2.0.4",
"versionType": "custom"
},
{
"lessThan": "2.0.5",
"status": "affected",
"version": "2.0.5",
"versionType": "custom"
}
]
},
{
"product": "Beautiful Stat Counter Plugin for WordPress \u2013 Everest Counter Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.7*",
"status": "affected",
"version": "2.0.7",
"versionType": "custom"
},
{
"lessThan": "2.0.8",
"status": "affected",
"version": "2.0.8",
"versionType": "custom"
}
]
},
{
"product": "Beautiful FAQ Plugin for WordPress \u2013 Everest FAQ Manager Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.8*",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
},
{
"lessThan": "1.0.9",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
}
]
},
{
"product": "Responsive Media Gallery Plugin for WordPress \u2013 Everest Gallery Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.8*",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
},
{
"lessThan": "1.0.9",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
}
]
},
{
"product": "Everest GPlaces Business Reviews",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.9*",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
},
{
"lessThan": "2.0.0",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"product": "Everest Review Lite \u2013 User/Admin review plugin for WordPress",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.7"
}
]
},
{
"product": "Free Responsive Tab Plugin For WordPress \u2013 Everest Tab Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.3*",
"status": "affected",
"version": "2.0.3",
"versionType": "custom"
},
{
"lessThan": "2.0.4",
"status": "affected",
"version": "2.0.4",
"versionType": "custom"
}
]
},
{
"product": "Responsive WordPress Timeline Plugin \u2013 Everest Timeline Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.1*",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
},
{
"lessThan": "1.1.2",
"status": "affected",
"version": "1.1.2",
"versionType": "custom"
}
]
},
{
"product": "Inline Call To Action Builder Lite \u2013 Free Call To Action Layer Plugin for WordPress",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.0*",
"status": "affected",
"version": "1.1.0",
"versionType": "custom"
},
{
"lessThan": "1.1.1",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
}
]
},
{
"product": "Product Slider For WooCommerce Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.5*",
"status": "affected",
"version": "1.1.5",
"versionType": "custom"
},
{
"lessThan": "1.1.6",
"status": "affected",
"version": "1.1.6",
"versionType": "custom"
}
]
},
{
"product": "Responsive Clients Logo Gallery Plugin for WordPress \u2013 Smart Logo Showcase Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.7*",
"status": "affected",
"version": "1.1.7",
"versionType": "custom"
},
{
"lessThan": "1.1.8",
"status": "affected",
"version": "1.1.8",
"versionType": "custom"
}
]
},
{
"product": "Smart Scroll Posts for WordPress",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.8*",
"status": "affected",
"version": "2.0.8",
"versionType": "custom"
},
{
"lessThan": "2.0.9",
"status": "affected",
"version": "2.0.9",
"versionType": "custom"
}
]
},
{
"product": "Faster and Easier scroll to Top Plugin for WordPress \u2013 Smart Scroll to Top Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.3*",
"status": "affected",
"version": "1.0.3",
"versionType": "custom"
},
{
"lessThan": "1.0.4",
"status": "affected",
"version": "1.0.4",
"versionType": "custom"
}
]
},
{
"product": "Total GDPR Compliance Lite \u2013 WordPress Plugin for GDPR Compatibility",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.4"
}
]
},
{
"product": "Total Team Lite \u2013 Responsive Team Manager / Showcase Plugin for WordPress",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.1*",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
},
{
"lessThan": "1.1.2",
"status": "affected",
"version": "1.1.2",
"versionType": "custom"
}
]
},
{
"product": "Free Responsive Post/Article Author Section Plugin for WordPress \u2013 Ultimate Author Box Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.2*",
"status": "affected",
"version": "1.1.2",
"versionType": "custom"
},
{
"lessThan": "1.1.3",
"status": "affected",
"version": "1.1.3",
"versionType": "custom"
}
]
},
{
"product": "Contact Form for WordPress \u2013 Ultimate Form Builder Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.5.0*",
"status": "affected",
"version": "1.5.0",
"versionType": "custom"
},
{
"lessThan": "1.5.1",
"status": "affected",
"version": "1.5.1",
"versionType": "custom"
}
]
},
{
"product": "Badge Designer Lite For WooCommerce",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.0*",
"status": "affected",
"version": "1.1.0",
"versionType": "custom"
},
{
"lessThan": "1.1.1",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
}
]
},
{
"product": "WordPress Slider Plugin \u2013 WP 1 Slider",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.2.9*",
"status": "affected",
"version": "1.2.9",
"versionType": "custom"
},
{
"lessThan": "1.3.0",
"status": "affected",
"version": "1.3.0",
"versionType": "custom"
}
]
},
{
"product": "Plugin to Manage / Design WordPress Blog \u2013 WP Blog Manager Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.1*",
"status": "affected",
"version": "1.1.1",
"versionType": "custom"
},
{
"lessThan": "1.1.2",
"status": "affected",
"version": "1.1.2",
"versionType": "custom"
}
]
},
{
"product": "Smartest Way To Design \u0026 Customize WordPress Comments \u0026 Comment Form \u2013 WP Comment Designer Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.3*",
"status": "affected",
"version": "2.0.3",
"versionType": "custom"
},
{
"lessThan": "2.0.4",
"status": "affected",
"version": "2.0.4",
"versionType": "custom"
}
]
},
{
"product": "Cookie Notification Plugin for WordPress \u2013 WP Cookie User Info",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.7*",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
},
{
"lessThan": "1.0.8",
"status": "affected",
"version": "1.0.8",
"versionType": "custom"
}
]
},
{
"product": "Social Review",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.0.9",
"status": "affected",
"version": "1.0.9",
"versionType": "custom"
}
]
},
{
"product": "MContact Button",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "2.0.7",
"status": "affected",
"version": "2.0.7",
"versionType": "custom"
}
]
},
{
"product": "WP Floating Menu \u2013 One page navigator, sticky menu for WordPress",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.4.4*",
"status": "affected",
"version": "1.4.4",
"versionType": "custom"
},
{
"lessThan": "1.4.5",
"status": "affected",
"version": "1.4.5",
"versionType": "custom"
}
]
},
{
"product": "The Easiest WordPress Media Manager Plugin \u2013 WP Media Manager Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.1.2*",
"status": "affected",
"version": "1.1.2",
"versionType": "custom"
},
{
"lessThan": "1.1.3",
"status": "affected",
"version": "1.1.3",
"versionType": "custom"
}
]
},
{
"product": "WP Popup Banners",
"vendor": "AccessPress Themes",
"versions": [
{
"lessThan": "1.2.3*",
"status": "affected",
"version": "1.2.3",
"versionType": "custom"
},
{
"lessThan": "1.2.4",
"status": "affected",
"version": "1.2.4",
"versionType": "custom"
}
]
},
{
"product": "WP Popup Lite \u2013 Responsive popup plugin for WordPress",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.8"
}
]
},
{
"product": "Responsive Products Showcase Listing for WordPress \u2013 WP Product Gallery Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.1.1"
}
]
},
{
"product": "accessbuddy",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.0"
