Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,443 results · page 13 of 29
Jul 14, 2022Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile function of the crtcrCVE-2022-28375 · Other software · Verizon · reported by MITRECritical 9.8
Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the crtcswitchsimprofile function of the crtcrpc JSON listener. A remote attacker on the local network can inject shell metacharacters into /usr/lib/lua/5.1/luci/controller/rpc.lua to achieve remote code execution as root,
- Product
- Lvskihp Outdoorunit Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the DMACC URLs on the Settings page of the EngCVE-2022-28374 · Other software · Verizon · reported by MITREHigh 8.8
Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 does not property sanitize user-controlled parameters within the DMACC URLs on the Settings page of the Engineering portal. An authenticated remote attacker on the local network can inject shell metacharacters into /usr/lib/lua/5.1/luci/controller/admin/settings.lua to achieve remote code execution as root.
- Product
- Lvskihp Outdoorunit Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the crtcreadpartition function of the crtcrpc JCVE-2022-28373 · Other software · Verizon · reported by MITRECritical 9.8
Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not properly sanitize user-controlled parameters within the crtcreadpartition function of the crtcrpc JSON listener in /usr/lib/lua/luci/crtc.lua. A remote attacker on the local network can inject shell metacharacters to achieve remote code execution as root.
- Product
- Lvskihp Indoorunit Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning CVE-2022-28372 · Other software · Verizon · reported by MITREHigh 7.5
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints provide a means of provisioning a firmware update for the device via crtc_fw_upgrade or crtcfwimage. The URL provided is not validated, and thus allows for arbitrary file upload to the device. This occurs in /lib/lua/luci/crtc.lua (IDU) and /lib/functions/wnc_jsonsh/wnc_crtc_fw.sh (ODU).
- Product
- Lvskihp Indoorunit Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate forCVE-2022-28371 · Other software · Verizon · reported by MITREHigh 7.5
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static certificate for access control. This certificate is embedded in the firmware, and is identical across the fleet of devices. An attacker need only download this firmware and extract the private components of these certificates (from /etc/lighttpd.d/ca.pem and /etc/lighttpd.d/server.pem) to gain access. (The firmware download location is shown in a device's upgrade logs.)
- Product
- Lvskihp Indoorunit Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of provisioning a firmware update for the devCVE-2022-28370 · Other software · Verizon · reported by MITREHigh 7.5
On Verizon 5G Home LVSKIHP OutDoorUnit (ODU) 3.33.101.0 devices, the RPC endpoint crtc_fw_upgrade provides a means of provisioning a firmware update for the device. /lib/functions/wnc_jsonsh/wnc_crtc_fw.sh has no cryptographic validation of the image, thus allowing an attacker to modify the installed firmware.
- Product
- Lvskihp Outdoorunit Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-operation of the crtcrCVE-2022-28369 · Other software · Verizon · reported by MITRECritical 9.8
Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 does not validate the user-provided URL within the crtcmode function's enable_ssh sub-operation of the crtcrpc JSON listener (found at /lib/functions/wnc_jsonsh/crtcmode.sh) A remote attacker on the local network can provide a malicious URL. The data (found at that URL) is written to /usr/sbin/dropbear and then executed as root.
- Product
- Lvskihp Indoorunit Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2022A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit wCVE-2022-34753 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.8
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit when the command is compromised. Affected Products: SpaceLogic C-Bus Home Controller (5200WHC2), formerly known as C-Bus Wiser Homer Controller MK2 (V1.31.460 and prior)
- Product
- SpaceLogic C-Bus Home Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdownload.schneider-electric.com
Jul 12, 2022Implemented protections on AWS credentials that were not properly protected.CVE-2022-22998 · Network & remote access · Western Digital · reported by psirt@wdc.comHigh 8
Implemented protections on AWS credentials that were not properly protected.
