Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list
35added in the last 30 days
472new WordPress flaws this week
390,714entries in the database

1,281 results · page 15 of 26

  • Dec 6, 2023Permission management vulnerability in the module for disabling Sound Booster.CVE-2023-6273 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3

    Permission management vulnerability in the module for disabling Sound Booster. Successful exploitation of this vulnerability may cause features to perform abnormally.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023Vulnerability of unauthorized file access in the Settings app.CVE-2023-49248 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5

    Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause unauthorized file access.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023Permission verification vulnerability in distributed scenarios.CVE-2023-49247 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023Unauthorized access vulnerability in the card management module.CVE-2023-49246 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023Unauthorized access vulnerability in the Huawei Share module.CVE-2023-49245 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Unauthorized access vulnerability in the Huawei Share module. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023Permission management vulnerability in the multi-user module.CVE-2023-49244 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Permission management vulnerability in the multi-user module. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023Vulnerability of unauthorized access to email attachments in the email module.CVE-2023-49243 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023Free broadcast vulnerability in the running management module.CVE-2023-49242 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Free broadcast vulnerability in the running management module. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023API permission control vulnerability in the network management module.CVE-2023-49241 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    API permission control vulnerability in the network management module. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023Unauthorized access vulnerability in the launcher module.CVE-2023-49240 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023Unauthorized access vulnerability in the card management module.CVE-2023-49239 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023Permission management vulnerability in the PMS module.CVE-2023-46773 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8

    Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023Vulnerability of missing permission verification for APIs in the Designed for Reliability (DFR) module.CVE-2023-44113 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Vulnerability of missing permission verification for APIs in the Designed for Reliability (DFR) module. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 6, 2023Vulnerability of data verification errors in the kernel module.CVE-2023-44099 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Vulnerability of data verification errors in the kernel module. Successful exploitation of this vulnerability may cause WLAN interruption.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 20, 2023in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through type confusion.CVE-2023-6045 · Other software · OpenHarmony · reported by scy@openharmony.ioMedium 5.9

    in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through type confusion.

    Product
    OpenHarmony
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 20, 2023in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through buffer overflow.CVE-2023-47217 · Other software · OpenHarmony · reported by scy@openharmony.ioMedium 4

    in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through buffer overflow.

    Product
    OpenHarmony
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 20, 2023in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion.CVE-2023-46705 · Other software · OpenHarmony · reported by scy@openharmony.ioMedium 6.2

    in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion.

    Product
    OpenHarmony
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 20, 2023in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource.CVE-2023-46100 · Other software · OpenHarmony · reported by scy@openharmony.ioMedium 6.2

    in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource.

    Product
    OpenHarmony
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 20, 2023in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions.CVE-2023-43612 · Other software · OpenHarmony · reported by scy@openharmony.ioHigh 8.4

    in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions.

    Product
    OpenHarmony
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 20, 2023in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default permissions.CVE-2023-42774 · Other software · OpenHarmony · reported by scy@openharmony.ioMedium 6.2

    in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default permissions.

    Product
    OpenHarmony
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 20, 2023in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through incorrect default permissions.CVE-2023-3116 · Other software · OpenHarmony · reported by scy@openharmony.ioHigh 7.3

    in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through incorrect default permissions.

    Product
    OpenHarmony
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 12, 2023Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security.CVE-2023-28134 · Other software · checkpoint · reported by cve@checkpoint.comHigh 7.8

    Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

    Product
    Harmony Endpoint.
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Permission control vulnerability in the call module.CVE-2023-46759 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Permission control vulnerability in the call module. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Permission management vulnerability in the multi-screen interaction module.CVE-2023-46758 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the device.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability may affect confidentCVE-2023-46757 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability may affect confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Permission control vulnerability in the window management module.CVE-2023-46756 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3