}
]
},
{
"product": "Accesspress Basic",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "3.2.1"
}
]
},
{
"product": "Accesspress Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.92"
}
]
},
{
"product": "Accesspress Mag",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.6.5"
}
]
},
{
"product": "AccessPress Parallax",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "4.5"
}
]
},
{
"product": "accesspress-ray",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.19.5"
}
]
},
{
"product": "AccessPress Root",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.5"
}
]
},
{
"product": "AccessPress Staple",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.9.1"
}
]
},
{
"product": "AccessPress Store",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.4.9"
}
]
},
{
"product": "Agency Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.1.6"
}
]
},
{
"product": "Aplite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.6"
}
]
},
{
"product": "Bingle",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.4"
}
]
},
{
"product": "Bloger",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.6"
}
]
},
{
"product": "Construction Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.5"
}
]
},
{
"product": "Doko",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.27"
}
]
},
{
"product": "Enlighten",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.3.5"
}
]
},
{
"product": "FashStore",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.1"
}
]
},
{
"product": "FotoGraphy",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.4.0"
}
]
},
{
"product": "Gaga Corp",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.8"
}
]
},
{
"product": "Gaga Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.4.2 1.0.8"
}
]
},
{
"product": "One Paze",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.2.8"
}
]
},
{
"product": "parallax-blog",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "3.1.1574941215"
}
]
},
{
"product": "ParallaxSome",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.3.6"
}
]
},
{
"product": "Punte",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.1.2"
}
]
},
{
"product": "Revolve",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "Ripple",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.0"
}
]
},
{
"product": "ScrollMe",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.1.0"
}
]
},
{
"product": "SportsMag",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.1"
}
]
},
{
"product": "StoreVilla",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.4.1"
}
]
},
{
"product": "Swing Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.1.9"
}
]
},
{
"product": "The Launcher",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.3.2"
}
]
},
{
"product": "The Monday",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.4.1"
}
]
},
{
"product": "Uncode Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.3.1"
}
]
},
{
"product": "Unicon Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.6"
}
]
},
{
"product": "VMag",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.2.7"
}
]
},
{
"product": "VMagazine Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.3.5"
}
]
},
{
"product": "Vmagazine News",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.5"
}
]
},
{
"product": "Zigcy Baby",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.6"
}
]
},
{
"product": "Zigcy Cosmetics",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "1.0.5"
}
]
},
{
"product": "Zigcy Lite",
"vendor": "AccessPress Themes",
"versions": [
{
"status": "affected",
"version": "2.0.9"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Harald Eilertsen (Jetpack Scan)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-21T10:45:39.000Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Backdoored Plugins \u0026 Themes from AccessPress Themes",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2021-24867",
"STATE": "PUBLIC",
"TITLE": "Backdoored Plugins \u0026 Themes from AccessPress Themes"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Frontend Post WordPress Plugin \u2013 AccessPress Anonymous Post",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.8.0",
"version_value": "2.8.0"
},
{
"version_affected": "\u003c",
"version_name": "2.8.1",
"version_value": "2.8.1"
}
]
}
},
{
"product_name": "AccessPress Custom CSS",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.1",
"version_value": "2.0.1"
},
{
"version_affected": "\u003c",
"version_name": "2.0.2",
"version_value": "2.0.2"
}
]
}
},
{
"product_name": "AccessPress Custom Post Type",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.8",
"version_value": "1.0.8"
},
{
"version_affected": "\u003c",
"version_name": "1.0.9",
"version_value": "1.0.9"
}
]
}
},
{
"product_name": "Social Auto Poster",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.1.3",
"version_value": "2.1.3"
},
{
"version_affected": "\u003c",
"version_name": "2.1.4",
"version_value": "2.1.4"
}
]
}
},
{
"product_name": "AccessPress iFeeds",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "4.0.3",
"version_value": "4.0.3"
},
{
"version_affected": "\u003c",
"version_name": "4.0.4",
"version_value": "4.0.4"
}
]
}
},
{
"product_name": "PI Button",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "3.3.3",
"version_value": "3.3.3"
},
{
"version_affected": "\u003c",
"version_name": "3.3.4",
"version_value": "3.3.4"
}
]
}
},
{
"product_name": "AccessPress Social Counter",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.9.1",
"version_value": "1.9.1"
},
{
"version_affected": "\u003c",
"version_name": "1.9.2",
"version_value": "1.9.2"
}
]
}
},
{
"product_name": "AccessPress Social Icons",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.8.2",
"version_value": "1.8.2"
},
{
"version_affected": "\u003c",
"version_name": "1.8.3",
"version_value": "1.8.3"
}
]
}
},
{
"product_name": "AccessPress Social Login Lite \u2013 Social Login WordPress Plugin",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "3.4.7",
"version_value": "3.4.7"
},
{
"version_affected": "\u003c",
"version_name": "3.4.8",
"version_value": "3.4.8"
}
]
}
},
{
"product_name": "AccessPress Social Share",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "4.5.5",
"version_value": "4.5.5"
},
{
"version_affected": "\u003c",
"version_name": "4.5.6",
"version_value": "4.5.6"
}
]
}
},
{
"product_name": "TAuto Poster",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.4.5",
"version_value": "1.4.5"
},
{
"version_affected": "\u003c",
"version_name": "1.4.6",
"version_value": "1.4.6"
}
]
}
},
{
"product_name": "WP TFeed",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.6.7",
"version_value": "1.6.7"
},
{
"version_affected": "\u003c",
"version_name": "1.6.8",
"version_value": "1.6.8"
}
]
}
},
{
"product_name": "Effectively Add \u0026 Customize Free Icons For WordPress Menus \u2013 WP Menu Icons Lite",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.9",
"version_value": "1.0.9"
}
]
}
},
{
"product_name": "AP Companion",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.7",
"version_value": "1.0.7"
}
]
}
},
{
"product_name": "Easiest Contact Form for WordPress \u2013 AP Contact Form",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.6",
"version_value": "1.0.6"
},
{
"version_affected": "\u003c",
"version_name": "1.0.7",
"version_value": "1.0.7"
}
]
}
},
{
"product_name": "Testimonial WordPress Plugin \u2013 AP Custom Testimonial",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.4.6",
"version_value": "1.4.6"
},
{
"version_affected": "\u003c",
"version_name": "1.4.7",
"version_value": "1.4.7"
}
]
}
},
{