- Product
- My Cloud Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwesterndigital.comwesterndigital.com
Jul 12, 2022Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attackerCVE-2022-22997 · Network & remote access · Western Digital · reported by psirt@wdc.comMedium 6.8
Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially allowed an attacker to execute unsigned code on My Cloud Home devices.
- Product
- My Cloud Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwesterndigital.comwesterndigital.com
Jul 10, 2022The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31585 · Other software · Home Internet Project · reported by MITRECritical 9.3
The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Home Internet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The nrlakin/homepage repository through 2017-03-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31548 · Other software · Homepage Project · reported by MITRECritical 9.3
The nrlakin/homepage repository through 2017-03-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Homepage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2022Inout Homestay v2.2 was discovered to contain a SQL injection vulnerability via the guests parameter at /index.php?page=search/rentals.CVE-2022-32055 · Other software · Nesote · reported by MITREHigh 7.5
Inout Homestay v2.2 was discovered to contain a SQL injection vulnerability via the guests parameter at /index.php?page=search/rentals.
- Product
- Inout Homestay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022Nextcloud mail is a Mail app for the Nextcloud home server product.CVE-2022-31131 · Other software · nextcloud · reported by GitHubMedium 5.4
Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incorrect system users. It is recommended that the Nextcloud Mail app is upgraded to 1.12.2. There are no known workarounds for this issue. ### Workarounds No workaround available ### References * [Pull request](https://github.com/nextcloud/mail/pull/6600) * [HackerOne](https://hackerone.com/reports/1579820) ### For more information If you have any questions or comments about this advisory: * Create a post in [nextcloud/security-advisories](https://github.com/nextcloud/security-advisories/discussions) * Customers: Open a support ticket at [support.nextcloud.com](https://support.nextcloud.com)
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2022HOME SPOT CUBE2 V102 contains an OS command injection vulnerability due to improper processing of data received from DHCP server.CVE-2022-33948 · Other software · KDDI CORPORATION · reported by vultures@jpcert.or.jpHigh 8.8
HOME SPOT CUBE2 V102 contains an OS command injection vulnerability due to improper processing of data received from DHCP server. An adjacent attacker may execute an arbitrary OS command on the product if a malicious DHCP server is placed on the WAN side of the product.
- Product
- HOME SPOT CUBE2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022Synapse is an open source home server implementation for the Matrix chat network.CVE-2022-31052 · Other software · matrix-org · reported by GitHubMedium 6.5
Synapse is an open source home server implementation for the Matrix chat network. In versions prior to 1.61.1 URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion. This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether. It is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user's client may automatically request a URL preview for. Remote users are not able to exploit this directly, because the URL preview endpoint is authenticated. Deployments with `url_preview_enabled: false` set in configuration are not affected. Deployments with `url_preview_enabled: true` set in configuration **are** affected. Deployments with no configuration value set for `url_preview_enabled` are not affected, because the default is `false`. Administrators of homeservers with URL previews enabled are advised to upgrade to v1.61.1 or higher. Users unable to upgrade should set `url_preview_enabled` to false.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/campus/campus_job.CVE-2022-33097 · Other software · 74cms · reported by MITREHigh 7.5
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/campus/campus_job.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/resume/index.CVE-2022-33096 · Other software · 74cms · reported by MITREHigh 7.5
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/resume/index.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.CVE-2022-33095 · Other software · 74cms · reported by MITREHigh 7.5
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map.CVE-2022-33094 · Other software · 74cms · reported by MITREHigh 7.5
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/map.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 202274cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/index.CVE-2022-33092 · Other software · 74cms · reported by MITREHigh 7.5
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/job/index.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2022Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure.CVE-2021-26638 · Other software · Xi S&D Inc. · reported by vuln@krcert.or.krHigh 7.3
Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and information exposure. Remote attackers can use this vulerability to take control of the home environment including indoor control.
