Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

457new WordPress flaws this week

390,714entries in the database

153 results · page 2 of 4

Oct 6, 2024In vdec, there is a possible out of bounds write due to a missing bounds check.CVE-2024-20090 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09028313; Issue ID: MSV-1703.
Product
MT6761, MT6765, MT6768, MT6779, MT6785, MT6853, MT6873, MT6885, MT8385, MT8666, MT8667, MT8766, MT8768, MT8781, MT8788, MT8789
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record corp.mediatek.com
Sep 2, 2024In vdec, there is a possible out of bounds write due to a missing bounds check.CVE-2024-20087 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08932916; Issue ID: MSV-1550.
Product
MT6765, MT6768, MT6779, MT6785, MT8385, MT8666, MT8667, MT8766, MT8768, MT8781, MT8788, MT8789
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record corp.mediatek.com
Sep 2, 2024In vdec, there is a possible out of bounds write due to a missing bounds check.CVE-2024-20086 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08932916; Issue ID: MSV-1551.
Product
MT6765, MT6768, MT6779, MT6785, MT8385, MT8666, MT8667, MT8766, MT8768, MT8781, MT8788, MT8789
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record corp.mediatek.com
Aug 17, 2024In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free in vdec_close There appears to be a possible use after frCVE-2024-42313 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free in vdec_close There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst. Fix it by cancelling the work in vdec_close.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Aug 6, 2024Out-of-bound write in libcodec2secmp4vdec.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code.CVE-2024-34612 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.3
Out-of-bound write in libcodec2secmp4vdec.so prior to SMR Aug-2024 Release 1 allows local attackers to execute arbitrary code.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com
Jun 10, 2024An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45176 · Other software · liveboxcloud · reported by MITREMedium 5.4
An issue was discovered in LIVEBOX Collaboration vDesk through v018. Stored Cross-site Scripting (XSS) can occur under the /api/v1/getbodyfile endpoint via the uri parameter. The web application (through its vShare functionality section) doesn't properly check parameters, sent in HTTP requests as input, before saving them on the server. In addition, crafted JavaScript content can then be reflected back to the end user and executed by the web browser.
Product
vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
Jun 10, 2024An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45168 · Other software · Liveboxcloud · reported by MITREMedium 6.5
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/createbackupcodes endpoint, because the application allows a user to generate or regenerate the backup codes before checking the TOTP.
Product
Vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
May 28, 2024An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45171 · Other software · liveboxcloud · reported by MITREHigh 8.8
An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous Type can occur under the vShare web site section. A remote user, authenticated to the product, can arbitrarily upload potentially dangerous files without restrictions.
Product
vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
May 2, 2024Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-34273 · Other software · Fatek Automation · reported by zdi-disclosures@trendmicro.comHigh 7.8
Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18183.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 2, 2024Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability.CVE-2023-34272 · Other software · Fatek Automation · reported by zdi-disclosures@trendmicro.comHigh 7.8
Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18182.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 2, 2024Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-34271 · Other software · Fatek Automation · reported by zdi-disclosures@trendmicro.comHigh 7.8
Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18178.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 2, 2024Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-34270 · Other software · Fatek Automation · reported by zdi-disclosures@trendmicro.comHigh 7.8
Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18176.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 2, 2024Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-34269 · Other software · Fatek Automation · reported by zdi-disclosures@trendmicro.comHigh 7.8
Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18173.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 2, 2024Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-34268 · Other software · Fatek Automation · reported by zdi-disclosures@trendmicro.comHigh 7.8
Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18172.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 2, 2024Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-34267 · Other software · Fatek Automation · reported by zdi-disclosures@trendmicro.comHigh 7.8
Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18170.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 2, 2024Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-34266 · Other software · Fatek Automation · reported by zdi-disclosures@trendmicro.comHigh 7.8
Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18168.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 2, 2024Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-34265 · Other software · Fatek Automation · reported by zdi-disclosures@trendmicro.comHigh 7.8
Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18166.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 2, 2024Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-34264 · Other software · Fatek Automation · reported by zdi-disclosures@trendmicro.comHigh 7.8
Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18164.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 2, 2024Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability.CVE-2023-34263 · Other software · Fatek Automation · reported by zdi-disclosures@trendmicro.comHigh 7.8
Fatek Automation FvDesigner FPJ File Parsing Uninitialized Pointer Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18162.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
May 2, 2024Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.CVE-2023-34262 · Other software · Fatek Automation · reported by zdi-disclosures@trendmicro.comHigh 7.8
Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FPJ files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18161.