"product_name": "Mega Menu Plugin for WordPress \u2013 AP Mega Menu",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "3.0.5",
"version_value": "3.0.5"
},
{
"version_affected": "\u003c",
"version_name": "3.0.6",
"version_value": "3.0.6"
}
]
}
},
{
"product_name": "Pricing Table Builder \u2013 AP Pricing Tables Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.3",
"version_value": "1.1.3"
},
{
"version_affected": "\u003c",
"version_name": "1.1.3",
"version_value": "1.1.3"
}
]
}
},
{
"product_name": "Responsive Notification Bar Plugin for WordPress \u2013 Apex Notification Bar Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.4",
"version_value": "2.0.4"
},
{
"version_affected": "\u003c",
"version_name": "2.0.5",
"version_value": "2.0.5"
}
]
}
},
{
"product_name": "Form Store to DB",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.9",
"version_value": "1.0.9"
},
{
"version_affected": "\u003c",
"version_name": "1.1.0",
"version_value": "1.1.0"
}
]
}
},
{
"product_name": "Comments Disable \u2013 AccessPress",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.7",
"version_value": "1.0.7"
},
{
"version_affected": "\u003c",
"version_name": "1.0.8",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "CTA plugin for WordPress \u2013 Easy Side Tab",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.7",
"version_value": "1.0.7"
},
{
"version_affected": "\u003c",
"version_name": "1.0.8",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "WordPress Backend Customizer \u2013 Everest Admin Theme Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.7",
"version_value": "1.0.7"
},
{
"version_affected": "\u003c",
"version_name": "1.0.8",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "Ultimate Coming Soon, Maintenance Mode Plugin for WordPress \u2013 Everest Coming Soon Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.0",
"version_value": "1.1.0"
},
{
"version_affected": "\u003c",
"version_name": "1.1.1",
"version_value": "1.1.1"
}
]
}
},
{
"product_name": "Free WordPress Plugin To Display Like/Dislike Comment Rating \u2013 Everest Comment Rating Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.4",
"version_value": "2.0.4"
},
{
"version_affected": "\u003c",
"version_name": "2.0.5",
"version_value": "2.0.5"
}
]
}
},
{
"product_name": "Beautiful Stat Counter Plugin for WordPress \u2013 Everest Counter Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.7",
"version_value": "2.0.7"
},
{
"version_affected": "\u003c",
"version_name": "2.0.8",
"version_value": "2.0.8"
}
]
}
},
{
"product_name": "Beautiful FAQ Plugin for WordPress \u2013 Everest FAQ Manager Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.8",
"version_value": "1.0.8"
},
{
"version_affected": "\u003c",
"version_name": "1.0.9",
"version_value": "1.0.9"
}
]
}
},
{
"product_name": "Responsive Media Gallery Plugin for WordPress \u2013 Everest Gallery Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.8",
"version_value": "1.0.8"
},
{
"version_affected": "\u003c",
"version_name": "1.0.9",
"version_value": "1.0.9"
}
]
}
},
{
"product_name": "Everest GPlaces Business Reviews",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.9",
"version_value": "1.0.9"
},
{
"version_affected": "\u003c",
"version_name": "2.0.0",
"version_value": "2.0.0"
}
]
}
},
{
"product_name": "Everest Review Lite \u2013 User/Admin review plugin for WordPress",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.7",
"version_value": "1.0.7"
}
]
}
},
{
"product_name": "Free Responsive Tab Plugin For WordPress \u2013 Everest Tab Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.3",
"version_value": "2.0.3"
},
{
"version_affected": "\u003c",
"version_name": "2.0.4",
"version_value": "2.0.4"
}
]
}
},
{
"product_name": "Responsive WordPress Timeline Plugin \u2013 Everest Timeline Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.1",
"version_value": "1.1.1"
},
{
"version_affected": "\u003c",
"version_name": "1.1.2",
"version_value": "1.1.2"
}
]
}
},
{
"product_name": "Inline Call To Action Builder Lite \u2013 Free Call To Action Layer Plugin for WordPress",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.0",
"version_value": "1.1.0"
},
{
"version_affected": "\u003c",
"version_name": "1.1.1",
"version_value": "1.1.1"
}
]
}
},
{
"product_name": "Product Slider For WooCommerce Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.5",
"version_value": "1.1.5"
},
{
"version_affected": "\u003c",
"version_name": "1.1.6",
"version_value": "1.1.6"
}
]
}
},
{
"product_name": "Responsive Clients Logo Gallery Plugin for WordPress \u2013 Smart Logo Showcase Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.7",
"version_value": "1.1.7"
},
{
"version_affected": "\u003c",
"version_name": "1.1.8",
"version_value": "1.1.8"
}
]
}
},
{
"product_name": "Smart Scroll Posts for WordPress",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.8",
"version_value": "2.0.8"
},
{
"version_affected": "\u003c",
"version_name": "2.0.9",
"version_value": "2.0.9"
}
]
}
},
{
"product_name": "Faster and Easier scroll to Top Plugin for WordPress \u2013 Smart Scroll to Top Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.3",
"version_value": "1.0.3"
},
{
"version_affected": "\u003c",
"version_name": "1.0.4",
"version_value": "1.0.4"
}
]
}
},
{
"product_name": "Total GDPR Compliance Lite \u2013 WordPress Plugin for GDPR Compatibility",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.4",
"version_value": "1.0.4"
}
]
}
},
{
"product_name": "Total Team Lite \u2013 Responsive Team Manager / Showcase Plugin for WordPress",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.1",
"version_value": "1.1.1"
},
{
"version_affected": "\u003c",
"version_name": "1.1.2",
"version_value": "1.1.2"
}
]
}
},
{
"product_name": "Free Responsive Post/Article Author Section Plugin for WordPress \u2013 Ultimate Author Box Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.2",
"version_value": "1.1.2"
},
{
"version_affected": "\u003c",
"version_name": "1.1.3",
"version_value": "1.1.3"
}
]
}
},
{
"product_name": "Contact Form for WordPress \u2013 Ultimate Form Builder Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.5.0",
"version_value": "1.5.0"
},
{
"version_affected": "\u003c",
"version_name": "1.5.1",
"version_value": "1.5.1"
}
]
}
},
{
"product_name": "Badge Designer Lite For WooCommerce",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.0",
"version_value": "1.1.0"
},
{
"version_affected": "\u003c",
"version_name": "1.1.1",
"version_value": "1.1.1"
}
]
}
},
{
"product_name": "WordPress Slider Plugin \u2013 WP 1 Slider",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.2.9",
"version_value": "1.2.9"
},
{
"version_affected": "\u003c",
"version_name": "1.3.0",
"version_value": "1.3.0"
}
]
}
},
{
"product_name": "Plugin to Manage / Design WordPress Blog \u2013 WP Blog Manager Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.1",
"version_value": "1.1.1"
},
{
"version_affected": "\u003c",
"version_name": "1.1.2",
"version_value": "1.1.2"
}
]
}
},
{
"product_name": "Smartest Way To Design \u0026 Customize WordPress Comments \u0026 Comment Form \u2013 WP Comment Designer Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "2.0.3",
"version_value": "2.0.3"
},
{
"version_affected": "\u003c",
"version_name": "2.0.4",
"version_value": "2.0.4"
}
]
}
},
{
"product_name": "Cookie Notification Plugin for WordPress \u2013 WP Cookie User Info",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.0.7",
"version_value": "1.0.7"
},
{
"version_affected": "\u003c",
"version_name": "1.0.8",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "Social Review",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.9",