- Product
- S&D smarthome (smartcare)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Jun 17, 2022A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h.CVE-2022-21806 · Other software · Anker · reported by talos-cna@cisco.comCritical 9.8
A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network packets can lead to remote code execution. The device is exposed to attacks from the network.
- Product
- Eufy Homebase 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jun 15, 2022YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the IdList parameter at /App/Lib/Action/Home/ApiAction.class.php.CVE-2022-32301 · Other software · Youdiancms · reported by MITRECritical 9.8
YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the IdList parameter at /App/Lib/Action/Home/ApiAction.class.php.
- Product
- Youdiancms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2022An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface.CVE-2022-31485 · Other software · LenelS2 · reported by productsecurity@carrier.comMedium 5.3
An unauthenticated attacker can send a specially crafted packets to update the “notes” section of the home page of the web interface. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contain firmware versions prior to 1.29.
- Product
- LNL-X2210
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorporate.carrier.comcorporate.carrier.com
May 26, 202274cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.CVE-2022-29721 · Other software · 74cms · reported by MITREHigh 7.5
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist.
- Product
- 74cmsse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022A vulnerability, which was classified as problematic, has been found in Home Clean Services Management System 1.0.CVE-2022-1840 · Other software · unspecified · reported by VulDBLow 2.4
A vulnerability, which was classified as problematic, has been found in Home Clean Services Management System 1.0. This issue affects register.php?link=registerand. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely but demands authentication. Exploit details have been disclosed to the public.
- Product
- Home Clean Services Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022A vulnerability classified as critical was found in Home Clean Services Management System 1.0.CVE-2022-1839 · Other software · unspecified · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in Home Clean Services Management System 1.0. This vulnerability affects the file login.php. The manipulation of the argument email with the input admin%'/**/AND/**/(SELECT/**/5383/**/FROM/**/(SELECT(SLEEP(2)))JPeh)/**/AND/**/'frfq%'='frfq leads to sql injection. The attack can be initiated remotely but it requires authentication. Exploit details have been disclosed to the public.
- Product
- Home Clean Services Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022A vulnerability classified as critical has been found in Home Clean Services Management System 1.0.CVE-2022-1838 · Other software · unspecified · reported by VulDBMedium 4.7
A vulnerability classified as critical has been found in Home Clean Services Management System 1.0. This affects an unknown part of admin/login.php. The manipulation of the argument username with the input admin%'/**/AND/**/(SELECT/**/5383/**/FROM/**/(SELECT(SLEEP(5)))JPeh)/**/AND/**/'frfq%'='frfq leads to sql injection. It is possible to initiate the attack remotely but it requires authentication. Exploit details have been disclosed to the public.
- Product
- Home Clean Services Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2022A vulnerability was found in Home Clean Services Management System 1.0.CVE-2022-1837 · Other software · unspecified · reported by VulDBMedium 4.7
A vulnerability was found in Home Clean Services Management System 1.0. It has been rated as critical. Affected by this issue is register.php?link=registerand. The manipulation with the input <?php phpinfo();?> leads to code execution. The attack may be launched remotely but demands an authentication. Exploit details have been disclosed to the public.
- Product
- Home Clean Services Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutio_language cookie SQL injection.CVE-2022-31489 · Other software · Inoutscripts · reported by MITREHigh 7.5
Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutio_language cookie SQL injection.
- Product
- Blockchain Altexchanger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Sony PlayMemories Home v6.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.CVE-2022-27094 · Other software · Sony · reported by MITREMedium 6.7
Sony PlayMemories Home v6.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
- Product
- Playmemories Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
May 19, 2022Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request.CVE-2021-26631 · Websites & servers · Hometory Co.,Ltd · reported by vuln@krcert.or.krHigh 8
Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploit this vulnerability to manipulate the total order amount into a negative number and then pay for the order.
