Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,547 results · page 162 of 391
Sep 15, 2021SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious coCVE-2021-33694 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.8
SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious codes that get stored in the database, and when accessed, could be executed in the application, resulting in Stored Cross-Site Scripting.
- Product
- SAP Cloud Connector
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 15, 2021NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabilitCVE-2021-33691 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.SAP NetWeaver Development Infrastructure Notification Service allows a threat actor to send crafted scripts to a victim. If the victim has an active session when the crafted script gets executed, the threat actor could compromise information in victims session, and gain access to some sensitive information also.
- Product
- SAP NetWeaver Development Infrastructure (Notification Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 15, 2021The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/indexCVE-2021-40845 · Other software · Zenitel · reported by MITREHigh 8.8
The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.
- Product
- Alphacom XE Audio Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 14, 2021SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks forCVE-2021-37535 · Network & remote access · SAP SE · reported by cna@sap.comCritical 9.8
SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authorization checks for user privileges.
- Product
- SAP NetWeaver Application Server Java (JMS Connector Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 14, 2021Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive information, but does not hCVE-2021-33686 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.3
Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive information, but does not have control over kind or degree.
- Product
- SAP Business One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 14, 2021Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs.CVE-2021-33675 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to exploit a Reflected Cross-Site Scripting (XSS) vulnerability through phishing and to execute arbitrary code on the victim's browser.
- Product
- SAP Contact Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 14, 2021Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs.CVE-2021-33674 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. This allows an attacker to exploit a Reflected Cross-Site Scripting (XSS) vulnerability when creating a new email and to execute arbitrary code on the victim's browser.
- Product
- SAP Contact Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 14, 2021Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them.CVE-2021-33673 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. This allows an attacker to exploit a Stored Cross-Site Scripting (XSS) vulnerability when a user browses through the employee directory and to execute arbitrary code on the victim's browser. Due to the usage of ActiveX in the application, the attacker can further execute operating system level commands.
- Product
- SAP Contact Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 14, 2021SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulting in Stored Cross-SCVE-2021-21489 · Network & remote access · SAP SE · reported by cna@sap.comMedium 4.8
SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulting in Stored Cross-Site Scripting (XSS) vulnerability. This would allow an attacker with administrative privileges to store a malicious script on the portal. The execution of the script content by a victim registered on the portal could compromise the confidentiality and integrity of portal content.
- Product
- SAP NetWeaver Enterprise Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 13, 2021tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the combination of data, OACK, and other optioCVE-2021-41054 · Other software · Atftp Project · reported by MITREHigh 7.5
tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the combination of data, OACK, and other options.
- Product
- Atftp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Sep 13, 2021Comment Link Remove and Other Comment Tools: Does not have CSRF check in its 'Delete comments easily'CVE-2021-24725 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments
- Product
- Comment Link Remove and Other Comment Tools
- Fixed in
- 2.1.6
- What to do
- Update Comment Link Remove and Other Comment Tools to 2.1.6 or newer.
Full record and what to do →NVD recordwpscan.comtrustwave.com
Sep 13, 2021Timetable and Event Schedule by MotoPress: Does not sanitise some of its parametersCVE-2021-24724 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s
- Product
- Timetable and Event Schedule by MotoPress
- Fixed in
- 2.3.19
- What to do
- Update Timetable and Event Schedule by MotoPress to 2.3.19 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Sep 13, 2021WordPress Advanced Ticket System, Elite Support Helpdesk: Does not sanitize or escape form values before saving to the database orCVE-2021-24623 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WordPress Advanced Ticket System, Elite Support Helpdesk
- Fixed in
- 1.0.64
- What to do
- Update WordPress Advanced Ticket System, Elite Support Helpdesk to 1.0.64 or newer.
Sep 13, 2021WP Courses LMS: Does not sanitise its Video Embed CodeCVE-2021-24621 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfiltered_html capability is disallowed, which could lead to Stored Cross-Site Scripting issues
- Product
- WP Courses LMS
- Fixed in
- 2.0.44
- What to do
- Update WP Courses LMS to 2.0.44 or newer.
