Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,147 results · page 14 of 23
Jul 29, 2022When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the liCVE-2022-23004 · Network & remote access · Western Digital · reported by psirt@wdc.comMedium 5.3
When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the library, and an invalid unreduced value is written to the output buffer. This may be leveraged by an attacker to cause an error scenario, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.
- Product
- Sweet B Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwesterndigital.comwesterndigital.com
Jul 29, 2022When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly redCVE-2022-23003 · Network & remote access · Western Digital · reported by psirt@wdc.comMedium 5.3
When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output may cause an error when used in other operations. This may be leveraged by an attacker to cause an error scenario or incorrect choice of session key in applications which use the library, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.
- Product
- Sweet B Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwesterndigital.comwesterndigital.com
Jul 29, 2022When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properly reduced modulo theCVE-2022-23002 · Network & remote access · Western Digital · reported by psirt@wdc.comMedium 5.3
When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output will cause an error when used in other operations. This may be leveraged by an attacker to cause an error scenario in applications which use the library, resulting in a limited denial of service for an individual user. The scope of impact cannot extend to other components.
- Product
- Sweet B Library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwesterndigital.comwesterndigital.com
Jul 28, 2022When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients.CVE-2022-1805 · Other software · Teradici · reported by hp-security-alert@hp.comHigh 8.1
When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. This issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client.
- Product
- Tera2 Pcoip Zero Client Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Jul 26, 2022By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security polCVE-2022-2225 · Other software · Cloudflare · reported by cna@cloudflare.comHigh 8.1
By using warp-cli subcommands (disable-ethernet, disable-wifi), it was possible for a user without admin privileges to bypass configured Zero Trust security policies (e.g. Secure Web Gateway policies) and features such as 'Lock WARP switch'.
- Product
- WARP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file.CVE-2022-2058 · Other software · libtiff · reported by cve@gitlab.comMedium 5.5
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
- Product
- libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file.CVE-2022-2057 · Other software · libtiff · reported by cve@gitlab.comMedium 5.5
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
- Product
- libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2022Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file.CVE-2022-2056 · Other software · libtiff · reported by cve@gitlab.comMedium 5.5
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010.
- Product
- libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022Invalid interval in CONNECT_IND leads to Division by Zero.CVE-2021-3432 · Other software · zephyrproject-rtos · reported by vulnerabilities@zephyrproject.orgMedium 4.3
Invalid interval in CONNECT_IND leads to Division by Zero. Zephyr versions >= v1.14.0 Divide By Zero (CWE-369). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-7364-p4wc-8mj4
- Product
- zephyr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initializeCVE-2022-25345 · Other software · Discordjs · reported by report@snyk.ioHigh 7.5
All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash.
- Product
- Opus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2022ZeroShell 3.9.5 has a command injection vulnerability in /cgi-bin/kerbynet IP parameter, which may allow an authenticated attacker to execute system commands.CVE-2021-41738 · Other software · Zeroshell · reported by MITREHigh 8.8
ZeroShell 3.9.5 has a command injection vulnerability in /cgi-bin/kerbynet IP parameter, which may allow an authenticated attacker to execute system commands.
- Product
- Zeroshell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values from the Zero KnowledgCVE-2022-29566 · Other software · Bulletproofs Project · reported by MITREHigh 8.1
The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of the public values from the Zero Knowledge proof statement as well as all of the public values computed in the proof, aka the Frozen Heart issue.
- Product
- Bulletproofs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.trailofbits.comeprint.iacr.org
Apr 21, 2022In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.CVE-2016-20014 · Other software · PAM Tacplus Project · reported by MITRECritical 9.8
In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.
- Product
- PAM Tacplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data.CVE-2022-24833 · Other software · PrivateBin · reported by GitHubHigh 8.2
PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin < v1.4.0 a cross-site scripting (XSS) vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called ZeroBin. The issue is caused by the fact that SVGs can contain JavaScript. This can allow an attacker to execute code, if the user opens a paste with a specifically crafted SVG attachment, and interacts with the preview image and the instance isn't protected by an appropriate content security policy. Users are advised to either upgrade to version 1.4.0 or to ensure the content security policy of their instance is set correctly.
