Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
900 results · page 10 of 18
Aug 2, 2023ngiflib commit fb271 was discovered to contain a segmentation violation via the function "main" at gif2tag.c.CVE-2023-39113 · Other software · Miniupnp Project · reported by MITREMedium 5.5
ngiflib commit fb271 was discovered to contain a segmentation violation via the function "main" at gif2tag.c. This vulnerability is triggered when running the program gif2tga.
- Product
- Ngiflib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2023Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin polCVE-2023-4045 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Jul 26, 2023The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoCVE-2023-20891 · Other software · VMware · reported by security@vmware.comMedium 6.5
The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.
- Product
- VMware Tanzu Application Service for VMs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function BackwardPass::IsEmptyLoopAfterMemOp().CVE-2023-37143 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5.5
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function BackwardPass::IsEmptyLoopAfterMemOp().
- Product
- Chakracore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees().CVE-2023-37142 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5.5
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees().
- Product
- Chakracore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray().CVE-2023-37141 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5.5
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray().
- Product
- Chakracore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2023ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariablesWalker::GetChildrenCount().CVE-2023-37140 · Computers, phones & browsers · Microsoft · reported by MITREMedium 5.5
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariablesWalker::GetChildrenCount().
- Product
- Chakracore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the BM_ParseIndexValueReplace function at /lib/libgpac.so.CVE-2023-37767 · Other software · gpac · reported by MITREMedium 5.5
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the BM_ParseIndexValueReplace function at /lib/libgpac.so.
- Product
- gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_isom_remove_user_data function at /lib/libgpac.so.CVE-2023-37766 · Other software · Gpac · reported by MITREMedium 5.5
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_isom_remove_user_data function at /lib/libgpac.so.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_dump_vrml_sffield function at /lib/libgpac.so.CVE-2023-37765 · Other software · Gpac · reported by MITREMedium 5.5
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_dump_vrml_sffield function at /lib/libgpac.so.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the dump_isom_scene function at /mp4box/filedump.c.CVE-2023-37174 · Other software · Gpac · reported by MITREMedium 5.5
GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the dump_isom_scene function at /mp4box/filedump.c.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2023Windows CNG Key Isolation Service Elevation of Privilege VulnerabilityCVE-2023-35340 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 6, 2023An access violation vulnerability exists in the eventcore functionality of Milesight UR32L v32.3.0.5.CVE-2023-23571 · Other software · Milesight · reported by talos-cna@cisco.comHigh 7.5
An access violation vulnerability exists in the eventcore functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to denial of service. An attacker can send a network request to trigger this vulnerability.
- Product
- UR32L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jun 28, 2023In FaceStatsAnalyzer::InterpolateWeightList of face_stats_analyzer.cc, there is a possible out of bounds read due to a missing bounds check.CVE-2023-21152 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In FaceStatsAnalyzer::InterpolateWeightList of face_stats_analyzer.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-269174022References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 19, 2023When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in the same proCVE-2023-34415 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
When choosing a site-isolated process for a document loaded from a data: URL that was the result of a redirect, Firefox would load that document in the same process as the site that issued the redirect. This bypassed the site-isolation protections against Spectre-like attacks on sites that host an "open redirect". Firefox no longer follows HTTP redirects to data: URLs. This vulnerability affects Firefox < 114.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgsecurity.gentoo.org
May 24, 2023The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instancesCVE-2023-33946 · Other software · Liferay · reported by security@liferay.comLow 2.7
The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.
- Product
- Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordliferay.devliferay.dev
May 18, 2023redis v7.0.10 was discovered to contain a segmentation violation.CVE-2023-31655 · Other software · Redis · reported by MITREHigh 7.5
redis v7.0.10 was discovered to contain a segmentation violation. This vulnerability allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
- Product
- Redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.netapp.com
May 17, 2023yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function do_directive at /nasm/nasm-pp.c.CVE-2023-31724 · Other software · Yasm Project · reported by MITREHigh 7.8
yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function do_directive at /nasm/nasm-pp.c.
- Product
- Yasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function expand_mmac_params at /nasm/nasm-pp.c.CVE-2023-31723 · Other software · Yasm Project · reported by MITREMedium 5.5
yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function expand_mmac_params at /nasm/nasm-pp.c.
- Product
- Yasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023In registerReceiverWithFeature of ActivityManagerService.java, there is a possible way for isolated processes to register a broadcast receiver due to a permissiCVE-2023-21117 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In registerReceiverWithFeature of ActivityManagerService.java, there is a possible way for isolated processes to register a broadcast receiver due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-263358101
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
May 10, 2023podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent.CVE-2023-31556 · Other software · Podofo Project · reported by MITREMedium 6.5
podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfDictionary::findKeyParent.
- Product
- Podofo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfObject::DelayedLoad.CVE-2023-31555 · Other software · Podofo Project · reported by MITREMedium 6.5
podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfObject::DelayedLoad.
- Product
- Podofo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry.CVE-2023-30408 · Other software · Jerryscript · reported by MITREMedium 5.5
Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c.CVE-2023-30406 · Other software · Jerryscript · reported by MITREMedium 5.5
Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpers.c.
- Product
- Jerryscript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by write access violation.CVE-2023-29067 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Apr 14, 2023A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by read access violation.CVE-2023-27915 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
- Product
- Autocad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Apr 13, 2023libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() at /client/client_control.c.CVE-2023-27772 · Other software · Mz-automation · reported by MITREHigh 7.5
libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() at /client/client_control.c.
- Product
- Libiec61850
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c.CVE-2023-29581 · Other software · yasm_project · reported by MITREMedium 5.5
yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c. NOTE: although a libyasm application could become unavailable if this were exploited, the vendor's position is that there is no security relevance because there is either supposed to be input validation before data reaches libyasm, or a sandbox in which the application runs.
