Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,142 results · page 13 of 23
Oct 27, 2022IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function.CVE-2022-43367 · Other software · Ip-com · reported by MITRECritical 9.8
IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function.
- Product
- Ew9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to access sensitive information via the checkLoginUser, ate, telnet, version, setDebugCfg, and booCVE-2022-43366 · Other software · Ip-com · reported by MITREHigh 7.5
IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to access sensitive information via the checkLoginUser, ate, telnet, version, setDebugCfg, and boot interfaces.
- Product
- Ew9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022IP-COM EW9 V15.11.0.14(9732) was discovered to contain a buffer overflow in the formSetDebugCfg function.CVE-2022-43365 · Other software · Ip-com · reported by MITREHigh 7.5
IP-COM EW9 V15.11.0.14(9732) was discovered to contain a buffer overflow in the formSetDebugCfg function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string.
- Product
- Ew9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2022Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements.CVE-2022-28170 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.5
Brocade Fabric OS Web Application services before Brocade Fabric v9.1.0, v9.0.1e, v8.2.3c, v7.4.2j store server and user passwords in the debug statements. This could allow a local user to extract the passwords from a debug file.
- Product
- Fabric Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.combroadcom.com
Oct 25, 2022An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privileges to do so.CVE-2022-33757 · Other software · Tenable, Inc. · reported by vulnreport@tenable.comMedium 6.5
An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privileges to do so. This may lead to the disclosure of information on the scan target and/or the Nessus scan to unauthorized parties able to reach the Nessus instance.
- Product
- Tenable Nessus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Oct 25, 2022An OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc.CVE-2022-32773 · Other software · abode systems, inc. · reported by talos-cna@cisco.comCritical 9.8
An OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger this vulnerability.
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 25, 2022A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc.CVE-2022-32760 · Other software · abode systems, inc. · reported by talos-cna@cisco.comHigh 7.5
A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to denial of service. An attacker can send a malicious XML payload to trigger this vulnerability.
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 17, 2022Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “nessusd” process in clCVE-2022-28291 · Other software · Tenable · reported by disclose@cybersecurityworks.comMedium 6.5
Insufficiently Protected Credentials: An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “nessusd” process in cleartext via process dumping. The affected products are all versions of Nessus Essentials and Professional. The vulnerability allows an attacker to access credentials stored in Nessus scanners, potentially compromising its customers’ network of assets.
- Product
- Nessus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcybersecurityworks.comcybersecurityworks.com
Oct 14, 2022The storage maintenance and debugging module has an array out-of-bounds read vulnerability.Successful exploitation of this vulnerability will cause incorrect stCVE-2022-41583 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The storage maintenance and debugging module has an array out-of-bounds read vulnerability.Successful exploitation of this vulnerability will cause incorrect statistics of this module.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration.CVE-2022-28762 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.3
Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, a local debugging port is opened by the Zoom client. A local malicious user could use this debugging port to connect to and control the Zoom Apps running in the Zoom client.
- Product
- Zoom Client for Meetings for MacOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Sep 23, 2022Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formSetDebugCfg with requeCVE-2022-40866 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formSetDebugCfg with request /goform/setDebugCfg/
- Product
- W20e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings.CVE-2022-38453 · Other software · Contec Health · reported by ics-cert@hq.dhs.govLow 3
Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify additional vulnerabilities.
- Product
- CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2022The Eclipse TCF debug interface in JasMiner-X4-Server-20220621-090907 and below is open on port 1534.CVE-2022-36601 · Other software · Jinglemining · reported by MITRECritical 9.8
The Eclipse TCF debug interface in JasMiner-X4-Server-20220621-090907 and below is open on port 1534. This issue allows unauthenticated attackers to gain root privileges on the affected device and access sensitive data or execute arbitrary commands.
- Product
- Jasminer X4 Server Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjamesachambers.comjamesachambers.com
Aug 25, 2022H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function switch_debug_info_set.CVE-2022-37074 · Other software · H3c · reported by MITREHigh 7.8
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function switch_debug_info_set.
- Product
- Gr-1200w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2022H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function debug_wlan_advance.CVE-2022-36517 · Other software · H3c · reported by MITRECritical 9.8
H3C GR-1200W MiniGRW1A0V100R006 was discovered to contain a stack overflow via the function debug_wlan_advance.
- Product
- Gr-1200w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2022Transposh WordPress Translation: Does not validate its debug settingsCVE-2022-25812 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE
- Product
- Transposh WordPress Translation
- Fixed in
- 1.0.8
- What to do
- Update Transposh WordPress Translation to 1.0.8 or newer.
Jul 20, 2022The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwordsCVE-2022-24660 · Other software · Goldshell · reported by MITREHigh 7.5
The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwords and other sensitive information in plaintext.