- Product
- PrivateBin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8.CVE-2022-1316 · Other software · zerotier · reported by security@huntr.devHigh 8.8
Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation
- Product
- zerotier/zerotierone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.CVE-2022-27496 · Other software · Zero-Channel BBS Plus Developers · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
- Product
- Zero-channel BBS Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2022Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin.CVE-2021-38745 · Other software · Chamilo · reported by MITREMedium 6.8
Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker's profile page.
- Product
- Chamilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.chamilo.orgsupport.chamilo.org
Mar 14, 2022Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query.CVE-2021-42391 · Other software · yandex · reported by reefs@jfrog.comMedium 6.5
Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
- Product
- clickhouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query.CVE-2021-42390 · Other software · yandex · reported by reefs@jfrog.comMedium 6.5
Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
- Product
- clickhouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query.CVE-2021-42389 · Other software · yandex · reported by reefs@jfrog.comMedium 6.5
Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
- Product
- clickhouse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2022WordPress Zero Spam: Does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboardCVE-2022-0254 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
- Product
- WordPress Zero Spam
- Fixed in
- 5.2.11
- What to do
- Update WordPress Zero Spam to 5.2.11 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 11, 2022Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file.CVE-2022-0909 · Other software · libtiff · reported by cve@gitlab.comMedium 5.5
Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.
- Product
- libtiff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of ServiceCVE-2022-0856 · Other software · Libcaca Project · reported by patrick@puiterwijk.orgMedium 6.5
libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service
- Product
- Libcaca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Mar 3, 2022Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.CVE-2022-26126 · Other software · Frrouting · reported by Red HatHigh 7.8
Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c.
- Product
- Frrouting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 18, 2022ZEROF Web Server 2.0 allows /admin.back XSS.CVE-2022-25323 · Other software · Zerof · reported by MITREMedium 6.1
ZEROF Web Server 2.0 allows /admin.back XSS.
- Product
- Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022ZEROF Web Server 2.0 allows /HandleEvent SQL Injection.CVE-2022-25322 · Other software · Zerof · reported by MITRECritical 9.8
ZEROF Web Server 2.0 allows /HandleEvent SQL Injection.
- Product
- Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022In startVideoStream() there is a possibility of an OOB Read in the heap, when the camera buffer is ‘zero’ in size.Product: AndroidVersions: Android-11Android IDCVE-2021-39677 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In startVideoStream() there is a possibility of an OOB Read in the heap, when the camera buffer is ‘zero’ in size.Product: AndroidVersions: Android-11Android ID: A-205097028
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 4, 2022Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowing an attacker withCVE-2013-20003 · Other software · Silicon Labs · reported by cret@cert.orgHigh 8.3
Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowing an attacker within radio range to spoof Z-Wave traffic.
- Product
- Z-Wave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordorangecyberdefense.comsensepost.com
Jan 23, 2022Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.CVE-2022-23852 · Other software · Siemens · reported by MITRECritical 9.8
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comgithub.com
Jan 21, 2022A Divide By Zero vulnerability exists in HDF5 v1.13.1-1 vis the function H5T__complete_copy () at /hdf5/src/H5T.c.CVE-2021-46244 · Other software · Hdfgroup · reported by MITREMedium 6.5
A Divide By Zero vulnerability exists in HDF5 v1.13.1-1 vis the function H5T__complete_copy () at /hdf5/src/H5T.c. This vulnerability causes an aritmetic exception, leading to a Denial of Service (DoS).
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2021An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust.CVE-2021-45706 · Other software · Zeroize Derive Project · reported by MITRECritical 9.8
An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
- Product
- Zeroize Derive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Dec 21, 2021A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and application crash.CVE-2021-44917 · Other software · Gnuplot · reported by MITREMedium 5.5
A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and application crash.
- Product
- Gnuplot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Dec 2, 2021SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php.CVE-2021-43681 · Other software · Zerodream · reported by MITREMedium 6.1
SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php. The exit function will terminate the script and print the message $data['proxy_name'].