- Product
- yasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Apr 12, 2023yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.CVE-2023-29580 · Other software · Yasm Project · reported by MITREMedium 5.5
yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.
- Product
- Yasm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_TrunAtom::SetDataOffset(int) function in Ap4TrunAtom.h.CVE-2023-29576 · Other software · Axiosys · reported by MITREMedium 5.5
Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_TrunAtom::SetDataOffset(int) function in Ap4TrunAtom.h.
- Product
- Bento4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Microsoft Windows CNG Key Isolation Service Privilege Escalation VulnerabilityCVE-2023-28229 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7
Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.
- Product
- Windows CNG Key Isolation Service
- On CISA’s list since
- Oct 4, 2023 (federal fix deadline Oct 25, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2023Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_lvlhsh_find at src/njs_lvlhsh.c.CVE-2023-27730 · Network & remote access · F5 · reported by MITREHigh 7.5
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_lvlhsh_find at src/njs_lvlhsh.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2023Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_dump_is_recursive at src/njs_vmcode.c.CVE-2023-27728 · Network & remote access · F5 · reported by MITREHigh 7.5
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_dump_is_recursive at src/njs_vmcode.c.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2023Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_function_frame at src/njs_function.h.CVE-2023-27727 · Network & remote access · F5 · reported by MITREHigh 7.5
Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_function_frame at src/njs_function.h.
- Product
- NJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Irfanview v4.62 allows a user-mode write access violation via a crafted JPEG 2000 file starting at JPEG2000+0x0000000000001bf0.CVE-2023-26974 · Other software · Irfanview · reported by MITREMedium 5.5
Irfanview v4.62 allows a user-mode write access violation via a crafted JPEG 2000 file starting at JPEG2000+0x0000000000001bf0.
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2023Libde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_segment_header at decctx.cc.CVE-2023-27102 · Other software · Struktur · reported by MITREMedium 6.5
Libde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_segment_header at decctx.cc.
- Product
- Libde265
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Mar 13, 2023Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sockCVE-2023-0629 · Other software · Docker Inc. · reported by security@docker.comHigh 7.1
Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions by setting the Docker host to docker.raw.sock, or npipe:////.pipe/docker_engine_linux on Windows, via the -H (--host) CLI flag or the DOCKER_HOST environment variable and launch containers without the additional hardening features provided by ECI. This would not affect already running containers, nor containers launched through the usual approach (without Docker's raw socket). The affected functionality is available for Docker Business customers only and assumes an environment where users are not granted local root or Administrator privileges. This issue has been fixed in Docker Desktop 4.17.0. Affected Docker Desktop versions: from 4.13.0 before 4.17.0.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comdocs.docker.com
Feb 23, 2023ttftool v0.9.2 was discovered to contain a segmentation violation via the readU16 function at ttf.c.CVE-2022-46440 · Other software · Swftools · reported by MITREMedium 5.5
ttftool v0.9.2 was discovered to contain a segmentation violation via the readU16 function at ttf.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enabCVE-2022-38090 · Other software · Intel · reported by secure@intel.comMedium 6
Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access.
- Product
- Xeon Gold 5315y Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023Libpeconv – access violation, before commit b076013 (30/11/2022).CVE-2023-23461 · Other software · Hasherezade (github) · reported by cna@cyber.gov.ilCritical 9.8
Libpeconv – access violation, before commit b076013 (30/11/2022).
- Product
- Libpeconv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI).CVE-2022-4543 · Computers, phones & browsers · Linux · reported by Red HatMedium 5.5
A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch side-channels based on TLB timing for Intel systems.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comwillsroot.io
Jan 5, 2023GPAC MP4Box v2.1-DEV-rev574-g9d5bb184b contains a segmentation violation via the function gf_sm_load_init_swf at scene_manager/swf_parse.cCVE-2022-47086 · Other software · Gpac · reported by MITREMedium 5.5
GPAC MP4Box v2.1-DEV-rev574-g9d5bb184b contains a segmentation violation via the function gf_sm_load_init_swf at scene_manager/swf_parse.c
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2023NASM v2.16 was discovered to contain a segmentation violation in the component ieee_write_file at /output/outieee.c.CVE-2022-46457 · Other software · Nasm · reported by MITREMedium 5.5
NASM v2.16 was discovered to contain a segmentation violation in the component ieee_write_file at /output/outieee.c.
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usbugzilla.nasm.us
Dec 22, 2022A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`.CVE-2022-42927 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.1
A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 22, 2022Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations.CVE-2022-22745 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 5, 2022In Wi-Fi, there is a possible memory access violation due to a logic error.CVE-2022-32633 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In Wi-Fi, there is a possible memory access violation due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07441637; Issue ID: ALPS07441637.
- Product
- MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Nov 28, 2022Insecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\tools\pCVE-2022-45307 · Other software · Chocolatey · reported by MITREMedium 4.3
Insecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\tools\php81 and all files located in that folder.
- Product
- Chocolatey PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2022Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticated Users group write privileges for the sCVE-2022-45306 · Other software · Chocolatey · reported by MITREMedium 4.3
Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\agent and all files located in that folder.
- Product
- Chocolatey Azure-pipelines-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2022Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\PytCVE-2022-45305 · Other software · Chocolatey · reported by MITREMedium 4.3
Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\Python311 and all files located in that folder.
- Product
- Chocolatey Python3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2022Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\CmdeCVE-2022-45304 · Other software · Chocolatey · reported by MITREMedium 4.3
Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\Cmder and all files located in that folder.
- Product
- Chocolatey Cmder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.