Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
73 results · page 2 of 2
Mar 13, 2023The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video.CVE-2023-0349 · Other software · Akuvox · reported by ics-cert@hq.dhs.govHigh 7.5
The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video. This could allow an attacker to view and record image and video from the camera.
- Product
- E11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023Akuvox E11 allows direct SIP calls.CVE-2023-0348 · Other software · Akuvox · reported by ics-cert@hq.dhs.govHigh 7.5
Akuvox E11 allows direct SIP calls. No access control is enforced by the SIP servers, which could allow an attacker to contact any device within Akuvox to call any other device.
- Product
- E11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023The Akuvox E11 Media Access Control (MAC) address, a primary identifier, combined with the Akuvox E11 IP address, could allow an attacker to identify the deviceCVE-2023-0347 · Other software · Akuvox · reported by ics-cert@hq.dhs.govHigh 7.5
The Akuvox E11 Media Access Control (MAC) address, a primary identifier, combined with the Akuvox E11 IP address, could allow an attacker to identify the device on the Akuvox cloud.
- Product
- E11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023Akuvox E11 cloud login is performed through an unencrypted HTTP connection.CVE-2023-0346 · Other software · Akuvox · reported by ics-cert@hq.dhs.govHigh 7.5
Akuvox E11 cloud login is performed through an unencrypted HTTP connection. An attacker could gain access to the Akuvox cloud and device if the MAC address of a device if known.
- Product
- E11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023The Akuvox E11 secure shell (SSH) server is enabled by default and can be accessed by the root user.CVE-2023-0345 · Other software · Akuvox · reported by ics-cert@hq.dhs.govCritical 9.8
The Akuvox E11 secure shell (SSH) server is enabled by default and can be accessed by the root user. This password cannot be changed by the user.
- Product
- E11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2023Akuvox E11 uses a hard-coded cryptographic key, which could allow an attacker to decrypt sensitive information.CVE-2023-0355 · Other software · Akuvok · reported by ics-cert@hq.dhs.govMedium 6.5
Akuvox E11 uses a hard-coded cryptographic key, which could allow an attacker to decrypt sensitive information.
- Product
- E11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2021National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability.CVE-2021-44556 · Other software · KB · reported by MITRECritical 9.1
National Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected by a XML External Entity (XXE) vulnerability. Since XML parsing resolves external entities, a malicious XML stream could leak internal files and/or cause a DoS.
- Product
- Digger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 11, 2021ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can reCVE-2021-37910 · Network & remote access · ASUS · reported by twcert@cert.org.twLow 3.7
ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames.
- Product
- GT-AXE11000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 28, 2021There is a server-side request forgery vulnerability in HUAWEI P40 versions 10.1.0.118(C00E116R3P3).CVE-2021-37104 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a server-side request forgery vulnerability in HUAWEI P40 versions 10.1.0.118(C00E116R3P3). This vulnerability is due to insufficient validation of parameters while dealing with some messages. A successful exploit could allow the attacker to gain access to certain resource which the attacker are supposed not to do.
- Product
- P40 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2020HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02), versions earlier than 10.1.0.126(C10E11R5P1), and versions earlier than 10CVE-2020-9257 · Other software · Huawei · reported by psirt@huawei.comHigh 8.8
HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02), versions earlier than 10.1.0.126(C10E11R5P1), and versions earlier than 10.1.0.160(C00E160R2P8) have a buffer overflow vulnerability. The software access data past the end, or before the beginning, of the intended buffer when handling certain operations of certificate, the attacker should trick the user into installing a malicious application, successful exploit may cause code execution.
- Product
- HUAWEI P30 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2020HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02), versions earlier than 10.1.0.126(C10E11R5P1), and versions earlier than 10CVE-2020-9254 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02), versions earlier than 10.1.0.126(C10E11R5P1), and versions earlier than 10.1.0.160(C00E160R2P8) have a logic check error vulnerability. A logic error occurs when the software checking the size of certain parameter, the attacker should trick the user into installing a malicious application, successful exploit may cause code execution.
- Product
- HUAWEI P30 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2020Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and traceroute diagnostiCVE-2020-10173 · Other software · Comtrend · reported by MITREHigh 8.8
Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and traceroute diagnostic pages, as demonstrated by shell metacharacters in the pingIpAddress parameter to ping.cgi.
- Product
- Vr-3033 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Nov 12, 2019Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), 9.1.0.153(C00E150R1PCVE-2019-5246 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0.135(C00E130R1P21), 9.1.0.153(C00E150R1P21), 9.1.0.155(C00E150R1P21), 9.1.0.162(C00E160R2P1) have an insufficient verification vulnerability. The system does not verify certain parameters sufficiently, an attacker should connect to the phone and gain high privilege to launch the attack. Successful exploit could cause DOS or malicious code execution.
