Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,083 results · page 129 of 302
Nov 1, 2023Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML pCVE-2023-5858 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 1, 2023Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially execute arbitrary code via a malicioCVE-2023-5857 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially execute arbitrary code via a malicious file. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 1, 2023Use after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentCVE-2023-5856 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 1, 2023Use after free in Reading Mode in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to poteCVE-2023-5855 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Reading Mode in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 1, 2023Use after free in Profiles in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentiaCVE-2023-5854 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Profiles in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 1, 2023Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page.CVE-2023-5853 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 1, 2023Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentiaCVE-2023-5852 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 1, 2023Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page.CVE-2023-5851 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 1, 2023Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted domain name.CVE-2023-5850 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 1, 2023Integer overflow in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2023-5849 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Integer overflow in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 1, 2023Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTMLCVE-2023-5482 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 1, 2023Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file.CVE-2023-5480 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.1
Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Oct 31, 2023SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions.CVE-2023-46255 · Other software · authzed · reported by GitHubMedium 4.2
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full URI (including the provided password) is printed, so that the password is shown in the logs. Version 1.27.0-rc1 patches this issue.
- Product
- spicedb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023In Print Service, there is a possible background activity launch due to a logic error in the code.CVE-2023-45780 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In Print Service, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In collapse of canonicalize_md.c, there is a possible out of bounds read due to a missing bounds check.CVE-2023-40101 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In collapse of canonicalize_md.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In sdksandbox, there is a possible strandhogg style overlay attack due to a logic error in the code.CVE-2023-21398 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In sdksandbox, there is a possible strandhogg style overlay attack due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value.CVE-2023-21397 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Activity Manager, there is a possible background activity launch due to a logic error in the code.CVE-2023-21396 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Bluetooth, there is a possible out of bounds read due to a use after free.CVE-2023-21395 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.5
In Bluetooth, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from another user due to a missing permission check.CVE-2023-21394 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 30, 2023In Settings, there is a possible way for the user to change SIM due to a missing permission check.CVE-2023-21393 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Settings, there is a possible way for the user to change SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Bluetooth, there is a possible way to corrupt memory due to a use after free.CVE-2023-21392 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In Bluetooth, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege when connecting to a Bluetooth device with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Messaging, there is a possible way to disable the messaging application due to improper input validation.CVE-2023-21391 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In Messaging, there is a possible way to disable the messaging application due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Sim, there is a possible way to evade mobile preference restrictions due to a permission bypass.CVE-2023-21390 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Sim, there is a possible way to evade mobile preference restrictions due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check.CVE-2023-21389 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Settings, there is a possible restriction bypass due to a missing permission check.CVE-2023-21388 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log information disclosure.CVE-2023-21387 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Whitechapel, there is a possible out of bounds read due to memory corruption.CVE-2023-21385 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Whitechapel, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent.CVE-2023-21384 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt.CVE-2023-21383 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permission check.CVE-2023-21382 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Media Resource Manager, there is a possible local arbitrary code execution due to use after free.CVE-2023-21381 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Media Resource Manager, there is a possible local arbitrary code execution due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow.CVE-2023-21380 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Bluetooth, there is a possible out of bounds read due to a missing bounds check.CVE-2023-21379 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check.CVE-2023-21378 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In SELinux Policy, there is a possible restriction bypass due to a permissions bypass.CVE-2023-21377 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In SELinux Policy, there is a possible restriction bypass due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code.CVE-2023-21376 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Sysproxy, there is a possible out of bounds write due to an integer underflow.CVE-2023-21375 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Sysproxy, there is a possible out of bounds write due to an integer underflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In System UI, there is a possible factory reset protection bypass due to a logic error in the code.CVE-2023-21374 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In System UI, there is a possible factory reset protection bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Telephony, there is a possible way for a guest user to change the preferred SIM due to a missing permission check.CVE-2023-21373 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Telephony, there is a possible way for a guest user to change the preferred SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In libdexfile, there is a possible out of bounds read due to a missing bounds check.CVE-2023-21372 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In libdexfile, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Secure Element, there is a possible out of bounds write due to an integer overflow.CVE-2023-21371 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In Secure Element, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In the Security Element API, there is a possible out of bounds write due to an integer overflow.CVE-2023-21370 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In the Security Element API, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Usage Access, there is a possible way to display a Settings usage access restriction toggle screen due to a permissions bypass.CVE-2023-21369 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Usage Access, there is a possible way to display a Settings usage access restriction toggle screen due to a permissions bypass. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Audio, there is a possible out of bounds read due to missing bounds check.CVE-2023-21368 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Audio, there is a possible out of bounds read due to missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Scudo, there is a possible way to exploit certain heap OOB read/write issues due to an insecure implementation/design.CVE-2023-21367 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Scudo, there is a possible way to exploit certain heap OOB read/write issues due to an insecure implementation/design. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Scudo, there is a possible way for an attacker to predict heap allocation patterns due to insecure implementation/design.CVE-2023-21366 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Scudo, there is a possible way for an attacker to predict heap allocation patterns due to insecure implementation/design. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Contacts, there is a possible crash loop due to resource exhaustion.CVE-2023-21365 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In ContactsProvider, there is a possible crash loop due to resource exhaustion.CVE-2023-21364 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In ContactsProvider, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Usage, there is a possible permanent DoS due to resource exhaustion.CVE-2023-21362 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Usage, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.