Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,692 results · page 17 of 34
Jan 10, 2024The issue was addressed with additional restrictions on the observability of app states.CVE-2023-42829 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
The issue was addressed with additional restrictions on the observability of app states. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to access SSH passphrases.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 10, 2024An access issue was addressed with additional sandbox restrictions.CVE-2023-28197 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4. An app may be able to access user-sensitive data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 3, 2024Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM) "Garage Door Control Module Setup" and modifCVE-2023-5881 · Other software · The Genie Company · reported by cve@rapid7.comHigh 8.2
Unauthenticated access permitted to web interface page The Genie Company Aladdin Connect (Retrofit-Kit Model ALDCM) "Garage Door Control Module Setup" and modify the Garage door's SSID settings.
- Product
- Aladdin Connect (Retrofit-Kit)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Garage Door Control ModuCVE-2023-5880 · Other software · The Genie Company · reported by cve@rapid7.comHigh 8.8
When the Genie Company Aladdin Connect garage door opener (Retrofit-Kit Model ALDCM) is placed into configuration mode the web servers “Garage Door Control Module Setup” page is vulnerable to XSS via a broadcast SSID name containing malicious code with client side Java Script and/or HTML. This allows the attacker to inject malicious code with client side Java Script and/or HTML into the users' web browser.
- Product
- Aladdin Connect (Retrofit-Kit)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2024Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) CVE-2023-5879 · Other software · The Genie Company · reported by cve@rapid7.comMedium 6.8
Users’ product account authentication data was stored in clear text in The Genie Company Aladdin Connect Mobile Application Version 5.65 Build 2075 (and below) on Android Devices. This allows the attacker, with access to the android device, to potentially retrieve users' clear text authentication credentials.
- Product
- Aladdin Connect Mobile Application
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2023Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data.CVE-2023-51663 · Other software · hail-is · reported by GitHubMedium 5.3
Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect (OIDC) email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change their email address, they could create accounts and use resources in clusters that they should not have access to. For example, a user could create a Microsoft or Google account and then change their email to `test@example.org`. This account can then be used to create a Hail Batch account in Hail Batch clusters whose organization domain is `example.org`. The attacker is not able to access private data or impersonate another user, but they would have the ability to run jobs if Hail Batch billing projects are enabled and create Azure Tenants if they have Azure Active Directory Administrator access.
- Product
- hail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2023An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This isCVE-2023-41097 · Other software · silabs.com · reported by product-security@silabs.comMedium 4.6
An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0.
- Product
- GSDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsiliconlabs.lightning.force.com
Dec 18, 2023An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code onCVE-2023-32727 · Other software · Zabbix · reported by security@zabbix.comMedium 6.8
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comlists.debian.org
Dec 17, 2023Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.CVE-2023-50979 · Other software · Cryptopp · reported by MITREMedium 5.9
Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.
- Product
- Crypto++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023 When handling contactless cards, usage of a specific function to get additional information from the card which doesn't check the boundary on the dataCVE-2023-33222 · Other software · IDEMIA · reported by a87f365f-9d39-4848-9b3a-58c7cae69cabMedium 6.8
When handling contactless cards, usage of a specific function to get additional information from the card which doesn't check the boundary on the data received while reading. This allows a stack-based buffer overflow that could lead to a potential Remote Code Execution on the targeted device
- Product
- SIGMA Lite & Lite +
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2023A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker fCVE-2023-6357 · Other software · CODESYS · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker could exploit the vulnerability and inject additional system commands via file system libraries which could give the attacker full control of the device.
- Product
- CODESYS Control for BeagleBone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2023In saveToXml of PersistableBundle.java, invalid data could lead to local persistent denial of service with no additional execution privileges needed.CVE-2023-40074 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In saveToXml of PersistableBundle.java, invalid data could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Nov 28, 2023Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perCVE-2023-3533 · Other software · Chamilo · reported by info@starlabs.sgCritical 9.8
Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.
- Product
- Chamilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2023Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution CVE-2023-3368 · Other software · Chamilo · reported by info@starlabs.sgCritical 9.8
Command injection in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960.
- Product
- Chamilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2023An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding.CVE-2023-48051 · Other software · Carglglz · reported by MITREHigh 7.5
An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding.
- Product
- Upydev
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023yt-dlp is a youtube-dl fork with additional features and fixes.CVE-2023-46121 · Other software · yt-dlp · reported by GitHubMedium 5
yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution when using `--no-check-certificate`.
- Product
- yt-dlp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.CVE-2023-5546 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 4.3
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
- Product
- moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 9, 2023Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.CVE-2023-5544 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 6.5
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Nov 1, 2023SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the getrulebCVE-2023-44025 · Other software · Addify · reported by MITRECritical 9.8
SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the getrulebyid function in the AddifyfreegiftsModel.php component.