Sep 13, 2021The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital prodCVE-2021-24620 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE
- Product
- WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- Affected
- up to 2.2.5
- What to do
- Affects up to 2.2.5. Update WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Per page add to head: Does not properly sanitise one of its settingCVE-2021-24619 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfiltered_html capability is disallowed, which could lead to Cross-Site Scripting issues.
- Product
- Per page add to head
- Affected
- up to 1.4.4
- What to do
- Affects up to 1.4.4. Update Per page add to head to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Book appointment online: Does not sanitise or escape Service Prices before outputting it in the ListCVE-2021-24614 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Book appointment online WordPress plugin before 1.39 does not sanitise or escape Service Prices before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Book appointment online
- Fixed in
- 1.39
- What to do
- Update Book appointment online to 1.39 or newer.
Sep 13, 2021create_post_page AJAX action of the Custom Post View Generator: (available to authenticated user) does not sanitise or escape user input before outputting it back in the responseCVE-2021-24605 · WordPress plugins & themes · reported by WPScanMedium 5.4
The create_post_page AJAX action of the Custom Post View Generator WordPress plugin through 0.4.6 (available to authenticated user) does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue
- Product
- create_post_page AJAX action of the Custom Post View Generator
- Affected
- up to 0.4.6
- What to do
- Affects up to 0.4.6. Update create_post_page AJAX action of the Custom Post View Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Software License Manager: Does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboardCVE-2021-24560 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
- Product
- Software License Manager
- Fixed in
- 4.4.8
- What to do
- Update Software License Manager to 4.4.8 or newer.
Sep 13, 2021Daily Prayer Time: Does not sanitise or escape some of its settings before outputting them in the pageCVE-2021-24523 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues.
- Product
- Daily Prayer Time
- Fixed in
- 2021.08.10
- What to do
- Update Daily Prayer Time to 2021.08.10 or newer.
Sep 13, 2021MF Gig Calendar: Does not sanitise and escape the id GET parameter before outputting back in the admin dashboardCVE-2021-24510 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue
- Product
- MF Gig Calendar
- Fixed in
- 1.2
- What to do
- Update MF Gig Calendar to 1.2 or newer.
Sep 13, 2021Smash Balloon Social Post Feed: Does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of iCVE-2021-24508 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.
- Product
- Smash Balloon Social Post Feed
- Fixed in
- 2.19.2
- What to do
- Update Smash Balloon Social Post Feed to 2.19.2 or newer.
Sep 13, 2021The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any securityCVE-2021-24493 · WordPress plugins & themes · reported by WPScanCritical 9.8
The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading to RCE
- Product
- Shopp
- Affected
- up to 1.4
- What to do
- Affects up to 1.4. Update Shopp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Fileviewer: Does not have CSRF checks in placeCVE-2021-24491 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a result, attackers could make a logged in administrator delete and upload arbitrary files via a CSRF attack
- Product
- Fileviewer
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Fileviewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Email Artillery (MASS EMAIL): Does not properly check the uploaded files from the Import Emails featureCVE-2021-24490 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denying access to everything in the folder the file is uploaded to, the malicious uploaded file will only be accessible on Web Servers such as Nginx/IIS
- Product
- Email Artillery (MASS EMAIL)
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update Email Artillery (MASS EMAIL) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 13, 2021Language Bar Flags: Does not have any CSRF in placeCVE-2021-24431 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in the frontend for all users
- Product
- Language Bar Flags
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update Language Bar Flags to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 7, 2021The Bluetooth Classic implementation on the Texas Instruments CC256XCQFN-EM does not properly handle the reception of continuous LMP_AU_Rand packets, allowing aCVE-2021-34149 · Other software · TI · reported by MITREMedium 6.5
The Bluetooth Classic implementation on the Texas Instruments CC256XCQFN-EM does not properly handle the reception of continuous LMP_AU_Rand packets, allowing attackers in radio range to trigger a denial of service (deadlock) of the device by flooding it with LMP_AU_Rand packets after the paging procedure.
- Product
- Cc256xcqfn-em Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netti.com
Sep 7, 2021The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot wCVE-2021-34148 · Other software · Cypress · reported by MITREMedium 6.5
The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with a greater ACL Length after completion of the LMP setup procedure, allowing attackers in radio range to trigger a denial of service (firmware crash) via a crafted LMP packet.
