Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,213 results · page 16 of 25
Apr 15, 2022Windows Hyper-V Remote Code Execution VulnerabilityCVE-2022-24537 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Hyper-V Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Hyper-V Shared Virtual Hard Disks Information Disclosure VulnerabilityCVE-2022-24490 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
- Product
- Windows Server 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Hyper-V Denial of Service VulnerabilityCVE-2022-23268 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows Hyper-V Denial of Service Vulnerability
- Product
- Windows Server 2022
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Hyper-V Remote Code Execution VulnerabilityCVE-2022-23257 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Windows Hyper-V Remote Code Execution Vulnerability
- Product
- Windows 11 version 22H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Hyper-V Remote Code Execution VulnerabilityCVE-2022-22009 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Hyper-V Remote Code Execution Vulnerability
- Product
- Windows 10 Version 21H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Hyper-V Remote Code Execution VulnerabilityCVE-2022-22008 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Hyper-V Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 5, 2022Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_trCVE-2022-26356 · Other software · Xen · reported by security@xen.orgMedium 5.6
Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4.9) is racy with ongoing log dirty hypercalls. A suitably timed call to XEN_DMOP_track_dirty_vram can enable log dirty while another CPU is still in the process of tearing down the structures related to a previously enabled log dirty mode (XEN_DOMCTL_SHADOW_OP_OFF). This is due to lack of mutually exclusive locking between both operations and can lead to entries being added in already freed slots, resulting in a memory leak.
- Product
- xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Mar 9, 2022Windows Hyper-V Denial of Service VulnerabilityCVE-2022-21975 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Windows Hyper-V Denial of Service Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 21, 2022AnyComment: Does not have CSRF checks in the Import and Revert HyperComments featuresCVE-2022-0134 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack
- Product
- AnyComment
- Fixed in
- 0.2.18
- What to do
- Update AnyComment to 0.2.18 or newer.
Feb 9, 2022Windows Hyper-V Denial of Service VulnerabilityCVE-2022-22712 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.6
Windows Hyper-V Denial of Service Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 9, 2022Windows Hyper-V Remote Code Execution VulnerabilityCVE-2022-21995 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.9
Windows Hyper-V Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 7, 2022NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt storm on the hypervCVE-2022-21816 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt storm on the hypervisor host, leading to a denial of service.
- Product
- NVIDIA Virtual GPU Software and NVIDIA Cloud Gaming
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jan 19, 2022Vulnerability in the Oracle Essbase Administration Services product of Oracle Essbase (component: EAS Console).CVE-2021-35683 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9
Vulnerability in the Oracle Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported version that is affected is Prior to 11.1.2.4.047. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase Administration Services. While the vulnerability is in Oracle Essbase Administration Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Essbase Administration Services. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
- Product
- Hyperion Essbase Administration Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2022Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdraCVE-2021-30285 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.3
Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Inf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 11, 2022Windows Hyper-V Security Feature Bypass VulnerabilityCVE-2022-21905 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.6
Windows Hyper-V Security Feature Bypass Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2022Windows Hyper-V Elevation of Privilege VulnerabilityCVE-2022-21901 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9
Windows Hyper-V Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2022Windows Hyper-V Security Feature Bypass VulnerabilityCVE-2022-21900 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.6
Windows Hyper-V Security Feature Bypass Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2022Windows Hyper-V Denial of Service VulnerabilityCVE-2022-21847 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows Hyper-V Denial of Service Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 5, 2022A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 via the H5D__create_chunk_file_map_hyper function in /hdf5/src/H5Dchunk.c, which causes a DeCVE-2021-45833 · Other software · Hdfgroup · reported by MITREMedium 5.5
A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 via the H5D__create_chunk_file_map_hyper function in /hdf5/src/H5Dchunk.c, which causes a Denial of Service (context-dependent).
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2022IBM PowerVM Hypervisor FW860, FW940, FW950, and FW1010, through a specific sequence of VM management operations could lead to a violation of the isolation betweCVE-2021-38918 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM PowerVM Hypervisor FW860, FW940, FW950, and FW1010, through a specific sequence of VM management operations could lead to a violation of the isolation between peer VMs. IBM X-Force ID: 210019.
