Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,210 results · page 12 of 45
Feb 13, 2023Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute arbitrary code via a CVE-2022-48077 · Other software · Genymotion · reported by MITREHigh 7.8
Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.
- Product
- Genymotion Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 1, 2023In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer.CVE-2023-22358 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.8
In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- APM Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows.CVE-2023-22283 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.5
On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrative privileges are required to exploit this vulnerability because the victim user needs to run the executable on the system and the attacker requires administrative privileges for modifying the files in the trusted search path. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- APM Clients
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023Connectwise Automate 2022.11 is vulnerable to Clickjacking.CVE-2023-23126 · Other software · Connectwise · reported by MITREMedium 6.1
Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: the vendor's position is that a Content-Security-Policy HTTP response header is present to block this attack.
- Product
- Automate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack.CVE-2022-20215 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183794206
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 26, 2023In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack.CVE-2022-20214 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.7
In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle button to enable apps to modify system settings without user consent.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183411210
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 26, 2023In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack.CVE-2022-20213 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183410508
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 20, 2023Cybereason EDR version 19.1.282 and above, 19.2.182 and above, 20.1.343 and above, and 20.2.X and above has a DLL hijacking vulnerability, which could allow a lCVE-2020-25502 · Other software · Cybereason · reported by MITREHigh 7.8
Cybereason EDR version 19.1.282 and above, 19.2.182 and above, 20.1.343 and above, and 20.2.X and above has a DLL hijacking vulnerability, which could allow a local attacker to execute code with elevated privileges.
- Product
- Endpoint Detection And Response
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybereason.comcybereason.com
Jan 11, 2023Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack.CVE-2022-4457 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 5.5
Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a malicious mobile application which could hijack legitimate app and steal potentially sensitive information when installed on the victim's device.
- Product
- WARP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2023Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll.CVE-2022-44939 · Other software · Echatserver · reported by MITREHigh 7.8
Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to execute arbitrary code via a crafted DLL.
- Product
- Easy Chat Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022A deserialization flaw was discovered in jackson-databind through 2.9.10.4.CVE-2020-10650 · Other software · Debian · reported by MITREHigh 8.1
A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2022A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic.CVE-2021-4279 · Other software · Starcounter-Jack · reported by VulDBMedium 6.3
A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.
- Product
- JSON-Patch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2022IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formAddDnsHijack function.CVE-2022-45707 · Other software · Ip-com · reported by MITRECritical 9.8
IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formAddDnsHijack function.
- Product
- M50 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability.CVE-2022-42945 · Other software · Autodesk · reported by psirt@autodesk.comHigh 7.8
DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system.
- Product
- DWG Trueview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordautodesk.comautodesk.com
Dec 16, 2022In onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/overlay attack.CVE-2022-20553 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.5
In onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/overlay attack. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-244155265
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 16, 2022In onCreate of various files, there is a possible tapjacking/overlay attack.CVE-2022-20520 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to local escalation of privilege or denial of server with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227203202
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/oveCVE-2022-20501 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246933359
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" due to a confused deputy.CVE-2022-20475 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-240663194
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API level < 23 due to a tapjacking/overlay aCVE-2022-20442 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In onCreate of ReviewPermissionsActivity.java, there is a possible way to grant permissions for a separate app with API level < 23 due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-176094367
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022AeroCMS v0.0.1 is vulnerable to ClickJacking.CVE-2022-46061 · Other software · Aerocms Project · reported by MITREMedium 6.1
AeroCMS v0.0.1 is vulnerable to ClickJacking.
- Product
- Aerocms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022 IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim.CVE-2022-34318 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 229461.
- Product
- CICS TX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 8, 2022The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack..CVE-2022-3260 · Other software · Redhat · reported by Red HatMedium 4.8
The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly, allowing clickjacking attacks.
- Product
- Openshift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Dec 8, 2022Implicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1 allows attacker to access sensitive information via implicit inteCVE-2022-39905 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Implicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1 allows attacker to access sensitive information via implicit intent.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Nov 30, 2022In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting.CVE-2022-38801 · Other software · Zkteco · reported by MITREMedium 5.4
In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting.
- Product
- Biotime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comzkteco.com
Nov 21, 2022A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) andCVE-2022-4105 · Other software · kiwitcms · reported by security@huntr.devMedium 5.4
A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
- Product
- kiwitcms/kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack.CVE-2022-45422 · Other software · LG · reported by product.security@lge.comHigh 7.8
When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-HOT-220005.
- Product
- Smart Share
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Nov 9, 2022The DDMP/ODMF module has a service hijacking vulnerability.CVE-2022-44555 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The DDMP/ODMF module has a service hijacking vulnerability. Successful exploit of this vulnerability may cause services to be unavailable.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Nov 7, 2022Local privilege escalation due to DLL hijacking vulnerability.CVE-2022-44744 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Oct 31, 2022 The application was vulnerable to a session fixation that could be used hijack accounts.CVE-2022-40293 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auCritical 9.8
The application was vulnerable to a session fixation that could be used hijack accounts.