- Product
- Wireless Internet Connectivity For Embedded Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netcypress.com
Sep 7, 2021The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timingCVE-2021-34147 · Other software · Cypress · reported by MITREMedium 6.5
The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, allowing attackers to exhaust device BT resources and eventually trigger a crash via multiple attempts of sending a crafted LMP timing accuracy response followed by a sudden reconnection with a random BDAddress.
- Product
- Wireless Internet Connectivity For Embedded Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netcypress.com
Sep 7, 2021The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attCVE-2021-34146 · Other software · Cypress · reported by MITREMedium 6.5
The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and restart (crash) of the device by flooding it with LMP_AU_Rand packets after the paging procedure.
- Product
- Cyw920735q60evb-01 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netcypress.com
Sep 7, 2021The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot wCVE-2021-34145 · Other software · Cypress · reported by MITREMedium 5.3
The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with an invalid Baseband packet type (and LT_ADDRESS and LT_ADDR) after completion of the LMP setup procedure, allowing attackers in radio range to trigger a denial of service (firmware crash) via a crafted LMP packet.
- Product
- Wireless Internet Connectivity For Embedded Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netcypress.com
Sep 7, 2021The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C_DEMO_V1.0 does not properly handle the reception of continuous unsolicited LMP responses, allowCVE-2021-34143 · Other software · Zh-jieli · reported by MITREMedium 6.5
The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C_DEMO_V1.0 does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (deadlock) of the device by flooding it with LMP_AU_Rand packets after paging procedure. User intervention is required to restart the device.
- Product
- Fw-ac63 BT SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netgithub.com
Sep 7, 2021The Bluetooth Classic Audio implementation on Actions ATS2815 and ATS2819 devices does not properly handle a connection attempt from a host with the same BDAddrCVE-2021-31786 · Other software · Actions-semi · reported by MITREMedium 6.5
The Bluetooth Classic Audio implementation on Actions ATS2815 and ATS2819 devices does not properly handle a connection attempt from a host with the same BDAddress as the current connected BT host, allowing attackers to trigger a disconnection and deadlock of the device by connecting with a forged BDAddress that matches the original connected host.
- Product
- Ats2819p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netlaunchstudio.bluetooth.com
Sep 7, 2021The Bluetooth Classic implementation on Actions ATS2815 and ATS2819 chipsets does not properly handle the reception of multiple LMP_host_connection_req packets,CVE-2021-31785 · Other software · Actions-semi · reported by MITREMedium 6.5
The Bluetooth Classic implementation on Actions ATS2815 and ATS2819 chipsets does not properly handle the reception of multiple LMP_host_connection_req packets, allowing attackers in radio range to trigger a denial of service (deadlock) of the device via crafted LMP packets. Manual user intervention is required to restart the device and restore Bluetooth communication.
- Product
- Ats2819p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netlaunchstudio.bluetooth.com
Sep 7, 2021The Bluetooth Classic implementation on Zhuhai Jieli AC690X devices does not properly handle the reception of an oversized LMP packet greater than 17 bytes duriCVE-2021-31612 · Other software · Zh-jieli · reported by MITREMedium 6.5
The Bluetooth Classic implementation on Zhuhai Jieli AC690X devices does not properly handle the reception of an oversized LMP packet greater than 17 bytes during the LMP auto rate procedure, allowing attackers in radio range to trigger a deadlock via a crafted LMP packet.
- Product
- Ac6901 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzh-jieli.comdl.packetstormsecurity.net
Sep 7, 2021The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure that is followed by CVE-2021-31611 · Other software · Zh-jieli · reported by MITREMedium 5.7
The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure that is followed by a malformed LMP packet, allowing attackers in radio range to deadlock a device via a crafted LMP packet. The user needs to manually reboot the device to restore communication.
- Product
- Ac6901 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzh-jieli.comdl.packetstormsecurity.net
Sep 7, 2021The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in raCVE-2021-31610 · Other software · MI · reported by MITREMedium 6.5
The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (either restart or deadlock the device) by flooding a device with LMP_AU_rand data.
- Product
- MI True Wireless Earbuds Basic 2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbluetrum.combluetrum.com
Sep 7, 2021The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17 bCVE-2021-31609 · Other software · Silabs · reported by MITREMedium 6.5
The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17 bytes, allowing attackers in radio range to trigger a crash in WT32i via a crafted LMP packet.