- Product
- Mangboard commerce package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
May 18, 2022In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Access Time Restriction --> Username field, a CVE-2021-41946 · Other software · Fiberhome · reported by MITREMedium 5.4
In FiberHome VDSL2 Modem HG150-Ub_V3.0, a stored cross-site scripting (XSS) vulnerability in Parental Control --> Access Time Restriction --> Username field, a user cannot delete the rule due to the XSS.
- Product
- Hg150-ub Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfiberhome.comgithub.com
May 17, 2022In Home Clean Service System 1.0, the password parameter is vulnerable to SQL injection attacks.CVE-2022-30052 · Other software · Home Clean Service System Project · reported by MITRECritical 9.8
In Home Clean Service System 1.0, the password parameter is vulnerable to SQL injection attacks.
- Product
- Home Clean Service System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['page'] parCVE-2022-28078 · Other software · Home Owners Collection Management System Project · reported by MITREMedium 6.1
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['page'] parameter.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['s'] parameCVE-2022-28077 · Other software · Home Owners Collection Management System Project · reported by MITREMedium 6.1
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['s'] parameter.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022A denial of service vulnerability exists in the libxm_av.so DemuxCmdInBuffer functionality of Anker Eufy Homebase 2 2.1.8.5h.CVE-2022-26073 · Other software · Anker · reported by talos-cna@cisco.comMedium 6.5
A denial of service vulnerability exists in the libxm_av.so DemuxCmdInBuffer functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network packets can lead to a device reboot. An attacker can send packets to trigger this vulnerability.
- Product
- Eufy Homebase 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
May 5, 2022An authentication bypass vulnerability exists in the libxm_av.so getpeermac() functionality of Anker Eufy Homebase 2 2.1.8.5h.CVE-2022-25989 · Other software · Anker · reported by talos-cna@cisco.comHigh 8.8
An authentication bypass vulnerability exists in the libxm_av.so getpeermac() functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted DHCP packet can lead to authentication bypass. An attacker can DHCP poison to trigger this vulnerability.
- Product
- Eufy Homebase 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
May 3, 2022EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.phpCVE-2022-28585 · Other software · Phome · reported by MITRECritical 9.8
EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2022ZCMS v20170206 was discovered to contain a stored cross-site scripting (XSS) vulnerability via index.php?m=home&c=message&a=add.CVE-2022-28522 · Other software · Zcms Project · reported by MITREMedium 5.4
ZCMS v20170206 was discovered to contain a stored cross-site scripting (XSS) vulnerability via index.php?m=home&c=message&a=add.
- Product
- Zcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2022ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=sp_set_config.CVE-2022-28521 · Other software · Zcms Project · reported by MITRECritical 9.8
ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=sp_set_config.
- Product
- Zcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase.CVE-2022-28417 · Other software · Home Owners Collection Management System Project · reported by MITRECritical 9.8
Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase.CVE-2022-28416 · Other software · Home Owners Collection Management System Project · reported by MITRECritical 9.8
Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_phase.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_collection.CVE-2022-28415 · Other software · Home Owners Collection Management System Project · reported by MITRECritical 9.8
Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_collection.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_member.CVE-2022-28414 · Other software · Home Owners Collection Management System Project · reported by MITRECritical 9.8
Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via /hocms/classes/Master.php?f=delete_member.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022Information exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without CVE-2022-27576 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Information exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permission
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 11, 2022Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permiCVE-2022-27575 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comLow 3.3
Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app information without permission.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 8, 2022Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home.CVE-2022-28002 · Other software · Movie Seat Reservation Project · reported by MITREHigh 7.5
Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home.
- Product
- Movie Seat Reservation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 3, 2022Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0.CVE-2022-28376 · Other software · Verizon · reported by MITREHigh 8.1
Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0.1 IP address. The password (for the verizon username) is calculated by concatenating the serial number and the model (i.e., the LVSKIHP string), running the sha256sum program, and extracting the first seven characters concatenated with the last seven characters of that SHA-256 value.
- Product
- Lvskihp Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.