- Product
- PowerVM Hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 15, 2021Windows Hyper-V Denial of Service VulnerabilityCVE-2021-43246 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.6
Windows Hyper-V Denial of Service Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 13, 2021Besu is an Ethereum client written in Java.CVE-2021-41272 · Other software · hyperledger · reported by GitHubHigh 7.5
Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error in values that represent negative values for 32 bit signed integers. Smart contracts that ask for shifts between approximately 2 billion and 4 billion bits (nonsensical but valid values for the operation) will fail to execute and hence fail to validate. In networks where vulnerable versions are mining with other clients or non-vulnerable versions this will result in a fork and the relevant transactions will not be included in the fork. In networks where vulnerable versions are not mining (such as Rinkeby) no fork will result and the validator nodes will stop accepting blocks. In networks where only vulnerable versions are mining the relevant transaction will not be included in any blocks. When the network adds a non-vulnerable version the network will act as in the first case. Besu 21.10.2 contains a patch for this issue. Besu 21.7.4 is not vulnerable and clients can roll back to that version. There is a workaround available: Once a transaction with the relevant shift operations is inc
- Product
- besu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (TLCVE-2021-26340 · Other software · AMD · reported by psirt@amd.comHigh 8.4
A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation Lookaside Buffer (TLB) resulting in unexpected behavior inside the virtual machine (VM).
- Product
- AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2021IBM PowerVM Hypervisor FW940, FW950, and FW1010 could allow an authenticated user to cause the system to crash using a specially crafted IBMi Hypervisor call.CVE-2021-38937 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM PowerVM Hypervisor FW940, FW950, and FW1010 could allow an authenticated user to cause the system to crash using a specially crafted IBMi Hypervisor call. IBM X-Force ID: 210894.
- Product
- PowerVM Hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 10, 2021IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and write arbitrary host system memory throCVE-2021-38917 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and write arbitrary host system memory through a series of carefully crafted service procedures. IBM X-Force ID: 210018.
- Product
- PowerVM Hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Nov 23, 2021guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its mCVE-2021-28706 · Other software · Xen · reported by security@xen.orgHigh 8.6
guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its memory allocation beyond the administrator established limit. This is a result of a calculation done with 32-bit precision, which may overflow. It would then only be the overflowed (and hence small) number which gets compared against the established upper bound.
- Product
- xen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Nov 18, 2021A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0.CVE-2021-43669 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.
- Product
- Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjira.hyperledger.org
Nov 18, 2021A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0.CVE-2021-43667 · Computers, phones & browsers · Linuxfoundation · reported by MITREHigh 7.5
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.
- Product
- Fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjira.hyperledger.org
Nov 12, 2021Possible memory corruption due to Improper handling of hypervisor unmap operations for concurrent memory operations in Snapdragon Auto, Snapdragon Compute, SnapCVE-2021-1921 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Possible memory corruption due to Improper handling of hypervisor unmap operations for concurrent memory operations in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Nov 9, 2021Windows Hyper-V Denial of Service VulnerabilityCVE-2021-42284 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Windows Hyper-V Denial of Service Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 9, 2021Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service VulnerabilityCVE-2021-42274 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.8
Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 8, 2021G Auto-Hyperlink: Does not sanitise or escape an 'id' GET parameter before using it in a SQL statementCVE-2021-24627 · WordPress plugins & themes · reported by WPScanHigh 7.2
The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection
- Product
- G Auto-Hyperlink
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update G Auto-Hyperlink to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodevigilant.comwpscan.com
Oct 20, 2021Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion (component: Repository).CVE-2021-35665 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.1
Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.6.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Hyperion Financial Reporting. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Hyperion Financial Reporting, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
- Product
- Hyperion Financial Reporting
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console).CVE-2021-35655 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported versions that are affected are Prior to 11.1.2.4.046 and Prior to 21.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Essbase Administration Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Essbase Administration Services accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Product
- Hyperion Essbase Administration Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console).CVE-2021-35654 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported versions that are affected are Prior to 11.1.2.4.046 and Prior to 21.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Essbase Administration Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Essbase Administration Services. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
- Product
- Hyperion Essbase Administration Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console).CVE-2021-35653 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.7
Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported versions that are affected are Prior to 11.1.2.4.046 and Prior to 21.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Essbase Administration Services. While the vulnerability is in Essbase Administration Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Essbase Administration Services accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
- Product
- Hyperion Essbase Administration Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console).CVE-2021-35652 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 10
Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported versions that are affected are Prior to 11.1.2.4.046 and Prior to 21.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Essbase Administration Services. While the vulnerability is in Essbase Administration Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Essbase Administration Services. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
- Product
- Hyperion Essbase Administration Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console).CVE-2021-35651 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.5
Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported versions that are affected are Prior to 11.1.2.4.046 and Prior to 21.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Essbase Administration Services. While the vulnerability is in Essbase Administration Services, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Essbase Administration Services accessible data as well as unauthorized update, insert or delete access to some of Essbase Administration Services accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
- Product
- Hyperion Essbase Administration Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2021Windows Hyper-V Remote Code Execution VulnerabilityCVE-2021-40461 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Windows Hyper-V Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Oct 12, 2021Windows Hyper-V Remote Code Execution VulnerabilityCVE-2021-38672 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Windows Hyper-V Remote Code Execution Vulnerability
- Product
- Windows Server 2022
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Oct 6, 2021IBM PowerVM Hypervisor FW1010 could allow a privileged user to gain access to another VM due to assigning duplicate WWPNs.CVE-2021-38923 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.1
IBM PowerVM Hypervisor FW1010 could allow a privileged user to gain access to another VM due to assigning duplicate WWPNs. IBM X-Force ID: 210162.
