Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
190 results · page 2 of 4
Dec 24, 2025In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix race in syncpt alloc/free Fix race condition between host1x_syncpt_alloc(CVE-2025-68732 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix race in syncpt alloc/free Fix race condition between host1x_syncpt_alloc() and host1x_syncpt_put() by using kref_put_mutex() instead of kref_put() + manual mutex locking. This ensures no thread can acquire the syncpt_mutex after the refcount drops to zero but before syncpt_release acquires it. This prevents races where syncpoints could be allocated while still being cleaned up from a previous release. Remove explicit mutex locking in syncpt_release as kref_put_mutex() handles this atomically.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Nov 26, 2025NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability.CVE-2025-26155 · Other software · Ncp-e · reported by MITRECritical 9.8
NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability.
- Product
- NCP Secure Entry Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest.axians.dencp-e.com
Nov 14, 2025Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier.CVE-2025-64444 · Other software · Sony Network Communications Inc. · reported by vultures@jpcert.or.jpHigh 8.6
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier. If exploited, a remote attacker who has obtained the authentication information to log in to the management page of the product may execute an arbitrary OS command with root privileges.
- Product
- NCP-HG100/Cellular model
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.sonynetwork.co.jp
Sep 24, 2025nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.CVE-2025-60020 · Other software · NNCP · reported by MITREMedium 6.4
nncp before 8.12.0 allows path traversal (for reading or writing) during freqing and file saving via a crafted path in packet data.
- Product
- NNCP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.cypherpunks.sunncpgo.org
Sep 19, 2025An issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara2CVE-2025-57528 · Network & remote access · Tenda · reported by MITREHigh 7.7
An issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara2 parameters to the formSetCfm function (uri path: SetCfm).
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2025Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script.CVE-2011-10013 · Other software · Traq Project · reported by VulnCheckCritical 10
Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality. This can be exploited via plugins.php to inject and execute arbitrary PHP code.
- Product
- Issue Tracking System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comraw.githubusercontent.com
May 16, 2025An Improper Access Control vulnerability was identified in the file download functionality.CVE-2025-2306 · Other software · SYNCPILOT · reported by a341c0d1-ebf7-493f-a84e-38cf86618674Medium 5.9
An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sensitive documents without authentication, if the URL is known. The attack requires the attacker to know the documents UUIDv4.
- Product
- LIVE CONTRACT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2025A Path traversal vulnerability in the file download functionality was identified.CVE-2025-2305 · Other software · SYNCPILOT · reported by a341c0d1-ebf7-493f-a84e-38cf86618674High 8.6
A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to download arbitrary files, in the context of the application server, from the Linux server.
- Product
- LIVE CONTRACT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash via parameter funcpaCVE-2025-28220 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda W6_S v1.0.0.4_510 has a Buffer Overflow vulnerability in the setcfm function, which allows remote attackers to cause web server crash via parameter funcpara1 passed to the binary through a POST request.
- Product
- W6-s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2025Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.CVE-2025-25678 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.
- Product
- I12 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2025Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the funcpara1 parameter in the formSetCfm function.CVE-2024-57578 · Network & remote access · Tenda · reported by MITREHigh 8.8
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the funcpara1 parameter in the formSetCfm function.
- Product
- Ac18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injection vulnerability via tCVE-2024-48441 · Other software · whtyglobal · reported by MITREHigh 8.8
Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injection vulnerability via the component at_command.asp.
- Product
- tianyu_cpe_router_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\0' termination of the path for CGI scripts because strncpy is misused.CVE-2023-46586 · Other software · weborf_project · reported by MITRECritical 9.1
cgi.c in weborf .0.17, 0.18, 0.19, and 0.20 (before 1.0) lacks '\0' termination of the path for CGI scripts because strncpy is misused.
- Product
- weborf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services.CVE-2024-42500 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.3
HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services.
