Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,443 results · page 14 of 29
Apr 1, 2022Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing moduleCVE-2022-27534 · Other software · Kaspersky · reported by vulnerability@kaspersky.comCritical 9.8
Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The fix was delivered automatically. Credits: Georgy Zaytsev (Positive Technologies).
- Product
- Anti-virus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.kaspersky.comsupport.kaspersky.com
Apr 1, 2022A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security.CVE-2021-27223 · Other software · Kaspersky · reported by vulnerability@kaspersky.comMedium 5.5
A denial-of-service issue existed in one of modules that was incorporated in Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security. A local user could cause Windows crash by running a specially crafted binary module. The fix was delivered automatically. Credits: (Straghkov Denis, Kurmangaleev Shamil, Fedotov Andrey, Kuts Daniil, Mishechkin Maxim, Akolzin Vitaliy) @ ISPRAS
- Product
- Anti-virus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.kaspersky.comsupport.kaspersky.com
Mar 31, 2022RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices.CVE-2022-24796 · Other software · jens-maus · reported by GitHubCritical 10
RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices. A Remote Code Execution (RCE) vulnerability in the file upload facility of the WebUI interface of RaspberryMatic exists. Missing input validation/sanitization in the file upload mechanism allows remote, unauthenticated attackers with network access to the WebUI interface to achieve arbitrary operating system command execution via shell metacharacters in the HTTP query string. Injected commands are executed as root, thus leading to a full compromise of the underlying system and all its components. Versions after `2.31.25.20180428` and prior to `3.63.8.20220330` are affected. Users are advised to update to version `3.63.8.20220330` or newer. There are currently no known workarounds to mitigate the security impact and users are advised to update to the latest version available.
- Product
- RaspberryMatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /home.asp.CVE-2021-43661 · Other software · Totolink · reported by MITREMedium 6.1
totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /home.asp.
- Product
- Ex300 V2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022There is a stored XSS vulnerability in ZTE home gateway product.CVE-2022-23136 · Other software · ZTE · reported by psirt@zte.com.cnMedium 5.4
There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters and trigger an XSS attack when the user views the current topology of the device through the management page.
- Product
- Zxhn F680 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zte.com.cnsupport.zte.com.cn
Mar 14, 2022WP Home Page Menu: Does not sanitise and escape its settingsCVE-2022-0684 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- WP Home Page Menu
- Fixed in
- 3.1
- What to do
- Update WP Home Page Menu to 3.1 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Mar 10, 2022SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user tCVE-2022-26104 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.3
SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user to alter the maintenance system message.
- Product
- SAP Financial Consolidation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddam.sap.comlaunchpad.support.sap.com
Mar 10, 2022Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut without user consent.CVE-2022-25817 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut without user consent.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 10, 2022An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal neCVE-2020-36517 · Other software · Home-assistant · reported by MITREHigh 7.5
An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration.
- Product
- Home-assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.home-assistant.iogithub.com
Mar 2, 2022A remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user/manage_user of Home Owners Collection Management System v1.0 allows CVE-2022-25115 · Other software · Home Owners Collection Management System Project · reported by MITREHigh 7.8
A remote code execution (RCE) vulnerability in the Avatar parameter under /admin/?page=user/manage_user of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the adminCVE-2022-25045 · Other software · Home Owners Collection Management System Project · reported by MITRECritical 9.8
Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
Mar 2, 2022Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_attendance/index.php.CVE-2022-25016 · Other software · Home Owners Collection Management System Project · reported by MITRECritical 9.8
Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_attendance/index.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2022Home Owners Collection Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the collected_by parameter under the ListCVE-2022-25028 · Other software · Home Owners Collection Management System Project · reported by MITREMedium 6.1
Home Owners Collection Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the collected_by parameter under the List of Collections module.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comraw.githubusercontent.com
Feb 25, 2022Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /members/view_member.php.CVE-2022-25096 · Other software · Home Owners Collection Management System Project · reported by MITRECritical 9.8
Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /members/view_member.php.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 25, 2022Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted POST request.CVE-2022-25095 · Other software · Home Owners Collection Management System Project · reported by MITRECritical 9.8
Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted POST request.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 25, 2022Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the parameter "cover" in SystemSettings.CVE-2022-25094 · Other software · Home Owners Collection Management System Project · reported by MITREHigh 8.8
Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the parameter "cover" in SystemSettings.php.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 24, 2022There is a directory traversal vulnerability in some home gateway products of ZTE.CVE-2022-23135 · Other software · ZTE · reported by psirt@zte.com.cnMedium 6.5
There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of user modified destination path, an attacker with specific permissions could modify the FTP access path to access and modify the system path contents without authorization, which will cause information leak and affect device operation.