"version_value": "1.0.9"
}
]
}
},
{
"product_name": "MContact Button",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "2.0.7",
"version_value": "2.0.7"
}
]
}
},
{
"product_name": "WP Floating Menu \u2013 One page navigator, sticky menu for WordPress",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.4.4",
"version_value": "1.4.4"
},
{
"version_affected": "\u003c",
"version_name": "1.4.5",
"version_value": "1.4.5"
}
]
}
},
{
"product_name": "The Easiest WordPress Media Manager Plugin \u2013 WP Media Manager Lite",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.1.2",
"version_value": "1.1.2"
},
{
"version_affected": "\u003c",
"version_name": "1.1.3",
"version_value": "1.1.3"
}
]
}
},
{
"product_name": "WP Popup Banners",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "1.2.3",
"version_value": "1.2.3"
},
{
"version_affected": "\u003c",
"version_name": "1.2.4",
"version_value": "1.2.4"
}
]
}
},
{
"product_name": "WP Popup Lite \u2013 Responsive popup plugin for WordPress",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.8",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "Responsive Products Showcase Listing for WordPress \u2013 WP Product Gallery Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.1.1",
"version_value": "1.1.1"
}
]
}
},
{
"product_name": "accessbuddy",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.0",
"version_value": "1.0.0"
}
]
}
},
{
"product_name": "Accesspress Basic",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "3.2.1",
"version_value": "3.2.1"
}
]
}
},
{
"product_name": "Accesspress Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.92",
"version_value": "2.92"
}
]
}
},
{
"product_name": "Accesspress Mag",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.6.5",
"version_value": "2.6.5"
}
]
}
},
{
"product_name": "AccessPress Parallax",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "4.5",
"version_value": "4.5"
}
]
}
},
{
"product_name": "accesspress-ray",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.19.5",
"version_value": "1.19.5"
}
]
}
},
{
"product_name": "AccessPress Root",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.5",
"version_value": "2.5"
}
]
}
},
{
"product_name": "AccessPress Staple",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.9.1",
"version_value": "1.9.1"
}
]
}
},
{
"product_name": "AccessPress Store",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.4.9",
"version_value": "2.4.9"
}
]
}
},
{
"product_name": "Agency Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.1.6",
"version_value": "1.1.6"
}
]
}
},
{
"product_name": "Aplite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.6",
"version_value": "1.0.6"
}
]
}
},
{
"product_name": "Bingle",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.4",
"version_value": "1.0.4"
}
]
}
},
{
"product_name": "Bloger",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.6",
"version_value": "1.2.6"
}
]
}
},
{
"product_name": "Construction Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.5",
"version_value": "1.2.5"
}
]
}
},
{
"product_name": "Doko",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.27",
"version_value": "1.0.27"
}
]
}
},
{
"product_name": "Enlighten",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.3.5",
"version_value": "1.3.5"
}
]
}
},
{
"product_name": "FashStore",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.1",
"version_value": "1.2.1"
}
]
}
},
{
"product_name": "FotoGraphy",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.4.0",
"version_value": "2.4.0"
}
]
}
},
{
"product_name": "Gaga Corp",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.8",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "Gaga Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.4.2",
"version_value": "1.0.8"
}
]
}
},
{
"product_name": "One Paze",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.2.8",
"version_value": "2.2.8"
}
]
}
},
{
"product_name": "parallax-blog",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "3.1.1574941215",
"version_value": "3.1.1574941215"
}
]
}
},
{
"product_name": "ParallaxSome",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.3.6",
"version_value": "1.3.6"
}
]
}
},
{
"product_name": "Punte",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.1.2",
"version_value": "1.1.2"
}
]
}
},
{
"product_name": "Revolve",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.3.1",
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "Ripple",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.0",
"version_value": "1.2.0"
}
]
}
},
{
"product_name": "ScrollMe",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.1.0",
"version_value": "2.1.0"
}
]
}
},
{
"product_name": "SportsMag",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.1",
"version_value": "1.2.1"
}
]
}
},
{
"product_name": "StoreVilla",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.4.1",
"version_value": "1.4.1"
}
]
}
},
{
"product_name": "Swing Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.1.9",
"version_value": "1.1.9"
}
]
}
},
{
"product_name": "The Launcher",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.3.2",
"version_value": "1.3.2"
}
]
}
},
{
"product_name": "The Monday",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.4.1",
"version_value": "1.4.1"
}
]
}
},
{
"product_name": "Uncode Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.3.1",
"version_value": "1.3.1"
}
]
}
},
{
"product_name": "Unicon Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.6",
"version_value": "1.2.6"
}
]
}
},
{
"product_name": "VMag",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.2.7",
"version_value": "1.2.7"
}
]
}
},
{
"product_name": "VMagazine Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.3.5",
"version_value": "1.3.5"
}
]
}
},
{
"product_name": "Vmagazine News",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.5",
"version_value": "1.0.5"
}
]
}
},
{
"product_name": "Zigcy Baby",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.6",
"version_value": "1.0.6"
}
]
}
},
{
"product_name": "Zigcy Cosmetics",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "1.0.5",
"version_value": "1.0.5"
}
]
}
},
{
"product_name": "Zigcy Lite",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "2.0.9",
"version_value": "2.0.9"
}
]
}
}
]
},
"vendor_name": "AccessPress Themes"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Harald Eilertsen (Jetpack Scan)"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-912 Hidden Functionality"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/9c76bada-fa32-4c2f-9855-d0efd1e63eff"
},
{
"name": "https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/",
"refsource": "MISC",
"url": "https://jetpack.com/2022/01/18/backdoor-found-in-themes-and-plugins-from-accesspress-themes/"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2021-24867",
"datePublished": "2022-02-21T10:45:39.000Z",
"dateReserved": "2021-01-14T00:00:00.000Z",
"dateUpdated": "2024-08-03T19:49:13.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-4229 (GCVE-0-2021-4229)
Vulnerability from cvelistv5 – Published: 2022-05-24 15:30 – Updated: 2025-04-15 14:38
VLAI
EPSS
VEX
Title
ua-parser-js Crypto Mining backdoor
Summary
A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-912 - Backdoor
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/advisories/GHSA-pjwm-rvh2-c87w | x_refsource_MISC |
| https://github.com/faisalman/ua-parser-js/issues/536 | x_refsource_MISC |
| https://vuldb.com/?id.185453 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unspecified | ua-parser-js |
