PatchTheCVEnibbleblog vulnerabilities and fixes
Recent CVEs affecting nibbleblog, with upgrade or downgrade steps. 4 tracked.
nibbleblog has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2021-01-27. Highest priority: CVE-2019-7719 (score 64/100).
- CVE-2020-23356 HIGH 7.5 DOWNGRADE dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is us
- CVE-2019-7719 CRITICAL 9.8 DOWNGRADE Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then maki
- CVE-2018-6470 MEDIUM 5.3 DOWNGRADE Nibbleblog 4.0.5 on macOS defaults to having .DS_Store in each directory, causing DS_Store information to leak
- CVE-2018-16604 HIGH 7.2 DOWNGRADE An issue was discovered in Nibbleblog v4.0.5
FAQ
How do I fix nibbleblog vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nibbleblog being exploited right now?
None of the tracked nibbleblog CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nibbleblog CVE should I patch first?
CVE-2019-7719 currently ranks highest (64/100): Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then maki.