Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,637 results · page 12 of 33
Nov 17, 2022A buffer overflow in Synthesia before 10.7.5567, when a non-Latin locale is used, allows user-assisted attackers to cause a denial of service (application crashCVE-2021-33897 · Other software · Synthesiagame · reported by MITREMedium 5.5
A buffer overflow in Synthesia before 10.7.5567, when a non-Latin locale is used, allows user-assisted attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes. This file is mishandled during a deletion attempt. In Synthesia before 10.9, an improper path handling allows local attackers to cause a denial of service (application crash) via a crafted MIDI file with malformed bytes.
- Product
- Synthesia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordisopach.devsynthesiagame.com
Nov 11, 2022Cross-site scripting in the Intel(R) EMA software before version 1.8.0 may allow a privileged user to potentially enable escalation of privilege via local accesCVE-2022-30297 · Other software · Intel · reported by secure@intel.comLow 3.8
Cross-site scripting in the Intel(R) EMA software before version 1.8.0 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- Endpoint Management Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability.CVE-2022-31689 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token.
- Product
- Workspace ONE Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability.CVE-2022-31688 · Other software · VMware · reported by security@vmware.comMedium 6.1
VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.
- Product
- Workspace ONE Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability.CVE-2022-31687 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
- Product
- Workspace ONE Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability.CVE-2022-31686 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
- Product
- Workspace ONE Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2022VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability.CVE-2022-31685 · Other software · VMware · reported by security@vmware.comCritical 9.8
VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
- Product
- Workspace ONE Assist
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Use after free in assistant in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker who convinced a user to engage in specific UI gesturesCVE-2022-3309 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Use after free in assistant in Google Chrome on ChromeOS prior to 106.0.5249.62 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via specific UI gestures. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Oct 11, 2022Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices.CVE-2022-39271 · Other software · traefik · reported by GitHubHigh 7.5
Traefik (pronounced traffic) is a modern HTTP reverse proxy and load balancer that assists in deploying microservices. There is a potential vulnerability in Traefik managing HTTP/2 connections. A closing HTTP/2 server connection could hang forever because of a subsequent fatal error. This failure mode could be exploited to cause a denial of service. There has been a patch released in versions 2.8.8 and 2.9.0-rc5. There are currently no known workarounds.
- Product
- traefik
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2022Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist.CVE-2022-34394 · Other software · Dell · reported by security_alert@emc.comLow 3.7
Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to unauthorized access to limited switch configuration data. The vulnerability could be leveraged by attackers to conduct man-in-the-middle attacks to gain access to the Support Assist information.
- Product
- Dell Networking OS10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2022Improper access control in the Intel(R) DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalation of privilege viCVE-2022-26017 · Other software · Intel · reported by secure@intel.comHigh 8
Improper access control in the Intel(R) DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site request forgery which could allow an attacker to execute mCVE-2021-38868 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force Id: 208310.
- Product
- Engineering Requirements Quality Assistant On-Premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 18, 2022IBM Engineering Requirements Quality Assistant On-Premises (All versions) could allow an authenticated user to obtain sensitive information due to improper clieCVE-2021-29799 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Engineering Requirements Quality Assistant On-Premises (All versions) could allow an authenticated user to obtain sensitive information due to improper client side validation. IBM X-Force ID: 203738.
- Product
- Engineering Requirements Quality Assistant On-Premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 18, 2022IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting.CVE-2021-29790 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203440.
- Product
- Engineering Requirements Quality Assistant On-Premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 18, 2022IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting.CVE-2021-29788 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203310.