- Product
- PowerVM Hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 21, 2021IBM PowerVM Hypervisor FW860, FW930, FW940, and FW950 could allow a local user to create a specially crafted sequence of hypervisor calls from a partition that CVE-2021-29795 · Other software · IBM · reported by psirt@us.ibm.comMedium 6
IBM PowerVM Hypervisor FW860, FW930, FW940, and FW950 could allow a local user to create a specially crafted sequence of hypervisor calls from a partition that could crash the system. IBM X-Force ID: 203557.
- Product
- PowerVM Hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 15, 2021PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the execution of arbitrary CVE-2021-39307 · Other software · Pdftron · reported by MITREMedium 6.1
PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the execution of arbitrary JavaScript code.
- Product
- Webviewer UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.nccgroup.compdftron.com
Aug 31, 2021A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.CVE-2021-35239 · Other software · SolarWinds · reported by psirt@solarwinds.comHigh 7.5
A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.
- Product
- Orion Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsupport.solarwinds.com
Aug 4, 2021IBM PowerVM Hypervisor FW940 and FW950 could allow an attacker to obtain sensitive information if they gain service access to the FSP.CVE-2021-29765 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM PowerVM Hypervisor FW940 and FW950 could allow an attacker to obtain sensitive information if they gain service access to the FSP. IBM X-Force ID: 202476.
- Product
- PowerVM Hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 29, 2021The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange protocol can be compromised.CVE-2021-20505 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange protocol can be compromised. If an attacker has the ability to capture encrypted LPM network traffic and is able to gain service access to the FSP they can use this information to perform a series of PowerVM service procedures to decrypt the captured migration traffic IBM X-Force ID: 198232
- Product
- PowerVM Hypervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 21, 2021Vulnerability in the Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management).CVE-2021-2445 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.7
Vulnerability in the Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). The supported version that is affected is 11.2.5.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion Infrastructure Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Hyperion Infrastructure Technology accessible data as well as unauthorized access to critical data or complete access to all Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N).
- Product
- Hyperion Infrastructure Technology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021Vulnerability in the Oracle Hyperion BI+ product of Oracle Hyperion (component: UI and Visualization).CVE-2021-2439 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the Oracle Hyperion BI+ product of Oracle Hyperion (component: UI and Visualization). Supported versions that are affected are 11.1.2.4 and 11.2.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion BI+. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Hyperion BI+ accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).
- Product
- Hyperion BI+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021Vulnerability in the Essbase Analytic Provider Services product of Oracle Essbase (component: JAPI).CVE-2021-2435 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the Essbase Analytic Provider Services product of Oracle Essbase (component: JAPI). The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Essbase Analytic Provider Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Essbase Analytic Provider Services accessible data as well as unauthorized access to critical data or complete access to all Essbase Analytic Provider Services accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).
- Product
- Hyperion Analytic Provider Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2021Vulnerability in the Essbase Analytic Provider Services product of Oracle Essbase (component: Web Services).CVE-2021-2433 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Essbase Analytic Provider Services product of Oracle Essbase (component: Web Services). Supported versions that are affected are 11.1.2.4 and 21.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Essbase Analytic Provider Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Essbase Analytic Provider Services. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
- Product
- Hyperion Analytic Provider Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.