Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,443 results · page 15 of 29
Oct 12, 2021A heap-based buffer overflow vulnerability exists in the pushMuxer processRtspInfo functionality of Anker Eufy Homebase 2 2.1.6.9h.CVE-2021-21940 · Other software · Anker · reported by talos-cna@cisco.comCritical 10
A heap-based buffer overflow vulnerability exists in the pushMuxer processRtspInfo functionality of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted network packet can lead to a heap buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.
- Product
- Eufy Homebase 2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 1, 2021Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home apCVE-2021-29110 · Other software · Esri · reported by psirt@esri.comMedium 5.4
Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.
- Product
- Portal for ArcGIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2021An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter.CVE-2021-41649 · Other software · Online-shopping-system-advanced Project · reported by MITRECritical 9.8
An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.
- Product
- Online-shopping-system-advanced
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordawesomeopensource.comgithub.com
Sep 29, 2021An uncontrolled search path element privilege escalation vulnerability in Trend Micro HouseCall for Home Networks version 5.3.1225 and below could allow an attaCVE-2021-32466 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7
An uncontrolled search path element privilege escalation vulnerability in Trend Micro HouseCall for Home Networks version 5.3.1225 and below could allow an attacker to escalate privileges by placing a custom crafted file in a specific directory to load a malicious library. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
- Product
- Trend Micro HouseCall for Home Networks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.comhelpcenter.trendmicro.com
Sep 28, 2021ESPHome is a system to control the ESP8266/ESP32.CVE-2021-41104 · Other software · esphome · reported by GitHubHigh 7.5
ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.
- Product
- esphome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point.CVE-2021-22276 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.1
The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point.
- Product
- System Access Point
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Sep 13, 2021A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in aCVE-2021-40823 · Other software · Matrix · reported by MITREMedium 5.9
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were originally sent by affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.
- Product
- Javascript SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add.CVE-2020-19705 · Other software · Thinkphp-zcms Project · reported by MITRECritical 9.8
thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add.
- Product
- Thinkphp-zcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2021A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract dCVE-2021-36748 · Other software · Prestahome · reported by MITREHigh 7.5
A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract data from the database via the sb_category parameter.
- Product
- Blog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalysum5.promokit.eublog.sorcery.ie
Aug 17, 2021SQL Injection vulnerability exists in tp-shop 2.x-3.x via the /index.php/home/api/shop fBill parameter.CVE-2020-18164 · Other software · Tp-shop · reported by MITRECritical 9.8
SQL Injection vulnerability exists in tp-shop 2.x-3.x via the /index.php/home/api/shop fBill parameter.
- Product
- Tp-shop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxz.aliyun.comxz.aliyun.com
Aug 17, 2021A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious code to the install fCVE-2020-22937 · Other software · Phome · reported by MITRECritical 9.8
A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious code to the install file.
- Product
- Empirecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Aug 3, 2021An issue was discovered in Comelit "App lejos de casa (web)" 2.8.0.CVE-2019-14453 · Other software · Comelitgroup · reported by MITREHigh 8.8
An issue was discovered in Comelit "App lejos de casa (web)" 2.8.0. It allows privilege escalation via modified domus and logged fields, related to js/bridge.min.js and login.json. For example, an attacker can achieve high privileges (installer or administrator) for the graphical interface via a 1C000000000S value for domus, in conjunction with a zero value for logged.
- Product
- Away From Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogx86.netblogx86.net
Aug 3, 2021A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wireless Access Control sCVE-2021-27954 · Other software · Ecobee · reported by MITREHigh 8.2
A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to force the device to connect to a SSID or cause a denial of service.
- Product
- Ecobee3 Lite Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordl9group.coml9group.com
Aug 3, 2021A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process.CVE-2021-27953 · Other software · Ecobee · reported by MITREHigh 7.5
A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to cause a denial of service, forcing the device to reboot via a crafted HTTP request.
- Product
- Ecobee3 Lite Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordl9group.coml9group.com
Jul 22, 2021A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up tCVE-2021-33032 · Other software · Eq-3 · reported by MITRECritical 10
A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple HTTP request.
- Product
- Homematic Ccu2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnovag.github.ioeq-3.de
Jul 22, 2021Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2.1CVE-2020-5316 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3, 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, 3.2.1, 3.2.2, 3.3, 3.3.1, 3.3.2, 3.3.3, 3.4 contain an uncontrolled search path vulnerability. A locally authenticated low privileged user could exploit this vulnerability to cause the loading of arbitrary DLLs by the SupportAssist binaries, resulting in the privileged execution of arbitrary code.
- Product
- Dell SupportAssist Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2021There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS.CVE-2021-20107 · Other software · Sloan · reported by vulnreport@tenable.comMedium 5.4
There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vulnerability allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low Energy (BLE) connectivity to read and write to many BLE characteristics on the device. Some of these control the flow of water, the sensitivity of the sensors, and information about maintenance.