Affected:
0.7.29
Affected: 0.8.0 Affected: 1.0.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:23:08.902Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/faisalman/ua-parser-js/issues/536"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.185453"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-4229",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:14:48.297471Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:38:30.138Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ua-parser-js",
"vendor": "unspecified",
"versions": [
{
"status": "affected",
"version": "0.7.29"
},
{
"status": "affected",
"version": "0.8.0"
},
{
"status": "affected",
"version": "1.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Backdoor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-24T15:30:35.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/faisalman/ua-parser-js/issues/536"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.185453"
}
],
"title": "ua-parser-js Crypto Mining backdoor",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2021-4229",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "ua-parser-js Crypto Mining backdoor"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ua-parser-js",
"version": {
"version_data": [
{
"version_value": "0.7.29"
},
{
"version_value": "0.8.0"
},
{
"version_value": "1.0.0"
}
]
}
}
]
},
"vendor_name": ""
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "5.0",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-912 Backdoor"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w",
"refsource": "MISC",
"url": "https://github.com/advisories/GHSA-pjwm-rvh2-c87w"
},
{
"name": "https://github.com/faisalman/ua-parser-js/issues/536",
"refsource": "MISC",
"url": "https://github.com/faisalman/ua-parser-js/issues/536"
},
{
"name": "https://vuldb.com/?id.185453",
"refsource": "MISC",
"url": "https://vuldb.com/?id.185453"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2021-4229",
"datePublished": "2022-05-24T15:30:35.000Z",
"dateReserved": "2022-05-24T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:38:30.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-28593 (GCVE-0-2020-28593)
Vulnerability from cvelistv5 – Published: 2021-04-15 13:41 – Updated: 2024-08-04 16:40
VLAI
EPSS
VEX
Summary
A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability.
Severity
8.1 (High)
CWE
- CWE-912 - Hidden Functionality
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://talosintelligence.com/vulnerability_repor… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:40:59.283Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1217"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Cosori",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912: Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-15T13:41:22.000Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1217"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "talos-cna@cisco.com",
"ID": "CVE-2020-28593",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cosori",
"version": {
"version_data": [
{
"version_value": "Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability."
}
]
},
"impact": {
"cvss": {
"baseScore": 8.1,
"baseSeverity": "High",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-912: Hidden Functionality"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1217",
"refsource": "MISC",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2020-1217"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2020-28593",
"datePublished": "2021-04-15T13:41:22.000Z",
"dateReserved": "2020-11-13T00:00:00.000Z",
"dateUpdated": "2024-08-04T16:40:59.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-16204 (GCVE-0-2020-16204)
Vulnerability from cvelistv5 – Published: 2020-09-01 20:46 – Updated: 2024-08-04 13:37
VLAI
EPSS
VEX
Summary
The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / 702M12-W (all versions).
Severity
No CVSS data available.
CWE
- CWE-912 - HIDDEN FUNCTIONALITY (BACKDOOR) CWE-912
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01 | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2020/Sep/6 | mailing-listx_refsource_FULLDISC |
| http://packetstormsecurity.com/files/159064/Red-L… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | N-Tron 702-W / 702M12-W |
Affected:
Versions prior to all versions
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:37:53.987Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01"
},
{
"name": "20200902 SEC Consult SA-20200902-0 :: Multiple Vulnerabilities in Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2020/Sep/6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/159064/Red-Lion-N-Tron-702-W-702M12-W-2.0.26-XSS-CSRF-Shell.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "N-Tron 702-W / 702M12-W",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Versions prior to all versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / 702M12-W (all versions)."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "HIDDEN FUNCTIONALITY (BACKDOOR) CWE-912",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-04T20:06:14.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01"
},
{
"name": "20200902 SEC Consult SA-20200902-0 :: Multiple Vulnerabilities in Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2020/Sep/6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/159064/Red-Lion-N-Tron-702-W-702M12-W-2.0.26-XSS-CSRF-Shell.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2020-16204",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "N-Tron 702-W / 702M12-W",
"version": {
"version_data": [
{
"version_value": "Versions prior to all versions"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / 702M12-W (all versions)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "HIDDEN FUNCTIONALITY (BACKDOOR) CWE-912"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01"
},
{
"name": "20200902 SEC Consult SA-20200902-0 :: Multiple Vulnerabilities in Red Lion N-Tron 702-W, Red Lion N-Tron 702M12-W",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2020/Sep/6"
},
{
"name": "http://packetstormsecurity.com/files/159064/Red-Lion-N-Tron-702-W-702M12-W-2.0.26-XSS-CSRF-Shell.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/159064/Red-Lion-N-Tron-702-W-702M12-W-2.0.26-XSS-CSRF-Shell.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-16204",
"datePublished": "2020-09-01T20:46:26.000Z",
"dateReserved": "2020-07-31T00:00:00.000Z",
"dateUpdated": "2024-08-04T13:37:53.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-14487 (GCVE-0-2020-14487)
Vulnerability from cvelistv5 – Published: 2020-07-29 13:22 – Updated: 2024-09-16 19:21
VLAI
EPSS
VEX
Title
OpenClinic GA
Summary
OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands.
Severity
9.4 (Critical)
CWE
- CWE-912 - HIDDEN FUNCTIONALITY CWE-912
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open source | OpenClinic GA |
Affected:
5.09.02
|
Date Public
2020-07-02 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:46:34.658Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenClinic GA",
"vendor": "open source",
"versions": [
{
"status": "affected",
"version": "5.09.02"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Brian D. Hysell reported these vulnerabilities to CISA."
}
],
"datePublic": "2020-07-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "HIDDEN FUNCTIONALITY CWE-912",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-29T13:22:25.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01"
}
],
"solutions": [
{
"lang": "en",
"value": "Update to version 5.89.05b or newer."