- Product
- Free Gifts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Oct 25, 2023A permissions issue was addressed with additional restrictions.CVE-2023-40444 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1. An app may be able to access user-sensitive data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.apple.com
Oct 25, 2023A permissions issue was addressed with additional restrictions.CVE-2023-40421 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1, macOS Monterey 12.7.1, macOS Ventura 13.6.1. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Oct 25, 2023The issue was addressed with additional permissions checks.CVE-2023-40401 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
The issue was addressed with additional permissions checks. This issue is fixed in macOS Ventura 13.6.1. An attacker may be able to access passkeys without authentication.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.apple.com
Oct 10, 2023SmodBIP is vulnerable to Cross-Site Request Forgery, that could be used to induce logged in users to perform unintended actions, including creation of additionaCVE-2023-4837 · Other software · Jan Syski · reported by cvd@cert.plHigh 8.8
SmodBIP is vulnerable to Cross-Site Request Forgery, that could be used to induce logged in users to perform unintended actions, including creation of additional accounts with administrative privileges. This issue affects all versions of SmodBIP. SmodBIP is no longer maintained and the vulnerability will not be fixed.
- Product
- SmodBIP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2023Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information.CVE-2023-5331 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Oct 4, 2023On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated dataCVE-2023-5368 · Other software · FreeBSD · reported by secteam@freebsd.orgMedium 6.5
On an msdosfs filesystem, the 'truncate' or 'ftruncate' system calls under certain circumstances populate the additional space in the file with unallocated data from the underlying disk device, rather than zero bytes. This may permit a user with write access to files on a msdosfs filesystem to read unintended data (e.g. from a previously deleted file).
- Product
- FreeBSD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddfir.rusecurity.freebsd.org
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui HTTP Auth plugin <= 0.3.2 versions.CVE-2023-27435 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui HTTP Auth plugin <= 0.3.2 versions.
- Fixed in
- 1.0.0
- What to do
- Update the plugin to 1.0.0 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Sep 27, 2023A permissions issue was addressed with additional restrictions.CVE-2023-41980 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to bypass Privacy preferences.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Sep 27, 2023This issue was addressed by adding an additional prompt for user consent.CVE-2023-40541 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14. A shortcut may output sensitive user data without consent.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.apple.com
Sep 27, 2023A permissions issue was addressed with additional restrictions.CVE-2023-40455 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 10
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent sandbox restrictions.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.apple.com
Sep 27, 2023A permissions issue was addressed with additional restrictions.CVE-2023-40454 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to delete files for which it does not have permission.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Sep 27, 2023A configuration issue was addressed with additional restrictions.CVE-2023-40434 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access a user's Photos Library.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Sep 27, 2023A permissions issue was addressed with additional restrictions.CVE-2023-40426 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. An app may be able to bypass certain Privacy preferences.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.apple.com
Sep 27, 2023A permissions issue was addressed with additional restrictions.CVE-2023-40402 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. An app may be able to access sensitive user data.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.apple.com
Sep 27, 2023An access issue was addressed with additional sandbox restrictions.CVE-2023-38586 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 10
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent sandbox restrictions.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsupport.apple.com
Sep 25, 2023yt-dlp is a youtube-dl fork with additional features and fixes.CVE-2023-40581 · Other software · yt-dlp · reported by GitHubHigh 8.3
yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata values may be used in the shell commands. The metadata fields can be combined with the `%q` conversion, which is intended to quote/escape these values so they can be safely passed to the shell. However, the escaping used for `cmd` (the shell used by Python's `subprocess` on Windows) does not properly escape special characters, which can allow for remote code execution if `--exec` is used directly with maliciously crafted remote data. This vulnerability only impacts `yt-dlp` on Windows, and the vulnerability is present regardless of whether `yt-dlp` is run from `cmd` or from `PowerShell`. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2023.09.24 fixes this issue by properly escaping each special character. `\n` will be replaced by `\r` as no way of escaping it has been found. It is recommended to upgrade yt-dlp
- Product
- yt-dlp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameterCVE-2023-41436 · Other software · Cskaza · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additional Meta Tag parameter in the Pages Content Menu component.
- Product
- Cszcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2023A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolvCVE-2023-32636 · Other software · glib · reported by Red HatMedium 4.7
A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.
- Product
- glib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In wcn bsp driver, there is a possible out of bounds write due to a missing bounds check.This could lead to local denial of service with no additional executionCVE-2023-38554 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In wcn bsp driver, there is a possible out of bounds write due to a missing bounds check.This could lead to local denial of service with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38464 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privilegesCVE-2023-38463 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privilegesCVE-2023-38462 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privilegesCVE-2023-38461 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38460 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38459 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38458 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privilegesCVE-2023-38457 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38456 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38455 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privilegesCVE-2023-38454 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2023In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privilegesCVE-2023-38453 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- Product
- SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.