- Product
- Elle-al00b Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2019There is a DoS vulnerability in RTSP module of Leland-AL00A Huawei smart phones versions earlier than Leland-AL00A 9.1.0.111(C00E111R2P10T8).CVE-2019-5284 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
There is a DoS vulnerability in RTSP module of Leland-AL00A Huawei smart phones versions earlier than Leland-AL00A 9.1.0.111(C00E111R2P10T8). Remote attackers could trick the user into opening a malformed RTSP media stream to exploit this vulnerability. Successful exploit could cause the affected phone abnormal, leading to a DoS condition. (Vulnerability ID: HWPSIRT-2019-02004)
- Product
- Leland-AL00A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2018In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11CVE-2017-14803 · Other software · Micro Focus · reported by security@opentext.comCritical 9.8
In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system.
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2015Buffer overflow in the rx::TextureStorage11 class in ANGLE, as used in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, allows remote attackers to CVE-2015-7198 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
Buffer overflow in the rx::TextureStorage11 class in ANGLE, as used in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted texture data.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Oct 15, 2015The Image11::map function in renderer/d3d/d3d11/Image11.cpp in libANGLE, as used in Google Chrome before 46.0.2490.71, mishandles mapping failures after device-CVE-2015-6760 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
The Image11::map function in renderer/d3d/d3d11/Image11.cpp in libANGLE, as used in Google Chrome before 46.0.2490.71, mishandles mapping failures after device-lost events, which allows remote attackers to cause a denial of service (invalid read or write) or possibly have unspecified other impact via vectors involving a removed device.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglechromereleases.blogspot.comrhn.redhat.com
Sep 25, 2013Stack-based buffer overflow in the sub_E110 function in init in a certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless allCVE-2013-5933 · Computers, phones & browsers · Google · reported by MITREMedium 6.9
Stack-based buffer overflow in the sub_E110 function in init in a certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless allows local users to gain privileges or cause a denial of service (memory corruption) by writing a long string to the /dev/socket/init_runit socket that is inconsistent with a certain length value that was previously written to this socket.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwitter.complus.google.com
Mar 6, 2013The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP SerCVE-2013-1048 · Other software · Debian · reported by security@ubuntu.comMedium 4.6
The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.
- Product
- Apache2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.debian.orgdebian.org
Jul 5, 2009The YaST2 LDAP module in yast2-ldap-server on SUSE Linux Enterprise Server 11 (aka SLE11) does not enable the firewall in certain circumstances involving rebootCVE-2009-1648 · Other software · Suse · reported by MITREHigh 7.5
The YaST2 LDAP module in yast2-ldap-server on SUSE Linux Enterprise Server 11 (aka SLE11) does not enable the firewall in certain circumstances involving reboots during online updates, which makes it easier for remote attackers to access network services.
- Product
- Suse Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgsecunia.com
Oct 20, 2005The rfc1738_do_escape function in ftp.c for Squid 2.5 STABLE11 and earlier allows remote FTP servers to cause a denial of service (segmentation fault) via certaCVE-2005-3258 · Other software · Squid · reported by Red HatMedium 5
The rfc1738_do_escape function in ftp.c for Squid 2.5 STABLE11 and earlier allows remote FTP servers to cause a denial of service (segmentation fault) via certain "odd" responses.
- Product
- Squid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Dec 31, 2004Race condition in IMWheel 1.0.0pre11 and earlier, when running with the -k option, allows local users to cause a denial of service (IMWheel crash) and possibly CVE-2004-2698 · Other software · Imwheel · reported by MITREMedium 6.9
Race condition in IMWheel 1.0.0pre11 and earlier, when running with the -k option, allows local users to cause a denial of service (IMWheel crash) and possibly modify arbitrary files via a symlink attack on the imwheel.pid file.
- Product
- Imwheel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comimwheel.sourceforge.net
Oct 18, 2001Buffer overflow in Linux xinetd 2.1.8.9pre11-1 and earlier may allow remote attackers to execute arbitrary code via a long ident response, which is not properlyCVE-2001-0763 · Other software · Debian · reported by MITREHigh 7.5
Buffer overflow in Linux xinetd 2.1.8.9pre11-1 and earlier may allow remote attackers to execute arbitrary code via a long ident response, which is not properly handled by the svc_logprint function.
- Product
- Debian Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comdistro.conectiva.com.br
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.