- Product
- Optima Eaf-100 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jun 16, 2021Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room key backup from the CVE-2021-34813 · Other software · Matrix · reported by MITRECritical 9.8
Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room key backup from the homeserver) because olm_pk_decrypt has a stack-based buffer overflow. Remote code execution might be possible for some nonstandard build configurations.
- Product
- OLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.matrix.orggitlab.matrix.org
Jun 8, 2021Nextcloud Android is the Android client for the Nextcloud open source home cloud system.CVE-2021-32658 · Other software · nextcloud · reported by GitHubMedium 4.7
Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all sensitive data on account removal. This could include sensitive key material such as the End-to-End encryption keys. It is recommended that the Nextcloud Android App is upgraded to 3.16.1
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2021Trend Micro Home Network Security version 6.6.604 and earlier contains a hard-coded password vulnerability in the log collection server which could allow an attCVE-2021-32459 · Other software · Trend Micro · reported by security@trendmicro.comMedium 6.5
Trend Micro Home Network Security version 6.6.604 and earlier contains a hard-coded password vulnerability in the log collection server which could allow an attacker to use a specially crafted network request to lead to arbitrary authentication. An attacker must first obtain the ability to execute high-privileged code on the target device in order to exploit this vulnerability.
- Product
- Trend Micro Home Network Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.comtalosintelligence.com
May 27, 2021Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which could allow an attacker CVE-2021-32458 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.8
Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which could allow an attacker to issue a specially crafted iotcl which could lead to code execution on affected devices. An attacker must first obtain the ability to execute low-privileged code on the target device in order to exploit this vulnerability.
- Product
- Trend Micro Home Network Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.comtalosintelligence.com
May 26, 2021Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause information to be exposed when an unauthorCVE-2021-22740 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 6.5
Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause information to be exposed when an unauthorized file is uploaded.
- Product
- Spacelynk Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
May 26, 2021Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a device to be compromised when it is firsCVE-2021-22739 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 5.9
Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a device to be compromised when it is first configured.
- Product
- Spacelynk Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
May 26, 2021Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unauthorized acCVE-2021-22738 · Other software · Schneider-electric · reported by cybersecurity@se.comCritical 9.8
Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unauthorized access when credentials are discovered after a brute force attack.
- Product
- Spacelynk Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
May 26, 2021Insufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unauthorized access of whenCVE-2021-22737 · Other software · Schneider-electric · reported by cybersecurity@se.comCritical 9.8
Insufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unauthorized access of when credentials are discovered after a brute force attack.
- Product
- Spacelynk Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
May 26, 2021Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior whCVE-2021-22736 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a denial of service when an unauthorized file is uploaded.
- Product
- Spacelynk Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
May 26, 2021Improper Verification of Cryptographic Signature vulnerability exists inhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could allow remote code exeCVE-2021-22735 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.2
Improper Verification of Cryptographic Signature vulnerability exists inhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could allow remote code execution when unauthorized code is copied to the device.
- Product
- Spacelynk Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
May 26, 2021Improper Verification of Cryptographic Signature vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause remote code exCVE-2021-22734 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.2
Improper Verification of Cryptographic Signature vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause remote code execution when an attacker loads unauthorized code.
- Product
- Spacelynk Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
May 26, 2021Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause shell access when unauthorized coCVE-2021-22733 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause shell access when unauthorized code is loaded into the system folder.
- Product
- Spacelynk Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
May 26, 2021Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a code execution issue when an atCVE-2021-22732 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a code execution issue when an attacker loads unauthorized code on the web server.
- Product
- Spacelynk Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
May 26, 2021Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which could allow an attacker CVE-2021-32457 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.8
Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which could allow an attacker to issue a specially crafted iotcl to escalate privileges on affected devices. An attacker must first obtain the ability to execute low-privileged code on the target device in order to exploit this vulnerability.
- Product
- Trend Micro Home Network Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.comtalosintelligence.com
May 20, 2021homee Brain Cube v2 (2.28.2 and 2.28.4) devices have sensitive SSH keys within downloadable and unencrypted firmware images.CVE-2020-24396 · Other software · Hom.ee · reported by MITREHigh 7.5
homee Brain Cube v2 (2.28.2 and 2.28.4) devices have sensitive SSH keys within downloadable and unencrypted firmware images. This allows remote attackers to use the support server as a SOCKS proxy.
- Product
- Brain Cube Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2021The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install compromised firmware.CVE-2020-24395 · Other software · Hom.ee · reported by MITREMedium 6.8
The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install compromised firmware. This occurs because of insufficient validation of the firmware image file and can lead to code execution on the device.
- Product
- Brain Cube Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2021tab parameter of the settings page of the All 404 Redirect to Homepage: Was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issueCVE-2021-24326 · WordPress plugins & themes · reported by WPScanMedium 5.4
The tab parameter of the settings page of the All 404 Redirect to Homepage WordPress plugin before 1.21 was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issue as user input was not properly sanitised before being output in an attribute.
