Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,375 results · page 14 of 28
Mar 16, 2022An infinite loop flaw was found in the e1000 NIC emulator of the QEMU.CVE-2021-20257 · Other software · Qemu · reported by Red HatMedium 6.5
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Feb 24, 2022@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development.CVE-2022-24709 · Other software · aws · reported by GitHubHigh 8.8
@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and may allow for javascript injection. Users are advised to upgrade to version 3.0.367 or later. There are no known workarounds for this issue.
- Product
- awsui-documentation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Pexip Infinity before 27.0 has improper WebRTC input validation.CVE-2022-23228 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.0 has improper WebRTC input validation. An unauthenticated remote attacker can use excessive resources, temporarily causing denial of service.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Feb 18, 2022Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation.CVE-2021-29656 · Other software · Pexip · reported by MITRECritical 9.8
Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation. The allow list is not properly checked.
- Product
- Infinity Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Feb 18, 2022Pexip Infinity Connect before 1.8.0 omits certain provisioning authenticity checks.CVE-2021-29655 · Other software · Pexip · reported by MITRECritical 9.8
Pexip Infinity Connect before 1.8.0 omits certain provisioning authenticity checks. Thus, untrusted code may execute.
- Product
- Infinity Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Feb 14, 2022Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture fileCVE-2022-0586 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 6.3
Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmdCVE-2021-46354 · Other software · Cybelesoft · reported by MITREHigh 7.5
Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 4, 2022A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.CVE-2021-40401 · Other software · Gerbv Project · reported by talos-cna@cisco.comHigh 8.6
A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Gerbv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgtalosintelligence.com
Jan 28, 2022Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.CVE-2021-27654 · Other software · Pegasystems · reported by security@pega.comHigh 7.8
Forgotten password reset functionality for local accounts can be used to bypass local authentication checks.
- Product
- Pega Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcollaborate.pega.comcollaborate.pega.com
Jan 15, 2022Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.CVE-2021-42555 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jan 15, 2022Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.CVE-2021-35969 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jan 15, 2022Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2).CVE-2021-33499 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2).
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jan 15, 2022Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2).CVE-2021-33498 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2).
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jan 15, 2022Pexip Infinity before 26 allows remote denial of service because of missing RTMP input validation.CVE-2021-32545 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 26 allows remote denial of service because of missing RTMP input validation.
- Product
- Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jan 14, 2022The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module.CVE-2021-23567 · Other software · Colors.js Project · reported by report@snyk.ioHigh 7.5
The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0
- Product
- Colors.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2022Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop.CVE-2021-45445 · Other software · Unisys · reported by MITREHigh 7.5
Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop.
- Product
- Clearpath MCP Tcp/ip Networking Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublic.support.unisys.comunisys.com
Jan 4, 2022In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite looCVE-2021-40111 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade.
- Product
- Apache James
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Dec 30, 2021Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture fileCVE-2021-4185 · Other software · Wireshark Foundation · reported by cve@gitlab.comHigh 7.5
Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2021Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture fileCVE-2021-4184 · Other software · Wireshark Foundation · reported by cve@gitlab.comHigh 7.5
Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2021Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams.CVE-2021-43861 · Other software · mermaid-js · reported by GitHubHigh 7.2
Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading.
- Product
- mermaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2021An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste_tokens function.CVE-2021-45257 · Other software · Nasm · reported by MITREMedium 5.5
An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste_tokens function.
- Product
- Netwide Assembler
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.nasm.usbugzilla.nasm.us
Dec 21, 2021An infinite loop vulnerability exists in gpac 1.1.0 in the gf_log function, which causes a Denial of Service.CVE-2021-44924 · Other software · Gpac · reported by MITREMedium 5.5
An infinite loop vulnerability exists in gpac 1.1.0 in the gf_log function, which causes a Denial of Service.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2021An infinite loop vulnerability exists in Gpac 1.0.1 in gf_get_bit_size.CVE-2021-45297 · Other software · Gpac · reported by MITREMedium 5.5
An infinite loop vulnerability exists in Gpac 1.0.1 in gf_get_bit_size.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2021Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI.CVE-2021-44554 · Other software · Cybelesoft · reported by MITREMedium 5.3
Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest and krgtbt.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.CVE-2021-45092 · Other software · Cybelesoft · reported by MITRECritical 9.8
Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 15, 2021In AdapterService and GattService definition of AndroidManifest.xml, there is a possible way to disable bluetooth connection due to a missing permission check.CVE-2021-1017 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In AdapterService and GattService definition of AndroidManifest.xml, there is a possible way to disable bluetooth connection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-182583850
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 15, 2021In the broadcast definition in AndroidManifest.xml, there is a possible way to set the A2DP bluetooth device connection state due to a missing permission check.CVE-2021-0999 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In the broadcast definition in AndroidManifest.xml, there is a possible way to set the A2DP bluetooth device connection state due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-196858999
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 12, 2021In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exiCVE-2021-44848 · Other software · Cybelesoft · reported by MITREMedium 5.3
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.
- Product
- Thinfinity Virtualui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Nov 9, 2021NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run.CVE-2021-43172 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlHigh 7.5
NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuously generating a new child CA that only consists of another CA using a different RRDP repository, a malicious CA can create a chain of CAs of de-facto infinite length. Routinator prior to version 0.10.2 did not contain a limit on the length of such a chain and will therefore continue to process this chain forever. As a result, the validation run will never finish, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.
- Product
- Routinator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnlnetlabs.nlnlnetlabs.nl
Nov 5, 2021Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8.CVE-2020-23566 · Other software · Irfanview · reported by MITREMedium 5.5
Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8.
