Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,637 results · page 11 of 33
Jun 12, 2023Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable to elevation of priviCVE-2023-32673 · Other software · HP Inc. · reported by hp-security-alert@hp.comCritical 9.8
Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable to elevation of privilege.
- Product
- HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Jun 11, 2023Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager CVE-2023-35035 · Other software · Atos · reported by MITREHigh 8.8
Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager V10 R0 allow command injection by authenticated users, aka OSFOURK-23557.
- Product
- Unify Openscape 4000 Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetworks.unify.comnews.de
Jun 11, 2023Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow remote code execution CVE-2023-35034 · Other software · Atos · reported by MITRECritical 9.8
Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow remote code execution by unauthenticated users, aka OSFOURK-24033.
- Product
- Unify Openscape 4000 Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetworks.unify.comnews.de
Jun 11, 2023Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager CVE-2023-35033 · Other software · Atos · reported by MITREHigh 8.8
Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager V10 R0 allow command injection by authenticated users, aka OSFOURK-23556.
- Product
- Unify Openscape 4000 Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetworks.unify.comnews.de
Jun 11, 2023Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow command injection by aCVE-2023-35032 · Other software · Atos · reported by MITREHigh 8.8
Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow command injection by authenticated users, aka OSFOURK-23554.
- Product
- Unify Openscape 4000 Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetworks.unify.comnews.de
Jun 11, 2023Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager CVE-2023-35031 · Other software · Atos · reported by MITREHigh 8.8
Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8, and Manager V10 R0 allow command injection by authenticated users, aka OSFOURK-24036.
- Product
- Unify Openscape 4000 Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetworks.unify.comnews.de
Jun 5, 2023A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS.CVE-2023-3099 · Other software · KylinSoft · reported by VulDBMedium 4.4
A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function delete_file in the library dbus.SystemBus of the component Arbitrary File Handler. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.2-0kylin6k70-23 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230689 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- youker-assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2023A vulnerability classified as critical has been found in KylinSoft youker-assistant on KylinOS.CVE-2023-3098 · Other software · KylinSoft · reported by VulDBMedium 4.4
A vulnerability classified as critical has been found in KylinSoft youker-assistant on KylinOS. Affected is the function restore_all_sound_file. The manipulation leads to path traversal: '../filedir'. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.2-0kylin6k70-23 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230688. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- youker-assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023The online authentication provided by the hwKitAssistant lacks strict identity verification of applications.CVE-2023-0117 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
The online authentication provided by the hwKitAssistant lacks strict identity verification of applications. Successful exploitation of this vulnerability may affect availability of features,such as MeeTime.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
May 22, 2023The iBoot device’s basic discovery protocol assists in initial device configuration.CVE-2022-47320 · Other software · Dataprobe, Inc. · reported by ics-cert@hq.dhs.govHigh 8.1
The iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.
- Product
- Dataprobe iBoot-PDU FW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023Push Notifications for WordPress by PushAssist: Does not sanitise and escape various parameters before outputting them back in pagesCVE-2023-0644 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Push Notifications for WordPress by PushAssist WordPress plugin through 3.0.8 does not sanitise and escape various parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
- Product
- Push Notifications for WordPress by PushAssist
- Affected
- up to 3.0.8
- What to do
- Affects up to 3.0.8. Update Push Notifications for WordPress by PushAssist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 10, 2023Improper authorization in the Intel(R) EMA software before version 1.9.0.0 may allow an authenticated user to potentially enable denial of service via local accCVE-2022-45128 · Other software · Intel · reported by secure@intel.comMedium 5
Improper authorization in the Intel(R) EMA software before version 1.9.0.0 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Endpoint Management Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Improper buffer restrictions in the Intel(R) QAT Engine for OpenSSL before version 0.6.16 may allow a privileged user to potentially enable escalation of privilCVE-2022-43507 · Other software · Intel · reported by secure@intel.comHigh 7.5
Improper buffer restrictions in the Intel(R) QAT Engine for OpenSSL before version 0.6.16 may allow a privileged user to potentially enable escalation of privilege via network access.