- Product
- tab parameter of the settings page of the All 404 Redirect to Homepage
- Fixed in
- 1.21
- What to do
- Update tab parameter of the settings page of the All 404 Redirect to Homepage to 1.21 or newer.
May 14, 2021Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of cCVE-2020-18167 · Other software · Laobancms · reported by MITREMedium 4.8
Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of component "admin/info.php?shuyu".
- Product
- Laobancms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2021An incorrect permission vulnerability in the product installer folders for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attCVE-2021-31519 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.3
An incorrect permission vulnerability in the product installer folders for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker to escalate privileges by placing arbitrary code on a specified folder and have that code be executed by an Administrator who is running a scan. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
- Product
- Trend Micro HouseCall for Home Networks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.comzerodayinitiative.com
May 12, 2021An incorrect permission vulnerability in the product installer for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker toCVE-2021-28649 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.3
An incorrect permission vulnerability in the product installer for Trend Micro HouseCall for Home Networks version 5.3.1179 and below could allow an attacker to escalate privileges by placing arbitrary code on a specified folder and have that code be executed by an Administrator who is running a scan. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.
- Product
- Trend Micro HouseCall for Home Networks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.comzerodayinitiative.com
May 11, 2021Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse).CVE-2021-29471 · Other software · matrix-org · reported by GitHubLow 3.7
Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 "Push rules" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2021Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit the vulnerability aCVE-2021-31518 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.5
Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit the vulnerability and cause a denial-of-service to the device. This vulnerability is similar, but not identical to CVE-2021-31517.
- Product
- Trend Micro Home Network Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.comhelpcenter.trendmicro.com
May 5, 2021Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit the vulnerability aCVE-2021-31517 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7.5
Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit the vulnerability and cause a denial-of-service to the device. This vulnerability is similar, but not identical to CVE-2021-31518.
- Product
- Trend Micro Home Network Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpcenter.trendmicro.comhelpcenter.trendmicro.com
Apr 29, 2021Smartwares HOME easy <=1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability.CVE-2020-21997 · Other software · Smartwares · reported by MITREHigh 7.5
Smartwares HOME easy <=1.0.9 is vulnerable to an unauthenticated database backup download and information disclosure vulnerability. An attacker could disclose sensitive and clear-text information resulting in authentication bypass, session hijacking and full system control.
- Product
- Home Easy Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgexploit-db.com
Apr 29, 2021Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to improper access controlCVE-2020-21990 · Other software · Domoticz · reported by MITREHigh 7.5
Emmanuel MyDomoAtHome (MDAH) REST API REST API Domoticz ISS Gateway 0.2.40 is affected by an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker can exploit this, via a specially crafted request to gain access to sensitive information.
- Product
- Mydomoathome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comzeroscience.mk
Apr 27, 2021HomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP address using the X-Forwarded-For header with the local (loopbaCVE-2020-22001 · Other software · Homeautomation Project · reported by MITRECritical 9.8
HomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP address using the X-Forwarded-For header with the local (loopback) IP address value allowing remote control of the smart home solution.
- Product
- Homeautomation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgexploit-db.com
Apr 27, 2021HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin.CVE-2020-22000 · Other software · Homeautomation Project · reported by MITREHigh 8
HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'set_command_on' and 'set_command_off' POST parameters in '/system/systemplugins/customcommand/customcommand.plugin.php' by using an unsanitized PHP exec() function.
- Product
- Homeautomation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comzeroscience.mk
Apr 27, 2021In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users.CVE-2020-21998 · Other software · Homeautomation Project · reported by MITREMedium 6.1
In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.
- Product
- Homeautomation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comzeroscience.mk
Apr 27, 2021HomeAutomation 3.3.2 is affected by Cross Site Request Forgery (CSRF).CVE-2020-21989 · Other software · Homeautomation Project · reported by MITREHigh 8.8
HomeAutomation 3.3.2 is affected by Cross Site Request Forgery (CSRF). The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
- Product
- Homeautomation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comzeroscience.mk
Apr 27, 2021HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting (XSS).CVE-2020-21987 · Other software · Homeautomation Project · reported by MITREMedium 6.1
HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting (XSS). XSS vulnerabilities occur when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session.
- Product
- Homeautomation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comzeroscience.mk
Apr 22, 2021Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Home page).CVE-2021-2200 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Home page). The supported version that is affected is 12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applications Framework accessible data as well as unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
- Product
- Applications Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2021In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol.CVE-2021-20992 · Other software · Fibar Group S.A · reported by info@cert.vde.comHigh 8.1
In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords.
- Product
- Fibaro Home Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Apr 19, 2021In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vulCVE-2021-20991 · Other software · Fibar Group S.A · reported by info@cert.vde.comCritical 9.8
In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vulnerability.
- Product
- Fibaro Home Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.