- Product
- Zxhn F677 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zte.com.cnsupport.zte.com.cn
Feb 19, 2022NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-0632 · Other software · mruby · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2022Out-of-bounds Read in Homebrew mruby prior to 3.2.CVE-2022-0630 · Other software · mruby · reported by security@huntr.devHigh 7.1
Out-of-bounds Read in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.CVE-2022-0631 · Other software · mruby · reported by security@huntr.devCritical 9.8
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2022snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions.CVE-2021-3155 · Other software · Canonical Ltd. · reported by security@ubuntu.comLow 3.8
snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
- Product
- snapd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2022Out-of-bounds Read in Homebrew mruby prior to 3.2.CVE-2022-0623 · Other software · mruby · reported by security@huntr.devCritical 9.1
Out-of-bounds Read in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2022Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.CVE-2022-0614 · Other software · mruby · reported by security@huntr.devMedium 5.5
Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.CVE-2022-0570 · Other software · mruby · reported by security@huntr.devCritical 9.8
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022A vulnerability using PendingIntent in DeX Home and DeX for PC prior to SMR Feb-2022 Release 1 allows attackers to access files with system privilege.CVE-2022-23426 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.4
A vulnerability using PendingIntent in DeX Home and DeX for PC prior to SMR Feb-2022 Release 1 allows attackers to access files with system privilege.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Feb 8, 2022Out-of-bounds Read in Homebrew mruby prior to 3.2.CVE-2022-0525 · Other software · mruby · reported by security@huntr.devCritical 9.1
Out-of-bounds Read in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Local privilege escalation due to unrestricted loading of unsigned libraries.CVE-2022-24115 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 2021 (macOS) before build 39287
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Feb 4, 2022Local privilege escalation due to race condition on application startup.CVE-2022-24114 · Other software · Acronis · reported by security@acronis.comHigh 7
Local privilege escalation due to race condition on application startup. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 2021 (macOS) before build 39287
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Feb 4, 2022NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-0481 · Other software · mruby · reported by security@huntr.devHigh 7.5
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service.CVE-2021-44206 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Feb 4, 2022Local privilege escalation due to DLL hijacking vulnerability.CVE-2021-44205 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Jan 21, 2022NULL Pointer Dereference in Homebrew mruby prior to 3.2.CVE-2022-0326 · Other software · mruby · reported by security@huntr.devMedium 5.5
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
- Product
- mruby/mruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installationsCVE-2022-22845 · Other software · Qxip · reported by MITRECritical 9.8
QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations.
- Product
- Homer Webapp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsipcapture.orggithub.com
Dec 22, 2021An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h.CVE-2021-21953 · Other software · Anker · reported by talos-cna@cisco.comHigh 8.1
An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted man-in-the-middle attack can lead to increased privileges.
- Product
- Eufy Homebase 2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Dec 22, 2021An authentication bypass vulnerability exists in the CMD_DEVICE_GET_RSA_KEY_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h.CVE-2021-21952 · Other software · Anker · reported by talos-cna@cisco.comCritical 9.8
An authentication bypass vulnerability exists in the CMD_DEVICE_GET_RSA_KEY_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to increased privileges.
- Product
- Eufy Homebase 2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Dec 16, 2021FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability.CVE-2021-42912 · Other software · Fiberhome · reported by MITREHigh 8.8
FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands with a semicolon.