- Product
- Goldshell Miner Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjamesachambers.com
Jun 20, 2022XML Sitemaps: Does not sanitise and escape a settings before outputting it in the Debug pageCVE-2021-25088 · WordPress plugins & themes · reported by WPScanMedium 4.8
The XML Sitemaps WordPress plugin before 4.1.3 does not sanitise and escape a settings before outputting it in the Debug page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- XML Sitemaps
- Fixed in
- 4.1.3
- What to do
- Update XML Sitemaps to 4.1.3 or newer.
Jun 8, 2022H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnetDebug parameter at /goform/aspForm.CVE-2022-30916 · Other software · H3c · reported by MITRECritical 9.8
H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnetDebug parameter at /goform/aspForm.
- Product
- Magic R100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction wCVE-2022-31245 · Other software · Mailcow · reported by MITREHigh 8.8
mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.
- Product
- Mailcow\
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Hardware debug modes and processor INIT setting that allow override of locks for some Intel(R) Processors in Intel(R) Boot Guard and Intel(R) TXT may allow an uCVE-2022-0004 · Other software · Intel · reported by secure@intel.comMedium 6.8
Hardware debug modes and processor INIT setting that allow override of locks for some Intel(R) Processors in Intel(R) Boot Guard and Intel(R) TXT may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
- Product
- Core I3-12100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TMCVE-2021-33080 · Other software · Intel · reported by secure@intel.comMedium 6.8
Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(TM) SSD DC Products may allow an unauthenticated user to potentially enable information disclosure or escalation of privilege via physical access.
- Product
- Optane SSD DC P4800x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scriptCVE-2022-29939 · Other software · Librehealth · reported by MITREMedium 5.4
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scripting (XSS) vulnerabilities.
- Product
- Librehealth EHR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information.CVE-2022-25786 · Other software · Secomea · reported by VulnerabilityReporting@secomea.comMedium 4.9
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. This issue affects: GateManager all versions prior to 9.7.
- Product
- GateManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecomea.comsecomea.com
May 3, 2022In aee driver, there is a possible memory corruption due to active debug code.CVE-2022-20089 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In aee driver, there is a possible memory corruption due to active debug code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06240397; Issue ID: ALPS06240397.
- Product
- MT6580, MT6731, MT6739, MT6761, MT6762, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, MT6883,
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Apr 28, 2022In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possibleCVE-2022-29820 · Other software · JetBrains · reported by cve@jetbrains.comLow 3
In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible
- Product
- PyCharm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Apr 14, 2022Active debug code in the B.CVE-2020-25156 · Other software · B. Braun Melsungen AG · reported by ics-cert@hq.dhs.govHigh 7.2
Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and A11 and earlier enables attackers in possession of cryptographic material to access the device as root.
- Product
- SpaceCom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022In broadcastPortInfo of AdbService.java, there is a possible way for apps to run code as the shell user, if wireless debugging is enabled, due to a missing permCVE-2021-39794 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In broadcastPortInfo of AdbService.java, there is a possible way for apps to run code as the shell user, if wireless debugging is enabled, due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-205836329
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 18, 2022The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensitive information to thCVE-2021-27789 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.5
The Web application of Brocade Fabric OS before versions Brocade Fabric OS v9.0.1a and v8.2.3a contains debug statements that expose sensitive information to the program's standard output device. An attacker who has compromised the FOS system may utilize this weakness to capture sensitive information, such as user credentials.
- Product
- Fabric Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Mar 15, 2022Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /widgets/debug.php.CVE-2022-25489 · Other software · Thedigitalcraft · reported by MITREMedium 5.4
Atom CMS v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "A" parameter in /widgets/debug.php.
- Product
- Atomcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Hardware allows activation of test or debug logic at runtime for some Intel(R) Trace Hub instances which may allow an unauthenticated user to potentially enableCVE-2021-33150 · Other software · Intel · reported by secure@intel.comMedium 6.8
Hardware allows activation of test or debug logic at runtime for some Intel(R) Trace Hub instances which may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
- Product
- Atom C2308
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a lCVE-2021-42855 · Other software · Aternity · reported by cve_disclosure@tech.gov.sgHigh 7.8
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by the "/api/appInternals/1.0/agent/configuration" API to map the corresponding ID to a command to be executed.
- Product
- SteelCentral AppInternals Dynamic Sampling Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaternity.force.comaternity.force.com
Feb 23, 2022Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0721 · Other software · microweber · reported by security@huntr.devMedium 6.5
Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file.CVE-2021-3551 · Other software · Dogtagpki · reported by Red HatHigh 7.8
A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.
