Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,242 results · page 13 of 25
Jun 7, 2023Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitraCVE-2023-24014 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitrary code.
- Product
- CNCSoft-B DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023An issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18.CVE-2023-30400 · Other software · Anyka · reported by MITRECritical 9.8
An issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18. A command injection vulnerability in the network configuration script within the MCU's operating system allows attackers to perform arbitrary command execution via a crafted wifi SSID or password.
- Product
- Ak3918ev300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023A vulnerability classified as problematic has been found in FlexiHub 5.5.14691.0.CVE-2023-2872 · Other software · Electronic · reported by VulDBMedium 5.5
A vulnerability classified as problematic has been found in FlexiHub 5.5.14691.0. This affects the function 0x220088 in the library fusbhub.sys of the component IoControlCode Handler. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229851. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Flexihub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
May 8, 2023A buffer overflow in the component /Enclave.cpp of Electronics and Telecommunications Research Institute ShieldStore commit 58d455617f99705f0ffd8a27616abdf77bdcCVE-2021-44283 · Other software · Shieldstore Project · reported by MITREHigh 7.5
A buffer overflow in the component /Enclave.cpp of Electronics and Telecommunications Research Institute ShieldStore commit 58d455617f99705f0ffd8a27616abdf77bdc1bdc allows attackers to cause an information leak via a crafted structure from an untrusted operating system.
- Product
- Shieldstore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 20233CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory travCVE-2022-48483 · Other software · 3cx · reported by MITREHigh 7.5
3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory traversal in conjunction with a path component that has a drive letter and uses backslash characters. NOTE: this issue exists because of an incomplete fix for CVE-2022-28005.
- Product
- 3cx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 20233CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directorCVE-2022-48482 · Other software · 3cx · reported by MITREHigh 7.5
3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directory traversal. Files may have credentials, full backups, call recordings, and chat logs.
- Product
- 3cx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023Authentication Bypass by Primary Weakness vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass.CVE-2023-1833 · Other software · DTS Electronics · reported by iletisim@usom.gov.trCritical 9.8
Authentication Bypass by Primary Weakness vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass. This issue affects Redline Router: before 7.17.
- Product
- Redline Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Apr 14, 2023Authentication Bypass by Alternate Name vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass.CVE-2023-1803 · Other software · DTS Electronics · reported by iletisim@usom.gov.trCritical 9.8
Authentication Bypass by Alternate Name vulnerability in DTS Electronics Redline Router firmware allows Authentication Bypass. This issue affects Redline Router: before 7.17.
- Product
- Redline Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Apr 11, 2023Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is vulnerable to improper restriction of operations within the bounds of a memory buffer (CWE-119) dueCVE-2023-25755 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is vulnerable to improper restriction of operations within the bounds of a memory buffer (CWE-119) due to improper check of its data size when processing a project file. If a user of Screen Creator Advance 2 opens a specially crafted project file, information may be disclosed and/or arbitrary code may be executed.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Mar 31, 2023 The web configuration service of the affected device contains an authenticated command injection vulnerability.CVE-2023-0432 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9
The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system (OS) from the device in the context of the user "root." If the attacker has credentials for the web service, then the device could be fully compromised.
- Product
- DX-2100-L1-CN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023 Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect serviCVE-2023-1145 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-GatCVE-2023-1144 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbiCVE-2023-1143 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authCVE-2023-1142 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.5
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a command injection vulnerability that could allow an attacker to inject arbitrary coCVE-2023-1141 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a command injection vulnerability that could allow an attacker to inject arbitrary commands, which could result in remote code execution.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability that could allow an attacker to achieve unauthenticated remote code eCVE-2023-1140 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.8
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability that could allow an attacker to achieve unauthenticated remote code execution in the context of an administrator.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-gateway service, which cCVE-2023-1139 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-gateway service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain an improper access control vulnerability, which could allow an attacker to retrieve GCVE-2023-1138 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.5
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain an improper access control vulnerability, which could allow an attacker to retrieve Gateway configuration files to obtain plaintext credentials.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentiaCVE-2023-1137 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govMedium 6.5
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentials of administrator users, resulting in privilege escalation.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which would lead to authenticatCVE-2023-1136 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.8
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which would lead to authentication bypass.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023 In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which couCVE-2023-1135 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which could result in local privilege escalation.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a path traversal vulnerability, which could allow an attacker to read local fCVE-2023-1134 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.1
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a path traversal vulnerability, which could allow an attacker to read local files, disclose plaintext credentials, and escalate privileges.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by defaCVE-2023-1133 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.8
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. The service accepts the unverified UDP packets and deserializes the content, which could allow an unauthenticated attacker to remotely execute arbitrary code.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcisa.gov
Mar 6, 2023AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.CVE-2023-24217 · Other software · Agilebio · reported by MITREHigh 8.8
AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.