Product
FvDesigner
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zerodayinitiative.com zerodayinitiative.com
Apr 25, 2024Unauthenticated file upload allows remote code execution.CVE-2024-0916 · Other software · Webkul Software · reported by 41c37e40-543d-43a2-b660-2fee83ea851aCritical 10
Unauthenticated file upload allows remote code execution. This issue affects UvDesk Community: from 1.0.0 through 1.1.3.
Product
UvDesk Community
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com pentraze.com
Apr 1, 2024Improper Privilege Management in uvdesk/community-skeletonCVE-2024-3137 · Other software · uvdesk · reported by security@huntr.devHigh 7.1
Improper Privilege Management in uvdesk/community-skeleton
Product
uvdesk/community-skeleton
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huntr.com huntr.com
Mar 6, 2024In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trustCVE-2024-28152 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 6.3
In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests from forks, the trust policy "Forks in the same account" allows changes to Jenkinsfiles from users without write access to the project when using Bitbucket Server.
Product
Jenkins Bitbucket Branch Source Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Mar 3, 2024In vdec, there is a possible permission bypass due to a permissions bypass.CVE-2024-20036 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.4
In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08509508; Issue ID: ALPS08509508.
Product
MT6835, MT6855, MT6879, MT6886, MT6895, MT6983, MT6985, MT8792, MT8796, MT8798
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record corp.mediatek.com corp.mediatek.com
Feb 21, 2024An issue was discovered in LIVEBOX Collaboration vDesk through v031.CVE-2022-45179 · Other software · Liveboxcloud · reported by MITREMedium 5.4
An issue was discovered in LIVEBOX Collaboration vDesk through v031. A basic XSS vulnerability exists under the /api/v1/vdeskintegration/todo/createorupdate endpoint via the title parameter and /dashboard/reminders. A remote user (authenticated to the product) can store arbitrary HTML code in the reminder section title in order to corrupt the web page (for example, by creating phishing sections to exfiltrate victims' credentials).
Product
Vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
Feb 21, 2024An issue was discovered in LIVEBOX Collaboration vDesk through v031.CVE-2022-45177 · Other software · liveboxcloud · reported by MITREHigh 7.5
An issue was discovered in LIVEBOX Collaboration vDesk through v031. An Observable Response Discrepancy can occur under the /api/v1/vdeskintegration/user/isenableuser endpoint, the /api/v1/sharedsearch?search={NAME]+{SURNAME] endpoint, and the /login endpoint. The web application provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
Product
vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
Feb 21, 2024An issue was discovered in LIVEBOX Collaboration vDesk through v031.CVE-2022-45169 · Other software · Liveboxcloud · reported by MITREMedium 5.4
An issue was discovered in LIVEBOX Collaboration vDesk through v031. A URL Redirection to an Untrusted Site (Open Redirect) can occur under the /api/v1/notification/createnotification endpoint, allowing an authenticated user to send an arbitrary push notification to any other user of the system. This push notification can include an (invisible) clickable link.
Product
Vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
Dec 4, 2023Transient DOS when processing a NULL buffer while parsing WLAN vdev.CVE-2023-33089 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS when processing a NULL buffer while parsing WLAN vdev.
Product
Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Dec 4, 2023Memory corruption when processing cmd parameters while parsing vdev.CVE-2023-33088 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption when processing cmd parameters while parsing vdev.
Product
Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Dec 3, 2023In vdec, there is a possible out of bounds write due to type confusion.CVE-2023-32848 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08163896; Issue ID: ALPS08163896.
Product
MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6785, MT6853, MT6873, MT6885
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record corp.mediatek.com corp.mediatek.com
Nov 5, 2023In vdec, there is a possible out of bounds write due to type confusion.CVE-2023-32818 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08163896 & ALPS08013430; Issue ID: ALPS07867715.
Product
MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT6785, MT6853, MT6873, MT6885
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record corp.mediatek.com corp.mediatek.com
Oct 23, 2023A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted paCVE-2023-37636 · Other software · Webkul · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket.