}
],
"source": {
"advisory": "ICSMA-20-184-01 OpenClinic GA",
"discovery": "EXTERNAL"
},
"title": "OpenClinic GA",
"workarounds": [
{
"lang": "en",
"value": "OpenClinic GA is aware of these vulnerabilities but has not provided any confirmation of their resolution. Please upgrade to the latest version to ensure you have all current fixes."
}
],
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2020-07-02T00:00:00.000Z",
"ID": "CVE-2020-14487",
"STATE": "PUBLIC",
"TITLE": "OpenClinic GA"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OpenClinic GA",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "5.09.02"
}
]
}
}
]
},
"vendor_name": "open source"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Brian D. Hysell reported these vulnerabilities to CISA."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "HIDDEN FUNCTIONALITY CWE-912"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update to version 5.89.05b or newer."
}
],
"source": {
"advisory": "ICSMA-20-184-01 OpenClinic GA",
"discovery": "EXTERNAL"
},
"work_around": [
{
"lang": "en",
"value": "OpenClinic GA is aware of these vulnerabilities but has not provided any confirmation of their resolution. Please upgrade to the latest version to ensure you have all current fixes."
}
]
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-14487",
"datePublished": "2020-07-29T13:22:25.067Z",
"dateReserved": "2020-06-19T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:21:13.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-12504 (GCVE-0-2020-12504)
Vulnerability from cvelistv5 – Published: 2020-10-15 18:42 – Updated: 2024-09-16 17:09
VLAI
EPSS
VEX
Title
Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products
Summary
Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service.
Severity
9.8 (Critical)
CWE
- CWE-912 - Hidden Functionality
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://cert.vde.com/de-de/advisories/vde-2020-040 | x_refsource_CONFIRM |
| http://seclists.org/fulldisclosure/2021/Jun/0 | mailing-listx_refsource_FULLDISC |
| http://packetstormsecurity.com/files/162903/Koren… | x_refsource_MISC |
| https://sec-consult.com/vulnerability-lab/advisor… | x_refsource_CONFIRM |
| https://cert.vde.com/en-us/advisories/vde-2020-053 | x_refsource_CONFIRM |
| http://packetstormsecurity.com/files/165875/Koren… | x_refsource_MISC |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Pepperl+Fuchs | P+F Comtrol RocketLinx |
Affected:
ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510-XTE, ES9528/ES9528-XT all
Affected: ES7510-XT , < 2.1.1 (custom) Affected: ES8510 , < 3.1.1 (custom) |
|
| Pepperl+Fuchs | P+F Comtrol RocketLinx |
Affected:
ICRL-M-8RJ45/4SFP-G-DIN , ≤ 1.2.3
(custom)
Affected: ICRL-M-16RJ45/4CP-G-DIN , ≤ 1.2.3 (custom) |
|
| Korenix | JetNet |
Affected:
5428G-20SFP , ≤ V1.0
(custom)
Affected: 5810G , ≤ V1.1 (custom) Affected: 4706F , ≤ V2.3b (custom) Affected: 4510 , ≤ V3.0b (custom) Affected: 5310 , < V1.6 (custom) |
|
| Westermo | PMI-110-F2G |
Affected:
unspecified , < V1.8
(custom)
|
Date Public
2020-10-07 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:56:52.052Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert.vde.com/de-de/advisories/vde-2020-040"
},
{
"name": "20210601 SEC Consult SA-20210601-0 :: Multiple critical vulnerabilities in Korenix Technology JetNet Series",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2021/Jun/0"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-053"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "P+F Comtrol RocketLinx",
"vendor": "Pepperl+Fuchs",
"versions": [
{
"status": "affected",
"version": "ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510-XTE, ES9528/ES9528-XT all"
},
{
"lessThan": "2.1.1",
"status": "affected",
"version": "ES7510-XT",
"versionType": "custom"
},
{
"lessThan": "3.1.1",
"status": "affected",
"version": "ES8510",
"versionType": "custom"
}
]
},
{
"product": "P+F Comtrol RocketLinx",
"vendor": "Pepperl+Fuchs",
"versions": [
{
"lessThanOrEqual": "1.2.3",
"status": "affected",
"version": "ICRL-M-8RJ45/4SFP-G-DIN",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.2.3",
"status": "affected",
"version": "ICRL-M-16RJ45/4CP-G-DIN",
"versionType": "custom"
}
]
},
{
"product": "JetNet",
"vendor": "Korenix",
"versions": [
{
"lessThanOrEqual": "V1.0",
"status": "affected",
"version": "5428G-20SFP",
"versionType": "custom"
},
{
"lessThanOrEqual": "V1.1",
"status": "affected",
"version": "5810G",
"versionType": "custom"
},
{
"lessThanOrEqual": "V2.3b",
"status": "affected",
"version": "4706F",
"versionType": "custom"
},
{
"lessThanOrEqual": "V3.0b",
"status": "affected",
"version": "4510",
"versionType": "custom"
},
{
"lessThan": "V1.6",
"status": "affected",
"version": "5310",
"versionType": "custom"
}
]
},
{
"product": "PMI-110-F2G",
"vendor": "Westermo",
"versions": [
{
"lessThan": "V1.8",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "T. Weber (SEC Consult Vulnerability Lab)"
},
{
"lang": "en",
"value": "Coordinated by CERT@VDE"
}
],
"datePublic": "2020-10-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Hidden Functionality",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T19:06:15.000Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert.vde.com/de-de/advisories/vde-2020-040"
},
{
"name": "20210601 SEC Consult SA-20210601-0 :: Multiple critical vulnerabilities in Korenix Technology JetNet Series",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2021/Jun/0"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert.vde.com/en-us/advisories/vde-2020-053"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html"
}
],
"solutions": [
{
"lang": "en",
"value": "For ICRL-M-8RJ45/4SFP-G-DIN and ICRL-M-16RJ45/4CP-G-DIN:\nUpdate to Firmware 1.3.1 and deactivate TFTP-Service.\n\nFor all other devices:\nAn external protective measure is required.\n\n1) Traffic from untrusted networks to the device should be blocked by a firewall. Especially\ntraffic targeting the administration webpage.\n\n2) Administrator and user access should be protected by a secure password and only be\navailable to a very limited group of people."