- Product
- Quickassist Technology Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Improper buffer restriction in software for the Intel QAT Driver for Linux before version 1.7.l.4.12 may allow an authenticated user to potentially enable deniaCVE-2022-41808 · Other software · Intel · reported by secure@intel.comLow 3.3
Improper buffer restriction in software for the Intel QAT Driver for Linux before version 1.7.l.4.12 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Quickassist Technology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Incorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentialCVE-2022-41771 · Other software · Intel · reported by secure@intel.comMedium 6.5
Incorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Quickassist Technology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Incorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentialCVE-2022-41699 · Other software · Intel · reported by secure@intel.comHigh 8.2
Incorrect permission assignment for critical resource in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Quickassist Technology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable information disclosuCVE-2022-41621 · Other software · Intel · reported by secure@intel.comLow 3.3
Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Quickassist Technology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Improper authorization in Intel(R) EMA Configuration Tool before version 1.0.4 and Intel(R) MC before version 2.4 software may allow an authenticated user to poCVE-2022-41610 · Other software · Intel · reported by secure@intel.comMedium 5
Improper authorization in Intel(R) EMA Configuration Tool before version 1.0.4 and Intel(R) MC before version 2.4 software may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Endpoint Management Assistant Configuration Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable escalation of privilCVE-2022-40972 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Quickassist Technology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Out-of-bounds write in software for the Intel QAT Driver for Windows before version 1.9.0-0008 may allow an authenticated user to potentially enable escalation CVE-2022-21804 · Other software · Intel · reported by secure@intel.comHigh 8.4
Out-of-bounds write in software for the Intel QAT Driver for Windows before version 1.9.0-0008 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Quickassist Technology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Out-of-bounds read in software for the Intel QAT Driver for Windows before version 1.9.0-0008 may allow an authenticated user to potentially enable information CVE-2022-21239 · Other software · Intel · reported by secure@intel.comMedium 5.6
Out-of-bounds read in software for the Intel QAT Driver for Windows before version 1.9.0-0008 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- Quickassist Technology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavaCVE-2022-42335 · Other software · Xen · reported by security@xen.orgHigh 7.8
x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control.
- Product
- xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Apr 17, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veragroup Mobile Assistant allows SQL Injection.CVE-2023-1723 · Other software · Veragroup · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veragroup Mobile Assistant allows SQL Injection. This issue affects Mobile Assistant: before 21.S.2343.
- Product
- Mobile Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Apr 16, 2023The HwPCAssistant module has the out-of-bounds read/write vulnerability.CVE-2022-48312 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability may affect confidentiality and integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Apr 15, 2023A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS.CVE-2023-2091 · Other software · KylinSoft · reported by VulDBHigh 7.8
A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function adjust_cpufreq_scaling_governer. The manipulation leads to os command injection. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.4.13 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226099.
- Product
- youker-assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023In lcsm_SendRrAcquiAssist of lcsm_bcm_assist.c, there is a possible out of bounds write due to a missing bounds check.CVE-2023-21058 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In lcsm_SendRrAcquiAssist of lcsm_bcm_assist.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-246169606References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 24, 2023A vulnerability was found in OpenShift Assisted Installer.CVE-2021-3684 · Other software · Redhat · reported by Red HatMedium 5.5
A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.
- Product
- Openshift Assisted Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Mar 21, 2023x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailCVE-2022-42332 · Other software · Xen · reported by security@xen.orgHigh 7.8
x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data structures. To migrate or snapshot guests, Xen additionally runs them in so called log-dirty mode. The data structures needed by the log-dirty tracking are part of aformentioned auxiliary data. In order to keep error handling efforts within reasonable bounds, for operations which may require memory allocations shadow mode logic ensures up front that enough memory is available for the worst case requirements. Unfortunately, while page table memory is properly accounted for on the code path requiring the potential establishing of new shadows, demands by the log-dirty infrastructure were not taken into consideration. As a result, just established shadow page tables could be freed again immediately, while other code is still accessing them on the assumption that they would remain allocated.
- Product
- xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Mar 8, 2023homeassistant is an open source home automation tool.CVE-2023-27482 · Other software · home-assistant · reported by GitHubCritical 10
homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older. Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment, are not affected. The issue has been mitigated and closed in Supervisor version 2023.03.1, which has been rolled out to all affected installations via the auto-update feature of the Supervisor. This rollout has been completed at the time of publication of this advisory. Home Assistant Core 2023.3.0 included mitigation for this vulnerability. Upgrading to at least that version is thus advised. In case one is not able to upgrade the Home Assistant Supervisor or the Home Assistant Core application at this time, it is advised to not expose your Home Assistant instance to the internet.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023Media Library Assistant: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-0279 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Media Library Assistant WordPress plugin before 3.06 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- Media Library Assistant
- Fixed in
- 3.06
- What to do
- Update Media Library Assistant to 3.06 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Feb 16, 2023Improper neutralization in the Intel(R) EMA software before version 1.8.1.0 may allow a privileged user to potentially enable escalation of privilege via networCVE-2022-38056 · Other software · Intel · reported by secure@intel.comLow 3.8
Improper neutralization in the Intel(R) EMA software before version 1.8.1.0 may allow a privileged user to potentially enable escalation of privilege via network access.