- Product
- PHP Point of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Oct 27, 2022Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causCVE-2022-36182 · Other software · Hashicorp · reported by MITREMedium 6.1
Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to malicious sites, or causing users to perform malicious actions on the site.
- Product
- Boundary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordowasp.orgpacketstormsecurity.com
Oct 24, 2022Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users.CVE-2021-46279 · Other software · Lanner Inc · reported by prodsec@nozominetworks.comMedium 5.8
Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attacks against users. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.10.0.
- Product
- IAC-AST2500A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnozominetworks.comnozominetworks.com
Oct 12, 2022Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities.CVE-2022-33921 · Other software · Dell · reported by security_alert@emc.comHigh 7
Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context.
- Product
- GeoDrive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via implicit intent.CVE-2022-39859 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Implicit intent hijacking vulnerability in UPHelper library prior to version 3.0.12 allows attackers to access sensitive information via implicit intent.
- Product
- UPHelper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Oct 6, 2022IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim.CVE-2022-22503 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.1
IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 227125.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Oct 2, 2022In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent useCVE-2022-42004 · Other software · Fasterxml · reported by MITREHigh 7.5
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization.
- Product
- Jackson-databind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Oct 2, 2022In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializerCVE-2022-42003 · Other software · Fasterxml · reported by MITREHigh 7.5
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled.
- Product
- Jackson-databind
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Sep 28, 2022A session hijack risk was identified in the Shibboleth authentication plugin.CVE-2021-40691 · Other software · Moodle · reported by Red HatMedium 4.3
A session hijack risk was identified in the Shibboleth authentication plugin.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Sep 28, 2022Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbiCVE-2022-32168 · Other software · notepad-plus-plus · reported by vulnerabilitylab@mend.ioHigh 7.8
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.
- Product
- notepad-plus-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022There is a traffic hijacking vulnerability in WS7200-10 11.0.2.13.CVE-2021-46835 · Other software · Huawei · reported by psirt@huawei.comMedium 4.3
There is a traffic hijacking vulnerability in WS7200-10 11.0.2.13. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers.
- Product
- Ws7200-10 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijackingCVE-2022-40978 · Other software · JetBrains · reported by cve@jetbrains.comHigh 7.5
The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Sep 16, 2022Incorrect access control in Watchdog Anti-Virus v1.4.158 allows attackers to perform a DLL hijacking attack and execute arbitrary code via a crafted binary.CVE-2022-38611 · Other software · Watchdog · reported by MITREHigh 7.8
Incorrect access control in Watchdog Anti-Virus v1.4.158 allows attackers to perform a DLL hijacking attack and execute arbitrary code via a crafted binary.
- Product
- Anti-virus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 13, 2022Genymotion Desktop v3.2.1 was discovered to contain a DLL hijacking vulnerability which allows attackers to escalate privileges and execute arbitrary code via aCVE-2022-38633 · Other software · Genymobile · reported by MITREHigh 7.8
Genymotion Desktop v3.2.1 was discovered to contain a DLL hijacking vulnerability which allows attackers to escalate privileges and execute arbitrary code via a crafted binary.
- Product
- Genymotion Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2022DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.22083_3 allows attacker to execute arbitrary code.CVE-2022-39846 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.22083_3 allows attacker to execute arbitrary code.
- Product
- Smart Switch PC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 9, 2022Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files CVE-2022-36872 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5
Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
- Product
- Samsung Pay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 9, 2022Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files wCVE-2022-36871 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5
Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
- Product
- Samsung Pay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 9, 2022Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to aCVE-2022-36870 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5
Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent.
- Product
- Samsung Pay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 8, 2022Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request.CVE-2022-36736 · Other software · Jitsi · reported by MITREMedium 6.1
Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request. NOTE: this is disputed by the vendor
- Product
- Jitsi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022Outbyte PC Repair Installation File 1.7.112.7856 is vulnerable to Dll Hijacking.CVE-2022-36271 · Other software · Outbyte · reported by MITREHigh 7.8
Outbyte PC Repair Installation File 1.7.112.7856 is vulnerable to Dll Hijacking. iertutil.dll is missing so an attacker can use a malicious dll with same name and can get admin privileges.
- Product
- PC Repair
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2022An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijacking attack on C:\Program.exe.CVE-2022-37173 · Other software · VIM · reported by MITREHigh 7.8
An issue in the installer of gvim 9.0.0000 allows authenticated attackers to execute arbitrary code via a binary hijacking attack on C:\Program.exe.
- Product
- Gvim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2022A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to EteCVE-2022-24951 · Other software · Jason Gauci · reported by cve-assign@fb.comHigh 7
A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to Eternal Terminal clients which attempt to connect in the future.
- Product
- Eternal Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.