- Product
- An5506-01-a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2021The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineerCVE-2021-45099 · Other software · SSH & Web Terminal Project · reported by MITREHigh 8.8
The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against complex social engineering situations
- Product
- SSH & Web Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 15, 2021The absence of notifications regarding an ongoing RF jamming attack in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181CVE-2021-40171 · Other software · Securitashome · reported by MITREMedium 5.3
The absence of notifications regarding an ongoing RF jamming attack in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an attacker to block legitimate traffic while not alerting the owner of the system.
- Product
- Securitashome Alarm System Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiva-portal.orgsecuritashome.se
Dec 15, 2021An RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an attacker to triggerCVE-2021-40170 · Other software · Securitashome · reported by MITREMedium 6.8
An RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG_U-ITR-F1-BD_BL.A30.20181117, allows an attacker to trigger arbitrary system functionality by replaying previously recorded signals. This lets an adversary, among other things, disarm an armed system.
- Product
- Securitashome Alarm System Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiva-portal.orgsecuritashome.se
Dec 9, 2021An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h.CVE-2021-21955 · Other software · Anker · reported by talos-cna@cisco.comHigh 7.5
An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. Generic network sniffing can lead to password recovery. An attacker can sniff network traffic to trigger this vulnerability.
- Product
- Eufy Homebase 2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Dec 9, 2021A command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h.CVE-2021-21954 · Other software · Anker · reported by talos-cna@cisco.comCritical 9.9
A command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to arbitrary command execution.
- Product
- Eufy Homebase 2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Dec 9, 2021Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN network which exposes the CVE-2021-20145 · Other software · Gryphonconnect · reported by vulnreport@tenable.comHigh 7.5
Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN network which exposes the LAN interfaces of other users' devices connected to the same service. An attacker could leverage this to make configuration changes to, or otherwise attack victims' devices as though they were on an adjacent network.
- Product
- Gryphon Tower Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 8, 2021An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9CVE-2021-21951 · Other software · Anker · reported by talos-cna@cisco.comCritical 10
An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h in function read_udp_push_config_file. A specially-crafted network packet can lead to code execution.
- Product
- Eufy Homebase 2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Dec 8, 2021An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9CVE-2021-21950 · Other software · Anker · reported by talos-cna@cisco.comCritical 10
An out-of-bounds write vulnerability exists in the CMD_DEVICE_GET_SERVER_LIST_REQUEST functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h in function recv_server_device_response_msg_process. A specially-crafted network packet can lead to code execution.
- Product
- Eufy Homebase 2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Dec 1, 2021manage (last update Oct 24, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in Application/Home/Controller/GoodsController.class.php.CVE-2021-43689 · Other software · Manage Project · reported by MITREMedium 6.1
manage (last update Oct 24, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in Application/Home/Controller/GoodsController.class.php. The exit function will terminate the script and print a message which have values from $_POST.
- Product
- Manage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2021HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability.CVE-2021-26611 · Other software · Goqual · reported by vuln@krcert.or.krHigh 8.1
HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(reboot, factory reset, snapshot etc..)
- Product
- GKW-IC052
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Synapse is a package for Matrix homeservers written in Python 3/Twisted.CVE-2021-41281 · Other software · matrix-org · reported by GitHubHigh 7.5
Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing `../`s, against the whitelist. Server administrators should upgrade to 1.47.1 or later. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2021Redirect 404 Error Page to Homepage or Custom Page with Logs: Does not check for CSRFCVE-2021-24767 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack
- Product
- Redirect 404 Error Page to Homepage or Custom Page with Logs
- Fixed in
- 1.7.9
- What to do
- Update Redirect 404 Error Page to Homepage or Custom Page with Logs to 1.7.9 or newer.
Oct 22, 2021DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via the `filename`, `mid`,CVE-2020-36497 · Other software · Dedecms · reported by MITREMedium 6.1
DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via the `filename`, `mid`, `userid`, and `templet' parameters.
- Product
- Dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Oct 12, 2021A use-after-free vulnerability exists in the pushMuxer CreatePushThread functionality of Anker Eufy Homebase 2 2.1.6.9h.CVE-2021-21941 · Other software · Anker · reported by talos-cna@cisco.comCritical 9
A use-after-free vulnerability exists in the pushMuxer CreatePushThread functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to remote code execution.
- Product
- Eufy Homebase 2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.