Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,310 results · page 17 of 27
May 5, 2023llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.CVE-2023-29935 · Other software · Llvm · reported by MITREMedium 5.5
llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.
- Product
- Llvm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2023Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported.CVE-2022-2084 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 5.5
Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
- Product
- cloud-init
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.CVE-2023-1758 · Other software · thorsten · reported by security@huntr.devMedium 5.4
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023When cpif handles probe failures, there is a possible out of bounds read due to a use after free.CVE-2023-21045 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
When cpif handles probe failures, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-259323725References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 24, 2023In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidVersions: Android kernelAndroid ID: A-2642CVE-2023-21036 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidVersions: Android kernelAndroid ID: A-264261868References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 24, 2023In multiple functions of SnoozeHelper.java, there is a possible failure to persist settings due to an uncaught exception.CVE-2023-20993 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of SnoozeHelper.java, there is a possible failure to persist settings due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-261588851
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 24, 2023In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due to resource exhaustion.CVE-2023-20911 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-242537498
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 1, 2023 Failure to validate privileges during installation of AMD Ryzen™ Master may allow an attacker with low privileges to modify files potentially leading to privilCVE-2022-27677 · Other software · AMD · reported by psirt@amd.comHigh 7.8
Failure to validate privileges during installation of AMD Ryzen™ Master may allow an attacker with low privileges to modify files potentially leading to privilege escalation and code execution by the lower privileged user.
- Product
- Ryzen™ Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2023Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests.CVE-2023-27295 · Other software · Opencats · reported by vulnreport@tenable.comMedium 5.4
Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. An attacker can exploit this issue by creating a dummy page that executes Javascript in an authenticated user's session when visited.
- Product
- Opencats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Feb 24, 2023In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new locatioCVE-2023-26545 · Other software · Debian · reported by MITREMedium 4.7
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.kernel.orggit.kernel.org
Feb 21, 2023Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.CVE-2023-23009 · Other software · Libreswan · reported by MITREMedium 6.5
Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.
- Product
- Libreswan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Feb 16, 2023Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to potentCVE-2022-36797 · Other software · VMware · reported by secure@intel.comLow 3.3
Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Ixgben
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authenticated user to potenCVE-2022-36416 · Other software · VMware · reported by secure@intel.comMedium 4.4
Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Ixgben
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service viCVE-2022-36289 · Other software · Intel · reported by secure@intel.comLow 2.8
Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Media Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilCVE-2022-27170 · Other software · Intel · reported by secure@intel.comMedium 5.7
Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Media Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2023Protection mechanism failure in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escalation of privilege vCVE-2022-30530 · Other software · Intel · reported by secure@intel.comHigh 7.8
Protection mechanism failure in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure.CVE-2023-20924 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.8
In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. This could lead to local escalation of privilege with physical access to the device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-240428519References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 26, 2023In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20492 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242704043
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 26, 2023In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20490 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703505
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 26, 2023In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20489 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703460
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 26, 2023In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20456 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703780
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 18, 2023An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that caCVE-2022-46505 · Other software · Matrixssl · reported by MITREHigh 7.5
An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that can decrypt secret data.
- Product
- Matrixssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsmalltown123.notion.site
Jan 14, 2023Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2.CVE-2023-0302 · Other software · radareorg · reported by security@huntr.devHigh 7.8
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2.
- Product
- radareorg/radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confidential compute enviroCVE-2022-23814 · Other software · AMD · reported by psirt@amd.comMedium 5.3
Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confidential compute environment.
- Product
- 3rd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory tablCVE-2021-26346 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service.
- Product
- Ryzen 5000 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.CVE-2021-26328 · Other software · AMD · reported by psirt@amd.comMedium 4.4
Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests.
- Product
- 3rd Gen EPYC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2023Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (SCVE-2021-26316 · Other software · AMD · reported by psirt@amd.comHigh 7.8
Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution.
- Product
- Ryzen 5000 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2022NVIDIA Trusted OS contains a vulnerability in an SMC call handler, where failure to validate untrusted input may allow a highly privileged local attacker to cauCVE-2022-42269 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.9
NVIDIA Trusted OS contains a vulnerability in an SMC call handler, where failure to validate untrusted input may allow a highly privileged local attacker to cause information disclosure and compromise integrity. The scope of the impact can extend to other components.
- Product
- Jetson AGX Xavier series, Jetson Xavier NX, Jetson TX1, Jetson TX2 series, Jetson TX2 NX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Dec 27, 2022Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4721 · Other software · ikus060 · reported by security@huntr.devMedium 5.4
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2022In sysmmu_map of sysmmu.c, there is a possible EoP due to a precondition check failure.CVE-2022-20588 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In sysmmu_map of sysmmu.c, there is a possible EoP due to a precondition check failure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238785915References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20491 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703556
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20488 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703217
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20487 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703202
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20486 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703118
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20485 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242702935
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20484 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242702851
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20480 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-241764350
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20479 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-241764340
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion.CVE-2022-20478 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-241764135
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Nov 18, 2022NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a failure to properly vaCVE-2022-31606 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a failure to properly validate data might allow an attacker with basic user capabilities to cause an out-of-bounds access in kernel mode, which could lead to denial of service, information disclosure, escalation of privileges, or data tampering.
- Product
- NVIDIA Cloud Gaming (guest driver)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Nov 17, 2022The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform CVE-2022-42985 · Other software · Scratch-wiki · reported by MITREMedium 4.8
The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).
- Product
- Scratch Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2022Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege viaCVE-2022-33942 · Other software · Intel · reported by secure@intel.comHigh 8.8
Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- Data Center Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.CVE-2022-3607 · Other software · octoprint · reported by security@huntr.devMedium 6
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.
- Product
- octoprint/octoprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022Memory corruption in multimedia due to use after free during callback registration failure in Snapdragon MobileCVE-2022-25723 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption in multimedia due to use after free during callback registration failure in Snapdragon Mobile
- Product
- Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Sep 25, 2022registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstCVE-2022-41343 · Other software · Dompdf Project · reported by MITREHigh 7.5
registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.
- Product
- Dompdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local acCVE-2021-33081 · Other software · Intel · reported by secure@intel.comHigh 7.9
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.
- Product
- SSD 600p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsolidigm.comsolidigm.com
Sep 20, 2022Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local acCVE-2021-33079 · Other software · Intel · reported by secure@intel.comMedium 4.1
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.
- Product
- SSD 600p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsolidigm.comsolidigm.com
Sep 13, 2022IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag.CVE-2022-22330 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 219126.
- Product
- Control Desk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 6, 2022Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submitting a request to chCVE-2022-32277 · Other software · Squiz · reported by MITREMedium 5.3
Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submitting a request to change a user's contact details. NOTE: this is disputed by both the vendor and the original discoverer because it is a site-specific finding, not a finding about the Squiz Matrix CMS product.
- Product
- Matrix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrustwave.comtrustwave.com
Aug 27, 2022In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users tCVE-2022-38791 · Other software · Mariadb · reported by MITREMedium 5.5
In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock.
- Product
- Mariadb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjira.mariadb.orglists.fedoraproject.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.