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2021In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely.CVE-2021-41973 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
- Product
- Apache MINA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Nov 1, 2021An issue was discovered in the character definitions of the Unicode Specification through 14.0.CVE-2021-42694 · Other software · unicode · reported by MITREHigh 8.3
An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows an adversary to produce source code identifiers such as function names using homoglyphs that render visually identical to a target identifier. Adversaries can leverage this to inject code via adversarial identifier definitions in upstream software dependencies invoked deceptively in downstream software. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard (all versions). Unless mitigated, an adversary could produce source code identifiers using homoglyph characters that render visually identical to but are distinct from a target identifier. In this way, an adversary could inject adversarial identifier definitions in upstream software that are not detected by human reviewers and are invoked deceptively in downstream software. The Unicode Consortium has documented this class of security vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode
- Product
- unicode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Oct 20, 2021The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to leverage network delay to cause a denial of service (indefinite sCVE-2021-42765 · Other software · Proof-of-stake Ethereum Project · reported by MITREHigh 7.5
The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to leverage network delay to cause a denial of service (indefinite stalling of consensus decisions).
- Product
- Proof-of-stake Ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2021TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case.CVE-2021-42260 · Other software · Tinyxml Project · reported by MITREHigh 7.5
TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.
- Product
- Tinyxml
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
Sep 28, 2021Irfanview 4.57 is affected by an infinite loop when processing a crafted BMP file in the EFFECTS!AutoCrop_W component.CVE-2021-29365 · Other software · Irfanview · reported by MITREMedium 5.5
Irfanview 4.57 is affected by an infinite loop when processing a crafted BMP file in the EFFECTS!AutoCrop_W component. This can cause a denial of service (DOS).
- Product
- Irfanview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021An infinite loop in Open Robotics ros_comm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 allows remote attackers to cause a Denial oCVE-2021-37146 · Other software · ROS · reported by MITREHigh 7.5
An infinite loop in Open Robotics ros_comm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 allows remote attackers to cause a Denial of Service in ros_comm via a crafted XMLRPC call.
- Product
- Ros-comm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscourse.ros.orgdiscourse.ros.org
Sep 9, 2021The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU anCVE-2021-40839 · Other software · Rencode Project · reported by MITREHigh 7.5
The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.
- Product
- Rencode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2021A vulnerability affecting F-Secure Antivirus engine was discovered whereby scanning WIM archive file can lead to denial-of-service (infinite loop and freezes AVCVE-2021-33599 · Other software · F-Secure · reported by cve-notifications-us@f-secure.comMedium 4.6
A vulnerability affecting F-Secure Antivirus engine was discovered whereby scanning WIM archive file can lead to denial-of-service (infinite loop and freezes AV engine scanner). The vulnerability can be exploit remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.
- Product
- F-Secure endpoint protection products on Windows and Mac. F-Secure Linux Security (32-bit) F-Secure Linux Security 64 F-Secure Atlant F-Secure Cloud Protecti
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comf-secure.com
Aug 19, 2021The web server in InterNiche NicheStack through 4.0.1 allows remote attackers to cause a denial of service (infinite loop and networking outage) via an unexpectCVE-2021-27565 · Other software · Hcc-embedded · reported by MITREHigh 7.5
The web server in InterNiche NicheStack through 4.0.1 allows remote attackers to cause a denial of service (infinite loop and networking outage) via an unexpected valid HTTP request such as OPTIONS. This occurs because the HTTP request handler enters a miscoded wbs_loop() debugger hook.
- Product
- Nichestack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforescout.comhcc-embedded.com
Aug 10, 2021In Contiki 3.0, a Telnet server that silently quits (before disconnection with clients) leads to connected clients entering an infinite loop and waiting foreverCVE-2021-38387 · Other software · Contiki-os · reported by MITREHigh 7.5
In Contiki 3.0, a Telnet server that silently quits (before disconnection with clients) leads to connected clients entering an infinite loop and waiting forever, which may cause excessive CPU consumption.
- Product
- Contiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2021Astra Pro Addon: Did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated userCVE-2021-24507 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQL statement, leading to an SQL Injection issues
- Product
- Astra Pro Addon
- Fixed in
- 3.5.2
- What to do
- Update Astra Pro Addon to 3.5.2 or newer.
Aug 2, 2021There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause an infinite loop in DoS.CVE-2021-22381 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause an infinite loop in DoS.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jul 13, 2021When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop.CVE-2021-35515 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
- Product
- Apache Commons Compress
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comcommons.apache.org
Jul 7, 2021Pexip Infinity 25.x before 25.4 has Improper Input Validation, and thus an unauthenticated remote attacker can cause a denial of service via the administrative CVE-2021-31925 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 25.x before 25.4 has Improper Input Validation, and thus an unauthenticated remote attacker can cause a denial of service via the administrative web interface.
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jul 7, 2021Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup.CVE-2020-25868 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup. An unauthenticated remote attacker can trigger a software abort (temporary loss of service).
- Product
- Pexip Infinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.pexip.comdocs.pexip.com
Jun 18, 2021Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file".CVE-2020-18442 · Other software · Gdraheim · reported by MITRELow 3.3
Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file".
- Product
- Zziplib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jun 12, 2021In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file.CVE-2021-31812 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.5
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
- Product
- Apache PDFBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Jun 11, 2021A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could resultCVE-2021-22762 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in remote code execution, when a malicious CGF or WSP file is being parsed by IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 11, 2021A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior thatCVE-2021-22761 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote code e+F15xecution due to missing length check on user supplied data, when a malicious CGF file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 11, 2021A CWE-763: Release of invalid pointer or reference vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data orCVE-2021-22760 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-763: Release of invalid pointer or reference vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing checks of user-supplied input data, when a malicious CGF file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.