- Product
- Iwrap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netsilabs.com
Sep 7, 2021The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response CVE-2021-28139 · Other software · Espressif · reported by MITREHigh 8.8
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield payload.
- Product
- Esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netgithub.com
Sep 7, 2021The Bluetooth Classic implementation on Bluetrum AB5301A devices with unknown firmware versions does not properly handle the reception of oversized DM1 LMP packCVE-2021-34150 · Other software · Bluetrum · reported by MITREMedium 6.5
The Bluetooth Classic implementation on Bluetrum AB5301A devices with unknown firmware versions does not properly handle the reception of oversized DM1 LMP packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections (disabling the AB5301A inquiry and page scan procedures) via a crafted LMP packet. The user needs to manually perform a power cycle (restart) of the device to restore BT connectivity.
- Product
- Ab5301a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbluetrum.comdl.packetstormsecurity.net
Sep 7, 2021The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C BT SDK through 0.9.1 does not properly handle the reception of truncated LMP_SCO_Link_Request pCVE-2021-34144 · Other software · Zh-jieli · reported by MITREMedium 6.5
The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C BT SDK through 0.9.1 does not properly handle the reception of truncated LMP_SCO_Link_Request packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections (disabling the AB5301A inquiry and page scan procedures) via a crafted LMP packet. The user needs to manually perform a power cycle (restart) of the device to restore BT connectivity.
- Product
- Fw-ac63 BT SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netgithub.com
Sep 7, 2021The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle the reception of a truncated LMP packet during the LMP aCVE-2021-31613 · Other software · Zh-jieli · reported by MITREMedium 6.5
The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle the reception of a truncated LMP packet during the LMP auto rate procedure, allowing attackers in radio range to immediately crash (and restart) a device via a crafted LMP packet.
- Product
- Ac6901 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzh-jieli.comdl.packetstormsecurity.net
Sep 7, 2021The Bluetooth Classic implementation on JBL TUNE500BT devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackersCVE-2021-28155 · Other software · JBL · reported by MITREMedium 6.5
The Bluetooth Classic implementation on JBL TUNE500BT devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and shutdown a device by flooding the target device with LMP Feature Response data.
- Product
- Tune500bt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netjbl.com.sg
Sep 7, 2021The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets dCVE-2021-28136 · Other software · Espressif · reported by MITREMedium 6.5
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet.
- Product
- Esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netgithub.com
Sep 7, 2021The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowiCVE-2021-28135 · Other software · Espressif · reported by MITREMedium 6.5
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (crash) in ESP32 by flooding the target device with LMP Feature Response data.
- Product
- Esp-idf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddl.packetstormsecurity.netgithub.com
Sep 6, 2021Keyword Meta: Does not sanitise of escape its settings before outputting them back in the page after they are savedCVE-2021-24611 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.
- Product
- Keyword Meta
- Affected
- up to 3.0
- What to do
- Affects up to 3.0. Update Keyword Meta to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 6, 2021Site Reviews: Does not sanitise some of its Review DetailsCVE-2021-24603 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed
- Product
- Site Reviews
- Fixed in
- 5.13.1
- What to do
- Update Site Reviews to 5.13.1 or newer.
Sep 6, 2021WPFront Notification Bar: Does not properly sanitise and escape its settingsCVE-2021-24601 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WPFront Notification Bar
- Fixed in
- 2.1.0.08087
- What to do
- Update WPFront Notification Bar to 2.1.0.08087 or newer.
Sep 6, 2021Highlight: Does not sanitise its CustomCSS settingCVE-2021-24591 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Product
- Highlight
- Fixed in
- 0.9.3
- What to do
- Update Highlight to 0.9.3 or newer.
Sep 6, 2021Cookie Notice & Consent Banner for GDPR & CCPA Compliance: Does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization optionsCVE-2021-24590 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options.
- Product
- Cookie Notice & Consent Banner for GDPR & CCPA Compliance
- Fixed in
- 1.7.2
- What to do
- Update Cookie Notice & Consent Banner for GDPR & CCPA Compliance to 1.7.2 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.