- Product
- Engineering Requirements Quality Assistant On-Premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 10, 2022The lyubolp/Barry-Voice-Assistant repository through 2021-01-18 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31541 · Other software · Barry Voice Assistant Project · reported by MITRECritical 9.3
The lyubolp/Barry-Voice-Assistant repository through 2021-01-18 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Barry Voice Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022Dell SupportAssist Client Consumer versions (3.10.4 and prior) and Dell SupportAssist Client Commercial versions (3.1.1 and prior) contain a cross-site scriptinCVE-2022-29095 · Other software · Dell · reported by security_alert@emc.comHigh 8.3
Dell SupportAssist Client Consumer versions (3.10.4 and prior) and Dell SupportAssist Client Commercial versions (3.1.1 and prior) contain a cross-site scripting vulnerability. A remote unauthenticated malicious user could potentially exploit this vulnerability under specific conditions leading to execution of malicious code on a vulnerable system.
- Product
- SupportAssist Consumer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versions (3.1.1 and versions prior) contain an CVE-2022-29094 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versions (3.1.1 and versions prior) contain an arbitrary file deletion/overwrite vulnerability. Authenticated non-admin user could exploit the issue and delete or overwrite arbitrary files on the system.
- Product
- SupportAssist Client Consumer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versions (3.1.1 and versions prior) contain an CVE-2022-29093 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versions (3.1.1 and versions prior) contain an arbitrary file deletion vulnerability. Authenticated non-admin user could exploit the issue and delete arbitrary files on the system.
- Product
- SupportAssist Client Commercial
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022Dell SupportAssist Client Consumer versions (3.11.0 and versions prior) and Dell SupportAssist Client Commercial versions (3.2.0 and versions prior) contain a pCVE-2022-29092 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell SupportAssist Client Consumer versions (3.11.0 and versions prior) and Dell SupportAssist Client Commercial versions (3.2.0 and versions prior) contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system.
- Product
- SupportAssist Consumer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2022Due to improper error handling an authenticated user can crash CLA assistant instance.CVE-2022-29617 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
Due to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the application.
- Product
- CLA Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability.CVE-2022-26865 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability. An unauthenticated attacker with physical access to the system may exploit this vulnerability by bypassing OS Recovery authentication in order to run arbitrary code on the system as Administrator.
- Product
- Dell OS Recovery Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022Windows Upgrade Assistant Remote Code Execution VulnerabilityCVE-2022-24543 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Upgrade Assistant Remote Code Execution Vulnerability
- Product
- Windows Upgrade Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 18, 2022IBM Engineering Requirements Quality Assistant prior to 3.1.3 could allow an authenticated user to cause a denial of service.CVE-2021-29899 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Engineering Requirements Quality Assistant prior to 3.1.3 could allow an authenticated user to cause a denial of service. IBM X-Force ID: 207413.
- Product
- Engineering Requirements Quality Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 10, 2022An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal neCVE-2020-36517 · Other software · Home-assistant · reported by MITREHigh 7.5
An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration.
- Product
- Home-assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.home-assistant.iogithub.com
Mar 3, 2022A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the secuCVE-2022-23708 · Other software · Elastic · reported by security@elastic.coMedium 4.3
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
- Product
- elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.cosecurity.netapp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6922 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6921 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6920 · Other software · HP · reported by hp-security-alert@hp.comMedium 5.5
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6919 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6918 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6917 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Jan 28, 2022Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.CVE-2022-23456 · Other software · HP · reported by hp-security-alert@hp.comMedium 5.5
Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Jan 10, 2022Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information.CVE-2022-22289 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information.
- Product
- S Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jan 10, 2022HwPCAssistant has a path traversal vulnerability.CVE-2021-40003 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
HwPCAssistant has a path traversal vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Jan 3, 2022HwPCAssistant has a Improper Input Validation vulnerability.Successful exploitation of this vulnerability may create any file with the system app permission.CVE-2021-39970 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
HwPCAssistant has a Improper Input Validation vulnerability.Successful exploitation of this vulnerability may create any file with the system app permission.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Jan 3, 2022HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file.CVE-2021-37128 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Dec 16, 2021The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineerCVE-2021-45099 · Other software · SSH & Web Terminal Project · reported by MITREHigh 8.8
The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against complex social engineering situations
- Product
- SSH & Web Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 14, 2021An issue was discovered in UiPath Assistant 21.4.4.CVE-2021-44042 · Other software · Uipath · reported by MITRECritical 9.8
An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the URI handler for uipath-assistant:// is not correctly encoded, resulting in attacker-controlled content being injected into the error message displayed (when the injected content does not match an existing process). A determined attacker could leverage this to execute JavaScript in the context of the Electron application.