- Product
- Endpoint Management Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Uncontrolled search path in some Intel(R) QAT drivers for Windows before version 1.6 may allow an authenticated user to potentially enable escalation of privileCVE-2022-37340 · Other software · Intel · reported by secure@intel.comMedium 6.7
Uncontrolled search path in some Intel(R) QAT drivers for Windows before version 1.6 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Quickassist Technology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Incorrect default permissions in the software installer for some Intel(R) QAT drivers for Linux before version 4.17 may allow an authenticated user to potentialCVE-2022-36397 · Other software · Intel · reported by secure@intel.comHigh 7.3
Incorrect default permissions in the software installer for some Intel(R) QAT drivers for Linux before version 4.17 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Quickassist Technology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Description: Race condition in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escalation of privilege viCVE-2022-32764 · Other software · Intel · reported by secure@intel.comHigh 7.5
Description: Race condition in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Protection mechanism failure in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escalation of privilege vCVE-2022-30530 · Other software · Intel · reported by secure@intel.comHigh 7.8
Protection mechanism failure in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain privileges via a TrojanCVE-2023-22368 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- ELECOM Camera Assistant and QuickFileDealer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023 SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability.CVE-2022-34392 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An authenticated non-admin user can be able to obtain the refresh token and that leads to reuse the access token and fetch sensitive information.
- Product
- SupportAssist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023 Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component.CVE-2022-34389 · Other software · Dell · reported by security_alert@emc.comLow 3.7
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component. An unauthenticated attacker could potentially exploit this vulnerability and impersonate a legitimate dell customer to a dell support technician.
- Product
- SupportAssist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023 Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain information disclosure vulneraCVE-2022-34388 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain information disclosure vulnerability. A local malicious user with low privileges could exploit this vulnerability to view and modify sensitive information in the database of the affected application.
- Product
- SupportAssist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023 Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilege escalation vulneCVE-2022-34387 · Other software · Dell · reported by security_alert@emc.comMedium 6.4
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilege escalation vulnerability. A local authenticated malicious user could potentially exploit this vulnerability to elevate privileges and gain total control of the system.
- Product
- SupportAssist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023 Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic weakness vulnerabCVE-2022-34386 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic weakness vulnerability. An authenticated non-admin user could potentially exploit the issue and obtain sensitive information.
- Product
- SupportAssist Client Consumer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023 SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic weakness vulnerabilitCVE-2022-34385 · Other software · Dell · reported by security_alert@emc.comMedium 5.5
SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic weakness vulnerability. An authenticated non-admin user could potentially exploit the issue and obtain sensitive information.
- Product
- SupportAssist Client Consumer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023 Dell SupportAssist Client Consumer (version 3.11.1 and prior), SupportAssist Client Commercial (version 3.2 and prior), Dell Command | Update, Dell Update, andCVE-2022-34384 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell SupportAssist Client Consumer (version 3.11.1 and prior), SupportAssist Client Commercial (version 3.2 and prior), Dell Command | Update, Dell Update, and Alienware Update versions before 4.5 contain a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local malicious user may potentially exploit this vulnerability, leading to privilege escalation.
- Product
- SupportAssist Client Consumer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023 Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability.CVE-2022-34366 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability. An authenticated non-admin user could potentially exploit the issue and obtain sensitive information.
- Product
- SupportAssist Client Consumer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Potential security vulnerabilities have been identified in HP Support Assistant.CVE-2022-23455 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files.
- Product
- HP Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Feb 1, 2023Potential security vulnerabilities have been identified in HP Support Assistant.CVE-2022-23454 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files.
- Product
- HP Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Feb 1, 2023Potential security vulnerabilities have been identified in HP Support Assistant.CVE-2022-23453 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files.
- Product
- HP Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Dec 13, 2022A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager (8 before R2.22.18, 10 before 0.28CVE-2022-46404 · Other software · Atos · reported by MITRECritical 9.8
A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager (8 before R2.22.18, 10 before 0.28.13, and 10 R1 before R1.34.4) that may allow an unauthenticated attacker to upload arbitrary files and achieve administrative access to the system.
- Product
- Unify Openscape 4000 Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetworks.unify.comheise.de
Dec 12, 2022HP Support Assistant uses HP Performance Tune-up as a diagnostic tool.CVE-2022-38395 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.8
HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up.
- Product
- HP Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Nov 18, 2022Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress.CVE-2022-41618 · WordPress plugins & themes · reported by PatchstackLow 3.7
Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress.
- Affected
- up to 3.00
- What to do
- Affects up to 3.00. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.