- Product
- HPE HP-UX ONCplus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/goform/setcfm.CVE-2024-41465 · Network & remote access · tenda · reported by MITREHigh 7.5
Tenda FH1201 v1.2.0.14 was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/goform/setcfm.
- Product
- fh1201_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/goform/exeCommand.CVE-2024-34942 · Network & remote access · tenda · reported by MITREHigh 8.8
Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter at ip/goform/exeCommand.
- Product
- fh1206_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalm-vertebra-fe9.notion.sitepalm-vertebra-fe9.notion.site
Apr 23, 2024Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter in ip/goform/setcfm.CVE-2024-33212 · Network & remote access · tenda · reported by MITREHigh 8.8
Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter in ip/goform/setcfm.
- Product
- fh1206_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpalm-vertebra-fe9.notion.sitepalm-vertebra-fe9.notion.site
Apr 2, 2024In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.CVE-2024-28219 · Other software · fedoraproject · reported by MITREMedium 6.7
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
- Product
- fedora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Mar 29, 2024Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability located in the funcpara1 parameter in the formSetCfm function.CVE-2024-30635 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability located in the funcpara1 parameter in the formSetCfm function.
- Product
- f1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2024In strncpy of strncpy.c, there is a possible out of bounds write due to a missing bounds check.CVE-2024-27224 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.8
In strncpy of strncpy.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 24, 2024DOM-based Cross Site Scripting (XSS vulnerability in 'Tail Event Logs' functionality in Nagios Nagios Cross-Platform Agent (NCPA) before 2.4.0 allows attackers CVE-2021-43584 · Other software · Nagios · reported by MITREMedium 4.8
DOM-based Cross Site Scripting (XSS vulnerability in 'Tail Event Logs' functionality in Nagios Nagios Cross-Platform Agent (NCPA) before 2.4.0 allows attackers to run arbitrary code via the name element when filtering for a log.
- Product
- Nagios Cross Platform Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 25, 2023Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a %CVE-2023-28872 · Other software · Ncp-e · reported by MITREHigh 8.8
Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a %LOCALAPPDATA%\Temp\NcpSupport* location.
- Product
- Secure Enterprise Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Dec 9, 2023Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creating a symbolic linkCVE-2023-28871 · Other software · Ncp-e · reported by MITREMedium 4.3
Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by creating a symbolic link.
- Product
- Secure Enterprise Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Dec 9, 2023Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged CVE-2023-28870 · Other software · Ncp-e · reported by MITREMedium 6.5
Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files from low-privileged user accounts.
- Product
- Secure Enterprise Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Dec 9, 2023Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on the operating system by creating a symboCVE-2023-28869 · Other software · Ncp-e · reported by MITREMedium 6.5
Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on the operating system by creating a symbolic link.
- Product
- Secure Enterprise Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Dec 9, 2023Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link.CVE-2023-28868 · Other software · Ncp-e · reported by MITREHigh 8.1
Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creating a symbolic link.
- Product
- Secure Enterprise Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Sep 20, 2023Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admCVE-2023-42321 · Other software · Icmsdev · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admincp.php, members.admincp.php, and group.admincp.php files.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comicmsdev.com
Aug 10, 2023iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.CVE-2023-39805 · Other software · Idreamsoft · reported by MITRECritical 9.8
iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 15, 2023In PVRSRVBridgeSyncPrimOpCreate of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heaCVE-2021-0701 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In PVRSRVBridgeSyncPrimOpCreate of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 19, 2023In PVRSRVBridgeSyncPrimOpTake of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap CVE-2021-0885 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In PVRSRVBridgeSyncPrimOpTake of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-of-bounds heap access. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-270401914
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 27, 2022A vulnerability classified as problematic was found in Nagios NCPA.CVE-2021-4285 · Other software · Nagios · reported by VulDBLow 3.5
A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templates/tail.html. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to address this issue. The name of the patch is 5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5. It is recommended to upgrade the affected component. VDB-216874 is the identifier assigned to this vulnerability.
- Product
- NCPA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2022Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.CVE-2022-45665 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function.