}
],
"source": {
"advisory": "VDE-2020-040",
"discovery": "EXTERNAL"
},
"title": "Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2020-10-07T13:10:00.000Z",
"ID": "CVE-2020-12504",
"STATE": "PUBLIC",
"TITLE": "Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "P+F Comtrol RocketLinx",
"version": {
"version_data": [
{
"version_affected": "=",
"version_name": "ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510-XTE, ES9528/ES9528-XT",
"version_value": "all"
},
{
"version_affected": "\u003c",
"version_name": "ES7510-XT",
"version_value": "2.1.1"
},
{
"version_affected": "\u003c",
"version_name": "ES8510",
"version_value": "3.1.1"
}
]
}
},
{
"product_name": "P+F Comtrol RocketLinx",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "ICRL-M-8RJ45/4SFP-G-DIN",
"version_value": "1.2.3"
},
{
"version_affected": "\u003c=",
"version_name": "ICRL-M-16RJ45/4CP-G-DIN",
"version_value": "1.2.3"
}
]
}
}
]
},
"vendor_name": "Pepperl+Fuchs"
},
{
"product": {
"product_data": [
{
"product_name": "JetNet",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "5428G-20SFP",
"version_value": "V1.0"
},
{
"version_affected": "\u003c=",
"version_name": "5810G",
"version_value": "V1.1"
},
{
"version_affected": "\u003c=",
"version_name": "4706F",
"version_value": "V2.3b"
},
{
"version_affected": "\u003c=",
"version_name": "4510",
"version_value": "V3.0b"
},
{
"version_affected": "\u003c",
"version_name": "5310",
"version_value": "V1.6"
}
]
}
}
]
},
"vendor_name": "Korenix"
},
{
"product": {
"product_data": [
{
"product_name": "PMI-110-F2G",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "V1.8"
}
]
}
}
]
},
"vendor_name": "Westermo"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "T. Weber (SEC Consult Vulnerability Lab)"
},
{
"lang": "eng",
"value": "Coordinated by CERT@VDE"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-912 Hidden Functionality"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert.vde.com/de-de/advisories/vde-2020-040",
"refsource": "CONFIRM",
"url": "https://cert.vde.com/de-de/advisories/vde-2020-040"
},
{
"name": "20210601 SEC Consult SA-20210601-0 :: Multiple critical vulnerabilities in Korenix Technology JetNet Series",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2021/Jun/0"
},
{
"name": "http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/162903/Korenix-CSRF-Backdoor-Accounts-Command-Injection-Missing-Authentication.html"
},
{
"name": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/",
"refsource": "CONFIRM",
"url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-korenix-technology-westermo-pepperl-fuchs/"
},
{
"name": "https://cert.vde.com/en-us/advisories/vde-2020-053",
"refsource": "CONFIRM",
"url": "https://cert.vde.com/en-us/advisories/vde-2020-053"
},
{
"name": "http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/165875/Korenix-Technology-JetWave-CSRF-Command-Injection-Missing-Authentication.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "For ICRL-M-8RJ45/4SFP-G-DIN and ICRL-M-16RJ45/4CP-G-DIN:\nUpdate to Firmware 1.3.1 and deactivate TFTP-Service.\n\nFor all other devices:\nAn external protective measure is required.\n\n1) Traffic from untrusted networks to the device should be blocked by a firewall. Especially\ntraffic targeting the administration webpage.\n\n2) Administrator and user access should be protected by a secure password and only be\navailable to a very limited group of people."
}
],
"source": {
"advisory": "VDE-2020-040",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2020-12504",
"datePublished": "2020-10-15T18:42:59.041Z",
"dateReserved": "2020-04-30T00:00:00.000Z",
"dateUpdated": "2024-09-16T17:09:09.147Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-3352 (GCVE-0-2020-3352)
Vulnerability from cvelistv5 – Published: 2020-10-21 18:36 – Updated: 2024-11-13 17:48
VLAI
EPSS
VEX
Title
Cisco Firepower Threat Defense Software Hidden Commands Vulnerability
Summary
A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. The vulnerability is due to the presence of undocumented configuration commands. An attacker could exploit this vulnerability by performing specific steps that make the hidden commands accessible. A successful exploit could allow the attacker to make configuration changes to various sections of an affected device that should not be exposed to CLI access.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://tools.cisco.com/security/center/content/C… | vendor-advisoryx_refsource_CISCO |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cisco | Cisco Firepower Threat Defense Software |
Affected:
n/a
|
Date Public
2020-10-21 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T07:30:58.147Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20201021 Cisco Firepower Threat Defense Software Hidden Commands Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-hidcmd-pFDeWVBd"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2020-3352",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-13T17:22:49.430236Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-13T17:48:10.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco Firepower Threat Defense Software",
"vendor": "Cisco",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2020-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. The vulnerability is due to the presence of undocumented configuration commands. An attacker could exploit this vulnerability by performing specific steps that make the hidden commands accessible. A successful exploit could allow the attacker to make configuration changes to various sections of an affected device that should not be exposed to CLI access."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-10-21T18:36:38.000Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20201021 Cisco Firepower Threat Defense Software Hidden Commands Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-hidcmd-pFDeWVBd"
}
],
"source": {
"advisory": "cisco-sa-ftd-hidcmd-pFDeWVBd",
"defect": [
[
"CSCvq43920"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Firepower Threat Defense Software Hidden Commands Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2020-10-21T16:00:00",
"ID": "CVE-2020-3352",
"STATE": "PUBLIC",
"TITLE": "Cisco Firepower Threat Defense Software Hidden Commands Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco Firepower Threat Defense Software",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. The vulnerability is due to the presence of undocumented configuration commands. An attacker could exploit this vulnerability by performing specific steps that make the hidden commands accessible. A successful exploit could allow the attacker to make configuration changes to various sections of an affected device that should not be exposed to CLI access."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "5.3",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-912"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20201021 Cisco Firepower Threat Defense Software Hidden Commands Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-hidcmd-pFDeWVBd"
}
]
},
"source": {
"advisory": "cisco-sa-ftd-hidcmd-pFDeWVBd",
"defect": [
[
"CSCvq43920"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2020-3352",
"datePublished": "2020-10-21T18:36:38.357Z",
"dateReserved": "2019-12-12T00:00:00.000Z",
"dateUpdated": "2024-11-13T17:48:10.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-17919 (GCVE-0-2018-17919)
Vulnerability from cvelistv5 – Published: 2018-10-10 15:00 – Updated: 2024-09-16 18:03
VLAI
EPSS
VEX
Summary
All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams.
Severity
No CVSS data available.