- Product
- Dogtagpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Feb 3, 2022D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function httpd_debug.asp.CVE-2021-46228 · Other software · Dlink · reported by MITRECritical 9.8
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function httpd_debug.asp. This vulnerability allows attackers to execute arbitrary commands via the time parameter.
- Product
- Di-7200gv2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportannouncement.us.dlink.com
Feb 2, 2022The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context.CVE-2022-22818 · Other software · Djangoproject · reported by MITREMedium 6.1
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
- Product
- Django
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.djangoproject.comgroups.google.com
Jan 28, 2022Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem diCVE-2021-40338 · Other software · Hitachi · reported by cybersecurity@hitachienergy.comLow 3.7
Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24; 3.25; 3.26.
- Product
- Linkone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jan 27, 2022Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via to_json_or_debug at mjs/src/mjs_json.c.CVE-2021-46523 · Other software · Cesanta · reported by MITREHigh 7.8
Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via to_json_or_debug at mjs/src/mjs_json.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022There is an ASSERTION (pFuncBody->GetYieldRegister() == oldYieldRegister) failed in Js::DebugContext::RundownSourcesAndReparse in ChakraCore version 1.12.0.0-beCVE-2020-23315 · Computers, phones & browsers · Microsoft · reported by MITREHigh 7.5
There is an ASSERTION (pFuncBody->GetYieldRegister() == oldYieldRegister) failed in Js::DebugContext::RundownSourcesAndReparse in ChakraCore version 1.12.0.0-beta.
- Product
- Chakracore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2022Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.CVE-2021-44647 · Other software · LUA · reported by MITREMedium 5.5
Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of service.
- Product
- LUA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlua-users.orglua-users.org
Jan 3, 2022Possible denial of service due to improper handling of debug register trap from user applications in Snapdragon Consumer IOT, Snapdragon Industrial IOT, SnapdraCVE-2021-30283 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.1
Possible denial of service due to improper handling of debug register trap from user applications in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- Product
- Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 23, 2021mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow an attacker to inject arbitrary operatiCVE-2021-44453 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 10
mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow an attacker to inject arbitrary operating system commands.
- Product
- myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2021Buffer Overflow Vulnerability exists in ajaxsoundstudio.com n Pyo < 1.03 in the Server_debug function, which allows remote attackers to conduct DoS attacks by dCVE-2021-41499 · Other software · PYO Project · reported by MITREHigh 7.5
Buffer Overflow Vulnerability exists in ajaxsoundstudio.com n Pyo < 1.03 in the Server_debug function, which allows remote attackers to conduct DoS attacks by deliberately passing on an overlong audio file name.
- Product
- PYO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user.CVE-2021-39653 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user. This could lead to local escalation of privilege after preparing the device, hiding the warning, and passing the phone to a new user, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-193443223References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 15, 2021In dsi_panel_debugfs_read_cmdset of dsi_panel.c, there is a possible disclosure of freed kernel heap memory due to a use after free.CVE-2021-1042 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In dsi_panel_debugfs_read_cmdset of dsi_panel.c, there is a possible disclosure of freed kernel heap memory due to a use after free. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-187851056References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 8, 2021By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or CVE-2021-23861 · Other software · Bosch · reported by psirt@bosch.comMedium 6.5
By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.
- Product
- BVMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Dec 7, 2021The debug-meta-data plugin 1.1.2 for WordPress allows XSS.CVE-2020-27356 · WordPress plugins & themes · reported by MITREMedium 5.4
The debug-meta-data plugin 1.1.2 for WordPress allows XSS.
- Affected
- 1.1.2 to 1.1.2
- What to do
- Affects 1.1.2 to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 23, 2021OS Command Injection vulnerability in debug_fcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP requestCVE-2021-42784 · Network & remote access · D-Link · reported by cve_disclosure@tech.gov.sgCritical 9.8
OS Command Injection vulnerability in debug_fcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP request.
- Product
- DWR-932C E1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comsupportannouncement.us.dlink.com
Nov 23, 2021Missing Authentication for Critical Function vulnerability in debug_post_set.cgi of D-Link DWR-932C E1 firmware allows an unauthenticated attacker to execute adCVE-2021-42783 · Network & remote access · D-Link · reported by cve_disclosure@tech.gov.sgCritical 9.8
Missing Authentication for Critical Function vulnerability in debug_post_set.cgi of D-Link DWR-932C E1 firmware allows an unauthenticated attacker to execute administrative actions.
- Product
- DWR-932C E1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportannouncement.us.dlink.comsupportannouncement.us.dlink.com
Nov 20, 2021NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to access debug registers CVE-2021-1105 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 4.1
NVIDIA GPU and Tegra hardware contain a vulnerability in the internal microcontroller which may allow a user with elevated privileges to access debug registers during runtime, which may lead to information disclosure.
- Product
- NVIDIA GPU and Tegra hardware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.