    Permission control vulnerability in the window management module. Successful exploitation of this vulnerability may cause malicious pop-up windows.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Vulnerability of uncaught exceptions in the NFC module.CVE-2023-46774 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Vulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Out-of-bounds write vulnerability in the kernel driver module.CVE-2023-46767 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Out-of-bounds write vulnerability in the kernel driver module.CVE-2023-46766 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Vulnerability of uncaught exceptions in the NFC module.CVE-2023-46765 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Vulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Unauthorized startup vulnerability of background apps.CVE-2023-46764 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3

    Unauthorized startup vulnerability of background apps. Successful exploitation of this vulnerability may cause background apps to start maliciously.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Vulnerability of background app permission management in the framework module.CVE-2023-46763 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3

    Vulnerability of background app permission management in the framework module. Successful exploitation of this vulnerability may cause background apps to start maliciously.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Out-of-bounds write vulnerability in the kernel driver module.CVE-2023-46762 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Out-of-bounds write vulnerability in the kernel driver module.CVE-2023-46761 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Out-of-bounds write vulnerability in the kernel driver module.CVE-2023-46760 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Vulnerability of input parameters being not strictly verified in the input.CVE-2023-46755 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3

    Vulnerability of input parameters being not strictly verified in the input. Successful exploitation of this vulnerability may cause the launcher to restart.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Race condition vulnerability in the kernel module.CVE-2022-48613 · Other software · Huawei · reported by psirt@huawei.comMedium 5.9

    Race condition vulnerability in the kernel module. Successful exploitation of this vulnerability may cause variable values to be read with the condition evaluation bypassed.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Security vulnerability in the face unlock module.CVE-2023-46771 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Security vulnerability in the face unlock module. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 8, 2023Vulnerability of missing encryption in the card management module.CVE-2023-44098 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Vulnerability of missing encryption in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 7, 2023Vulnerability of improper permission control in the Booster module.CVE-2023-44115 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 7, 2023Vulnerability of identity verification being bypassed in the face unlock module.CVE-2023-5801 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1

    Vulnerability of identity verification being bypassed in the face unlock module. Successful exploitation of this vulnerability will affect integrity and confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 7, 2023Out-of-bounds vulnerability in the sensor module.CVE-2023-46770 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Out-of-bounds vulnerability in the sensor module. Successful exploitation of this vulnerability may cause mistouch prevention errors on users' mobile phones.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 7, 2023Use-After-Free (UAF) vulnerability in the dubai module.CVE-2023-46769 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Use-After-Free (UAF) vulnerability in the dubai module. Successful exploitation of this vulnerability will affect availability.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 7, 2023Multi-thread vulnerability in the idmap module.CVE-2023-46768 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Multi-thread vulnerability in the idmap module. Successful exploitation of this vulnerability may cause features to perform abnormally.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 11, 2023Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will affect availability.CVE-2023-44119 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will affect availability.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 11, 2023Vulnerability of undefined permissions in the MeeTime module.Successful exploitation of this vulnerability will affect availability and confidentiality.CVE-2023-44118 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1

    Vulnerability of undefined permissions in the MeeTime module.Successful exploitation of this vulnerability will affect availability and confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 11, 2023Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may cause some apps to runCVE-2023-44116 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8

    Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may cause some apps to run without being authorized.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 11, 2023Out-of-bounds array vulnerability in the dataipa module.Successful exploitation of this vulnerability may affect service confidentiality.CVE-2023-44114 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Out-of-bounds array vulnerability in the dataipa module.Successful exploitation of this vulnerability may affect service confidentiality.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 11, 2023Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart.CVE-2023-44108 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5

    Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 11, 2023 Vulnerability of defects introduced in the design process in the screen projection module.Successful exploitation of this vulnerability may affect service avaiCVE-2023-44107 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1

    Vulnerability of defects introduced in the design process in the screen projection module.Successful exploitation of this vulnerability may affect service availability and integrity.

    Product
    HarmonyOS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.