Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
58 results · page 2 of 2
Jun 15, 2022In multiple locations of the nanopb library, there is a possible way to corrupt memory when decoding untrusted protobuf files.CVE-2022-20203 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple locations of the nanopb library, there is a possible way to corrupt memory when decoding untrusted protobuf files. This could lead to local escalation of privilege,with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
May 27, 2022The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.CVE-2022-25878 · Other software · Protobufjs Project · reported by report@snyk.ioHigh 8.2
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
- Product
- Protobufjs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022Nullptr dereference when a null char is present in a proto symbol.CVE-2021-22570 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comMedium 6.5
Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
- Product
- Protobuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jan 10, 2022An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order.CVE-2021-22569 · Computers, phones & browsers · Google LLC · reported by cve-coordination@google.comHigh 7.5
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
- Product
- protobuf-java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jan 11, 2021An issue was discovered in GoGo Protobuf before 1.3.2.CVE-2021-3121 · Other software · Golang · reported by MITREHigh 8.6
An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.
- Product
- Protobuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comgithub.com
Aug 26, 2019An issue was discovered in the protobuf crate before 2.6.0 for Rust.CVE-2019-15544 · Other software · Rust-protobuf Project · reported by MITREHigh 7.5
An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.
- Product
- Rust-protobuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jun 6, 2018protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.CVE-2018-3738 · Other software · HackerOne · reported by support@hackerone.comMedium 5.5
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
- Product
- protobufjs node module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 25, 2017protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.CVE-2015-5237 · Computers, phones & browsers · Google · reported by Red HatHigh 8.8
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
- Product
- Protobuf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.