- Product
- Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.uipath.comdocs.uipath.com
Dec 14, 2021UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-asCVE-2021-44041 · Other software · Uipath · reported by MITRECritical 9.8
UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This allows an attacker to execute code on a victim's machine or capture NTLM credentials by supplying a networked or WebDAV file path.
- Product
- Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.uipath.comdocs.uipath.com
Nov 23, 2021Windows 10 Update Assistant Elevation of Privilege VulnerabilityCVE-2021-43211 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows 10 Update Assistant Elevation of Privilege Vulnerability
- Product
- Windows Update Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 23, 2021Windows 10 Update Assistant Elevation of Privilege VulnerabilityCVE-2021-42297 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5
Windows 10 Update Assistant Elevation of Privilege Vulnerability
- Product
- Windows Update Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 17, 2021Improper input validation for Intel(R) EMA before version 1.5.0 may allow an unauthenticated user to potentially enable denial of service via network access.CVE-2021-0013 · Other software · Intel · reported by secure@intel.comHigh 7.5
Improper input validation for Intel(R) EMA before version 1.5.0 may allow an unauthenticated user to potentially enable denial of service via network access.
- Product
- Endpoint Management Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll file via .dll planting/CVE-2021-36297 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll file via .dll planting/hijacking, only by a separate administrative action that is not a default part of the SOSInstallerTool.exe installation for executing arbitrary dll's,
- Product
- SupportAssist Client Consumer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file deletion vulnerability that can be exploited bCVE-2021-36286 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file deletion vulnerability that can be exploited by using the Windows feature of NTFS called Symbolic links. Symbolic links can be created by any(non-privileged) user under some object directories, but by themselves are not sufficient to successfully escalate privileges. However, combining them with a different object, such as the NTFS junction point allows for the exploitation. Support assist clean files functionality do not distinguish junction points from the physical folder and proceeds to clean the target of the junction that allows nonprivileged users to create junction points and delete arbitrary files on the system which can be accessed only by the admin.
- Product
- SupportAssist Client Consumer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2021Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product dCVE-2021-37860 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 3.7
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Aug 24, 2021Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL injection via the CorCad_F2/executaConsultaEspecifico IE_CORPO_ASSIST or CD_USUARIO_CONVCVE-2021-39376 · Other software · Philips · reported by MITREHigh 8.8
Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL injection via the CorCad_F2/executaConsultaEspecifico IE_CORPO_ASSIST or CD_USUARIO_CONVENIO parameter.
- Product
- Tasy Electronic Medical Record
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiesec.home.blogdiesec.home.blog
Aug 12, 2021Windows 10 Update Assistant Elevation of Privilege VulnerabilityCVE-2021-36945 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Windows 10 Update Assistant Elevation of Privilege Vulnerability
- Product
- Windows Update Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jul 22, 2021Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2.1CVE-2020-5316 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3, 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, 3.2.1, 3.2.2, 3.3, 3.3.1, 3.3.2, 3.3.3, 3.4 contain an uncontrolled search path vulnerability. A locally authenticated low privileged user could exploit this vulnerability to cause the loading of arbitrary DLLs by the SupportAssist binaries, resulting in the privileged execution of arbitrary code.
- Product
- Dell SupportAssist Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2021Windows Remote Assistance Information Disclosure VulnerabilityCVE-2021-34507 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows Remote Assistance Information Disclosure Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.