- Product
- I22 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from ExpressionParseFunctionCCVE-2022-44314 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from ExpressionParseFunctionCall.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2022iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php.CVE-2022-41496 · Other software · Idreamsoft · reported by MITRECritical 9.8
iCMS v7.0.16 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at admincp.php.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2022In D-Link DAP1650 v1.04 firmware, the fileaccess.cgi program in the firmware has a buffer overflow vulnerability caused by strncpy.CVE-2022-36588 · Other software · Dlink · reported by MITRECritical 9.8
In D-Link DAP1650 v1.04 firmware, the fileaccess.cgi program in the firmware has a buffer overflow vulnerability caused by strncpy.
- Product
- Dap-1650 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.dlink.com
May 10, 2022Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919.CVE-2022-1621 · Other software · vim · reported by security@huntr.devHigh 7.8
Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
- Product
- vim/vim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Feb 5, 2022perM 0.4.0 has a Buffer Overflow related to strncpy.CVE-2021-38172 · Other software · Debian · reported by MITRECritical 9.8
perM 0.4.0 has a Buffer Overflow related to strncpy. (Debian initially fixed this in 0.4.0-7.)
- Product
- Perm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orglists.debian.org
Nov 12, 2021iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.CVE-2020-21141 · Other software · Idreamsoft · reported by MITREHigh 8.8
iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2021An issue was discovered in the syncpool crate before 0.1.6 for Rust.CVE-2020-36462 · Other software · Syncpool Project · reported by MITREHigh 8.1
An issue was discovered in the syncpool crate before 0.1.6 for Rust. There is an unconditional implementation of Send for Bucket2.
- Product
- Syncpool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comrustsec.org
Nov 2, 2020Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API.CVE-2020-14425 · Other software · Foxitsoftware · reported by MITREHigh 7.8
Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog.
- Product
- Foxit Reader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Sep 16, 2020com_line() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code execution.CVE-2020-25412 · Other software · Gnuplot · reported by MITRECritical 9.8
com_line() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code execution.
- Product
- Gnuplot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netsourceforge.net
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.CVE-2020-25124 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.CVE-2020-25120 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Aug 12, 2020asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, beCVE-2020-17446 · Other software · Magic · reported by MITRECritical 9.8
asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.
- Product
- Asyncpg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 28, 2020NCP Secure Enterprise Client before 10.15 r47589 allows a symbolic link attack on enumusb.reg via Support Assistant.CVE-2020-11474 · Other software · Ncp-e · reported by MITREHigh 7.8
NCP Secure Enterprise Client before 10.15 r47589 allows a symbolic link attack on enumusb.reg via Support Assistant.
- Product
- Secure Enterprise Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Oct 31, 2019A security vulnerability exists in a management port in the version of ZTE's ZXMP M721V3.10P01B10_M2NCP.CVE-2019-3419 · Other software · ZTE Corporation · reported by psirt@zte.com.cnMedium 5.7
A security vulnerability exists in a management port in the version of ZTE's ZXMP M721V3.10P01B10_M2NCP. An attacker could exploit this vulnerability to build a link to the device and send specific packets to cause a denial of service.
- Product
- ZXMP M721 DX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zte.com.cnsupport.zte.com.cn
Oct 14, 2019idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the admincpCVE-2019-17583 · Other software · Idreamsoft · reported by MITREHigh 7.5
idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many comments, as demonstrated by the admincp.php?app=comment&perpage= substring followed by a large positive integer.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2019The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().CVE-2018-16228 · Other software · Tcpdump · reported by MITREHigh 7.5
The HNCP parser in tcpdump before 4.9.3 has a buffer over-read in print-hncp.c:print_prefix().
- Product
- Tcpdump
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Aug 12, 2019iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter.CVE-2019-14976 · Other software · Icmsdev · reported by MITREMedium 6.1
iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 4, 2019ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.CVE-2019-13305 · Other software · Imagemagick · reported by MITREHigh 7.8
ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.