Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15,083 results · page 131 of 302
Oct 30, 2023In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow.CVE-2023-21310 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In libcore, there is a possible out of bounds read due to a missing bounds check.CVE-2023-21309 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In libcore, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Composer, there is a possible out of bounds read due to a missing bounds check.CVE-2023-21308 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Composer, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Bluetooth, there is a possible way for a paired Bluetooth device to access a long term identifier for an Android device due to a permissions bypass.CVE-2023-21307 · Computers, phones & browsers · Google · reported by security@android.comMedium 5
In Bluetooth, there is a possible way for a paired Bluetooth device to access a long term identifier for an Android device due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In ContentService, there is a possible way to read installed sync content providers due to side channel information disclosure.CVE-2023-21306 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In ContentService, there is a possible way to read installed sync content providers due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.CVE-2023-21305 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Content Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.CVE-2023-21304 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Content Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Content, here is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.CVE-2023-21303 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Content, here is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.CVE-2023-21302 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In ActivityManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosuCVE-2023-21301 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In ActivityManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.CVE-2023-21300 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.CVE-2023-21299 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Slice, there is a possible disclosure of installed applications due to side channel information disclosure.CVE-2023-21298 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Slice, there is a possible disclosure of installed applications due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In SEPolicy, there is a possible way to access the factory MAC address due to a permissions bypass.CVE-2023-21297 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In SEPolicy, there is a possible way to access the factory MAC address due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.CVE-2023-21296 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In SliceManagerService, there is a possible way to check if a content provider is installed due to a missing null check.CVE-2023-21295 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In SliceManagerService, there is a possible way to check if a content provider is installed due to a missing null check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Slice, there is a possible disclosure of installed packages due to a missing permission check.CVE-2023-21294 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Slice, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosureCVE-2023-21293 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In Usage Stats Service, there is a possible way to determine whether an app is installed, without query permissions due to side channel information disclosure.CVE-2022-20264 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In Usage Stats Service, there is a possible way to determine whether an app is installed, without query permissions due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app without user consent dueCVE-2021-39810 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023Google Maps made Simple: SQL InjectionCVE-2023-5315 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Google Maps made Simple plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Google Maps made Simple
- Affected
- up to 0.6
- What to do
- Affects up to 0.6. Update Google Maps made Simple to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 27, 2023In android_view_InputDevice_create of android_view_InputDevice.cpp, there is a possible way to execute arbitrary code due to a use after free.CVE-2023-40140 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In android_view_InputDevice_create of android_view_InputDevice.cpp, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy.CVE-2023-40139 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy.CVE-2023-40138 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy.CVE-2023-40137 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy.CVE-2023-40136 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy.CVE-2023-40135 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy.CVE-2023-40134 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy.CVE-2023-40133 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In GpuService of GpuService.cpp, there is a possible use after free due to a race condition.CVE-2023-40131 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code.CVE-2023-40130 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and background activity launch with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow.CVE-2023-40129 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.8
In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow.CVE-2023-40128 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In multiple locations, there is a possible way to access screenshots due to a confused deputy.CVE-2023-40127 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass.CVE-2023-40125 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy.CVE-2023-40123 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization.CVE-2023-40121 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input validation.CVE-2023-40120 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 27, 2023In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass.CVE-2023-40117 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Oct 27, 2023In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code.CVE-2023-40116 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Oct 26, 2023Conversios Track Google Analytics 4, Facebook Pixel & Conversions API: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-46094 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for WooCommerce plugin <= 6.5.3 versions.
- Product
- Conversios Track Google Analytics 4, Facebook Pixel & Conversions API
- Fixed in
- 6.5.4
- What to do
- Update Conversios Track Google Analytics 4, Facebook Pixel & Conversions API to 6.5.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2023Very Simple Google Maps: Stored Cross-Site ScriptingCVE-2023-5744 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Very Simple Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vsgmap' shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Very Simple Google Maps
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update Very Simple Google Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 25, 2023Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2023-5472 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Oct 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Novo-media Novo-Map : your WP posts on custom google maps plugin <= 1.1.2 versions.CVE-2023-46190 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Novo-media Novo-Map : your WP posts on custom google maps plugin <= 1.1.2 versions.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Simple Calendar – Google Calendar Plugin <= 3.2.5 versions.CVE-2023-46189 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Simple Calendar – Google Calendar Plugin <= 3.2.5 versions.
- Fixed in
- 3.2.6
- What to do
- Update the plugin to 3.2.6 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 20, 2023miniOrange's Google Authenticator: Authorization bypassCVE-2022-4943 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to change the plugin's settings.
- Product
- miniOrange's Google Authenticator
- Affected
- up to 5.6.5
- What to do
- Affects up to 5.6.5. Update miniOrange's Google Authenticator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 18, 2023 In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2023-35663 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 18, 2023 In multiple functions of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2023-35656 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In multiple functions of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 18, 2023Widgets for Google Reviews: Cross-Site Request ForgeryCVE-2023-3254 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Widgets for Google Reviews
- Affected
- up to 10.9
- What to do
- Affects up to 10.9. Update Widgets for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Oct 17, 2023OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar.CVE-2023-45810 · Other software · openfga · reported by GitHubMedium 5.3
OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.
- Product
- openfga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.