CWE
- CWE-912 - HIDDEN FUNCTIONALITY CWE-912
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hangzhou Xiongmai Technology Co., Ltd | XMeye P2P Cloud Server |
Affected:
All versions
|
Date Public
2018-10-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:01:14.661Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "XMeye P2P Cloud Server",
"vendor": "Hangzhou Xiongmai Technology Co., Ltd",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
}
],
"datePublic": "2018-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account \"default\" with its default password to login to XMeye and access/view video streams."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "HIDDEN FUNCTIONALITY CWE-912",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-10T14:57:01.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2018-10-09T00:00:00",
"ID": "CVE-2018-17919",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "XMeye P2P Cloud Server",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
}
]
},
"vendor_name": "Hangzhou Xiongmai Technology Co., Ltd"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account \"default\" with its default password to login to XMeye and access/view video streams."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "HIDDEN FUNCTIONALITY CWE-912"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-282-06"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2018-17919",
"datePublished": "2018-10-10T15:00:00.000Z",
"dateReserved": "2018-10-02T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:03:48.747Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-20084 (GCVE-0-2017-20084)
Vulnerability from cvelistv5 – Published: 2022-06-22 06:10 – Updated: 2025-04-15 14:15
VLAI
EPSS
VEX
Title
JUNG Smart Visu Server KNX Group Address backdoor
Summary
A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical. Affected by this vulnerability is an unknown functionality of the component KNX Group Address. The manipulation leads to backdoor. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-912 - Backdoor
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://seclists.org/fulldisclosure/2017/Feb/18 | x_refsource_MISC |
| https://vuldb.com/?id.96817 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| JUNG | Smart Visu Server |
Affected:
1.0.804
Affected: 1.0.830 Affected: 1.0.832 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:45:25.474Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/18"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.96817"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2017-20084",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:08:58.502445Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:15:30.202Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Smart Visu Server",
"vendor": "JUNG",
"versions": [
{
"status": "affected",
"version": "1.0.804"
},
{
"status": "affected",
"version": "1.0.830"
},
{
"status": "affected",
"version": "1.0.832"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "T. Weber"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical. Affected by this vulnerability is an unknown functionality of the component KNX Group Address. The manipulation leads to backdoor. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Backdoor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-22T06:10:17.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/18"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.96817"
}
],
"title": "JUNG Smart Visu Server KNX Group Address backdoor",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2017-20084",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "JUNG Smart Visu Server KNX Group Address backdoor"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Smart Visu Server",
"version": {
"version_data": [
{
"version_value": "1.0.804"
},
{
"version_value": "1.0.830"
},
{
"version_value": "1.0.832"
}
]
}
}
]
},
"vendor_name": "JUNG"
}
]
}
},
"credit": "T. Weber",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical. Affected by this vulnerability is an unknown functionality of the component KNX Group Address. The manipulation leads to backdoor. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "5.3",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-912 Backdoor"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://seclists.org/fulldisclosure/2017/Feb/18",
"refsource": "MISC",
"url": "http://seclists.org/fulldisclosure/2017/Feb/18"
},
{
"name": "https://vuldb.com/?id.96817",
"refsource": "MISC",
"url": "https://vuldb.com/?id.96817"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2017-20084",
"datePublished": "2022-06-22T06:10:18.000Z",
"dateReserved": "2022-06-19T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:15:30.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-20083 (GCVE-0-2017-20083)
Vulnerability from cvelistv5 – Published: 2022-06-22 06:10 – Updated: 2025-04-15 14:15
VLAI
EPSS
VEX
Title
JUNG Smart Visu Server SSH Server backdoor
Summary
A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. Affected is an unknown function of the component SSH Server. The manipulation leads to backdoor. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-912 - Backdoor
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://seclists.org/fulldisclosure/2017/Feb/18 | x_refsource_MISC |
| https://vuldb.com/?id.96816 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| JUNG | Smart Visu Server |
Affected:
1.0.804
Affected: 1.0.830 Affected: 1.0.832 |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:45:25.257Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/18"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.96816"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2017-20083",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:09:02.314841Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:15:44.706Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Smart Visu Server",
"vendor": "JUNG",
"versions": [
{
"status": "affected",
"version": "1.0.804"
},
{
"status": "affected",
"version": "1.0.830"
},
{
"status": "affected",
"version": "1.0.832"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "T. Weber"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. Affected is an unknown function of the component SSH Server. The manipulation leads to backdoor. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-912",
"description": "CWE-912 Backdoor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-22T06:10:16.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/18"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.96816"
}
],
"title": "JUNG Smart Visu Server SSH Server backdoor",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2017-20083",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "JUNG Smart Visu Server SSH Server backdoor"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Smart Visu Server",
"version": {
"version_data": [
{
"version_value": "1.0.804"
},
{
"version_value": "1.0.830"
},
{
"version_value": "1.0.832"
}
]
}
}
]
},
"vendor_name": "JUNG"
}
]
}
},
"credit": "T. Weber",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. Affected is an unknown function of the component SSH Server. The manipulation leads to backdoor. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.900 is able to address this issue. It is recommended to upgrade the affected component."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "5.3",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-912 Backdoor"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://seclists.org/fulldisclosure/2017/Feb/18",
"refsource": "MISC",
"url": "http://seclists.org/fulldisclosure/2017/Feb/18"
},
{
"name": "https://vuldb.com/?id.96816",
"refsource": "MISC",
"url": "https://vuldb.com/?id.96816"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2017-20083",
"datePublished": "2022-06-22T06:10:16.000Z",
"dateReserved": "2022-06-19T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:15:44.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Installation
Always verify the integrity of the product that is being installed.
CAPEC-133: Try All Common Switches
An attacker attempts to invoke all common switches and options in the target application for the purpose of discovering weaknesses in the target. For example, in some applications, adding a --debug switch causes debugging information to be displayed, which can sometimes reveal sensitive processing or configuration information to an attacker. This attack differs from other forms of API abuse in that the attacker is indiscriminately attempting to invoke options in the hope that one of them will work rather than specifically targeting a known option. Nonetheless, even if the attacker is familiar with the published options of a targeted application this attack method may still be fruitful as it might discover unpublicized functionality.
CAPEC-190: Reverse Engineer an Executable to Expose Assumed Hidden Functionality
An attacker analyzes a binary file or executable for the purpose of discovering the structure, function, and possibly source-code of the file by using a variety of analysis techniques to effectively determine how the software functions and operates. This type of analysis is also referred to as Reverse Code Engineering, as techniques exist for extracting source code from an executable. Several techniques are often employed for this purpose, both black box and white box. The use of computer bus analyzers and packet sniffers allows the binary to be studied at a level of interactions with its computing environment, such as a host OS, inter-process communication, and/or network communication. This type of analysis falls into the 'black box' category because it involves behavioral analysis of the software without reference to source code, object code, or protocol specifications.