- Product
- Electronic Lab Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comlabcollector.com
Mar 5, 2023Use-after-free vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier.CVE-2023-22424 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Use-after-free vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier. With the abnormal value given as the maximum number of columns for the PLC program, the process accesses the freed memory. As a result, opening a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Kostac PLC Programming Software (Former name: Koyo PLC Programming Software)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Mar 5, 2023Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier.CVE-2023-22421 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier. The insufficient buffer size for the PLC program instructions leads to out-of-bounds read. As a result, opening a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Kostac PLC Programming Software (Former name: Koyo PLC Programming Software)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Mar 5, 2023Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier.CVE-2023-22419 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlier. When processing a comment block in stage information, the end of data cannot be verified and out-of-bounds read occurs. As a result, opening a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Kostac PLC Programming Software (Former name: Koyo PLC Programming Software)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Mar 3, 2023An issue discovered in Shenzhen Zhibotong Electronics WBT WE1626 Router v 21.06.18 allows attacker to execute arbitrary commands via serial connection to the UACVE-2022-45553 · Other software · ZBT · reported by MITRECritical 9.8
An issue discovered in Shenzhen Zhibotong Electronics WBT WE1626 Router v 21.06.18 allows attacker to execute arbitrary commands via serial connection to the UART port.
- Product
- We1626 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.prodefense.ioblog.prodefense.io
Mar 3, 2023An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive information via SPI busCVE-2022-45552 · Other software · ZBT · reported by MITREHigh 7.5
An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive information via SPI bus interface connected to pinout of the NAND flash memory.
- Product
- We1626 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.prodefense.ioblog.prodefense.io
Mar 3, 2023An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command to the Network DiagnoCVE-2022-45551 · Other software · ZBT · reported by MITRECritical 9.8
An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command to the Network Diagnosis endpoint.
- Product
- We1626 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.prodefense.ioblog.prodefense.io
Feb 27, 2023Part-DB is an open source inventory management system for your electronic components.CVE-2023-26042 · Other software · Part-DB · reported by GitHubMedium 6.1
Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to execute JavaScript code, unless in combination with other vulnerabilities. There are no workarounds, please upgrade to Pat-DB 1.0.2 or later.
- Product
- Part-DB-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter.CVE-2021-32302 · Other software · IRZ · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File parameter.
- Product
- Ruh2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD records4nsec.github.ios4nsec.github.io
Feb 24, 2023A vulnerability was found in JP1016 Markdown-Electron and classified as critical.CVE-2023-1005 · Other software · JP1016 · reported by VulDBMedium 5.3
A vulnerability was found in JP1016 Markdown-Electron and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to code injection. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-221738 is the identifier assigned to this vulnerability.
- Product
- Markdown-Electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023 The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorizationCVE-2023-0822 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 8.8
The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality.
- Product
- DIAEnergie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2023Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process even when an error was detCVE-2023-22360 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process even when an error was detected. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 12, 2023Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing coCVE-2023-22353 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing control management information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 12, 2023Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing paCVE-2023-22350 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing parts management information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 12, 2023Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing scCVE-2023-22349 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing screen management information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 12, 2023Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing fiCVE-2023-22347 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing file structure information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 12, 2023Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing teCVE-2023-22346 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verified when processing template information. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 12, 2023Out-of-bound write vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process when out of specificatCVE-2023-22345 · Other software · JTEKT ELECTRONICS CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Out-of-bound write vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process when out of specification errors are detected. Having a user of Screen Creator Advance 2 to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- Product
- Screen Creator Advance 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpelectronics.jtekt.co.jp
Feb 8, 2023Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buffer overflow through improper restrictions of operations within memory, which couCVE-2023-0251 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buffer overflow through improper restrictions of operations within memory, which could allow an attacker to remotely execute arbitrary code.
- Product
- DIAScreen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitCVE-2023-0250 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code.
- Product
- DIAScreen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.CVE-2023-0249 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.
- Product
- DIAScreen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to an out-of-bounds write, which could allow an attacker to remotely execute arbitrary coCVE-2023-0124 · Other software · Delta Industrial Automation · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to an out-of-bounds write, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitCVE-2023-0123 · Other software · Delta Industrial Automation · reported by ics-cert@hq.dhs.govHigh 7.8
Delta Electronics DOPSoft versions 4.00.16.22 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code when a malformed file is introduced to the software.
- Product
- DOPSoft
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023All versions prior to Delta Electronic’s CNCSoft version 1.01.34 (running ScreenEditor versions 1.01.5 and prior) are vulnerable to a stack-based buffer overfloCVE-2022-4634 · Other software · Delta Industrial Automation · reported by ics-cert@hq.dhs.govHigh 7.8
All versions prior to Delta Electronic’s CNCSoft version 1.01.34 (running ScreenEditor versions 1.01.5 and prior) are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbitrary code.
- Product
- ScreenEditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a.CVE-2023-0444 · Other software · Deltaww · reported by vulnreport@tenable.comHigh 8.8
A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. A default user 'User', which is in the 'Read Only User' group, can view the password of another default user 'Administrator', which is in the 'Administrator' group. This allows any lower privileged user to log in as an administrator.
- Product
- Infrasuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 26, 2023All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.CVE-2022-25908 · Other software · Create-choo-electron Project · reported by report@snyk.ioHigh 7.4
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.
- Product
- Create-choo-electron
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.snyk.iosecurity.snyk.io
Jan 12, 2023 Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port witCVE-2022-41778 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.8
Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.