- Product
- Sakurapanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021A potential vulnerability exists in AMD Platform Security Processor (PSP) that may allow an attacker to zero any privileged register on the System Management NeCVE-2020-12961 · Other software · AMD · reported by psirt@amd.comHigh 7.8
A potential vulnerability exists in AMD Platform Security Processor (PSP) that may allow an attacker to zero any privileged register on the System Management Network which may lead to bypassing SPI ROM protections.
- Product
- 2nd Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file.CVE-2020-23903 · Other software · Xiph · reported by MITREMedium 5.5
A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file.
- Product
- Speex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Nov 9, 2021The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signature is non-zero, whCVE-2021-43572 · Other software · Starkbank · reported by MITRECritical 9.8
The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
- Product
- Ecdsa-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2021The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge siCVE-2021-43571 · Other software · Starkbank · reported by MITRECritical 9.8
The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
- Product
- Ecdsa-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.nccgroup.com
Nov 9, 2021The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signaCVE-2021-43570 · Other software · Starkbank · reported by MITRECritical 9.8
The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
- Product
- Ecdsa-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.nccgroup.com
Nov 9, 2021The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge sigCVE-2021-43569 · Other software · Starkbank · reported by MITRECritical 9.8
The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
- Product
- Ecdsa-dotnet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.nccgroup.com
Nov 9, 2021The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge sCVE-2021-43568 · Other software · Starkbank · reported by MITRECritical 9.8
The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
- Product
- Elixir Ecdsa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comresearch.nccgroup.com
Oct 25, 2021In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data.CVE-2021-0938 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-171418586References: Upstream kernel
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 20, 2021Vulnerability in the Zero Downtime DB Migration to Cloud component of Oracle Database Server.CVE-2021-35599 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Zero Downtime DB Migration to Cloud component of Oracle Database Server. The supported version that is affected is 21c. Easily exploitable vulnerability allows high privileged attacker having Local Logon privilege with logon to the infrastructure where Zero Downtime DB Migration to Cloud executes to compromise Zero Downtime DB Migration to Cloud. While the vulnerability is in Zero Downtime DB Migration to Cloud, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Zero Downtime DB Migration to Cloud. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
- Product
- Database - Enterprise Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021A lack of target address verification in the destroycontract() function of 0xRACER 1.0 allows attackers to steal tokens from victim users via a crafted script.CVE-2020-19767 · Other software · Zeroxracer Project · reported by MITREHigh 7.5
A lack of target address verification in the destroycontract() function of 0xRACER 1.0 allows attackers to steal tokens from victim users via a crafted script.
- Product
- Zeroxracer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2021libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec_apng.cc jxl::DecodeImageAPNG().CVE-2021-36692 · Other software · Libjxl Project · reported by MITREMedium 6.5
libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec_apng.cc jxl::DecodeImageAPNG(). When encoding a malicous APNG file using cjxl, an attacker can trigger a denial of service.
- Product
- Libjxl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2021Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypCVE-2021-29923 · Other software · Golang · reported by MITREHigh 7.5
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.
- Product
- GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2021library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in soCVE-2021-29922 · Other software · Rust-lang · reported by MITRECritical 9.1
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
- Product
- Rust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddefcon.orgdoc.rust-lang.org
Jul 15, 2021Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point, mask.c#L85.CVE-2021-27847 · Other software · Libvips · reported by MITREMedium 6.5
Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point, mask.c#L85.
- Product
- Libvips
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2021A Divide-by-zero vulnerability exists in JasPer Image Coding Toolkit 2.0 in jasper/src/libjasper/jpc/jpc_enc.cCVE-2021-27845 · Other software · Jasper Project · reported by MITREMedium 5.5
A Divide-by-zero vulnerability exists in JasPer Image Coding Toolkit 2.0 in jasper/src/libjasper/jpc/jpc_enc.c
- Product
- Jasper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021-20235.CVE-2020-36400 · Other software · Zeromq · reported by MITRECritical 9.8
ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021-20235.
- Product
- Libzmq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Jun 23, 2021Divide-by-zero bug in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.CVE-2021-34069 · Other software · Tsmuxer Project · reported by MITREMedium 5.5
Divide-by-zero bug in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.
- Product
- Tsmuxer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.