Product
Uvdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record esecforte.com esecforte.com
Oct 23, 2023UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.CVE-2023-37635 · Other software · Uvdesk · reported by MITRECritical 9.8
UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the application.
Product
Community-skeleton
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record esecforte.com esecforte.com
Aug 7, 2023In vdec, there is a possible out of bounds write due to a missing bounds check.CVE-2023-20809 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03751198; Issue ID: DTV03751198.
Product
MT5583, MT5691, MT5695, MT9010, MT9011, MT9012, MT9016, MT9020, MT9021, MT9022, MT9030, MT9031, MT9032, MT9215, MT9216, MT9218, MT9220, MT9221, MT9222, MT9255,
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record corp.mediatek.com corp.mediatek.com
Aug 1, 2023An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.CVE-2023-39147 · Other software · Webkul · reported by MITREHigh 7.8
An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.
Product
Uvdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com docs.google.com
Aug 1, 2023A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript.CVE-2023-38559 · Other software · Red Hat · reported by Red HatMedium 5.5
A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs.
Product
Red Hat Enterprise Linux 8
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Jul 6, 2023Use After Free (UAF) vulnerability in the Vdecoderservice service.CVE-2022-48512 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Use After Free (UAF) vulnerability in the Vdecoderservice service. Successful exploitation of this vulnerability may cause the image decoding feature to perform abnormally.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Apr 14, 2023An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45180 · Other software · Liveboxcloud · reported by MITREMedium 6.5
An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdesk_{DOMAIN]/export endpoint. A malicious user, authenticated to the product without any specific privilege, can use the API for exporting information about all users of the system (an operation intended to only be available to the system administrator).
Product
Vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
Apr 14, 2023An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45178 · Other software · Liveboxcloud · reported by MITREHigh 8.8
An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskintegration/saml/user/createorupdate endpoint, the /settings/guest-settings endpoint, the /settings/samlusers-settings endpoint, and the /settings/users-settings endpoint. A malicious user (already logged in as a SAML User) is able to achieve privilege escalation from a low-privilege user (FGM user) to an administrative user (GGU user), including the administrator, or create new users even without an admin role.
Product
Vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
Apr 14, 2023An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45175 · Other software · Liveboxcloud · reported by MITREMedium 6.5
An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference can occur under the 5.6.5-3/doc/{ID-FILE]/c/{N]/{C]/websocket endpoint. A malicious unauthenticated user can access cached files in the OnlyOffice backend of other users by guessing the file ID of a target file.
Product
Vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
Apr 14, 2023An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45174 · Other software · Liveboxcloud · reported by MITRECritical 9.8
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Users can occur under the /login/backup_code endpoint and the /api/v1/vdeskintegration/challenge endpoint. The correctness of the TOTP is not checked properly, and can be bypassed by passing any string as the backup code.
Product
Vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
Apr 14, 2023An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45173 · Other software · Liveboxcloud · reported by MITRECritical 9.8
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /api/v1/vdeskintegration/challenge endpoint. Because only the client-side verifies whether a check was successful, an attacker can modify the response, and fool the application into concluding that the TOTP was correct.
Product
Vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
Apr 14, 2023An issue was discovered in LIVEBOX Collaboration vDesk through v018.CVE-2022-45170 · Other software · Liveboxcloud · reported by MITREMedium 6.5
An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malicious user, logged into a victim's account, is able to decipher a file without knowing the key set by the user.
Product
Vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
Apr 6, 2023In vdec, there is a possible use after free due to a race condition.CVE-2023-20685 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.4
In vdec, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07608575; Issue ID: ALPS07608575.
Product
MT6789, MT6855, MT6879, MT6895, MT6983, MT8673, MT8781, MT8795T, MT8798, MT8891
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record corp.mediatek.com corp.mediatek.com
Apr 6, 2023In vdec, there is a possible use after free due to a race condition.CVE-2023-20684 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.4
In vdec, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07671069; Issue ID: ALPS07671069.
Product
MT6789, MT6855, MT6879, MT6895, MT6983, MT8673, MT8781, MT8795T, MT8798, MT8891
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record corp.mediatek.com corp.mediatek.com
Apr 4, 2023Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application.CVE-2023-0325 · Other software · Uvdesk · reported by help@fluidattacks.comMedium 6.1
Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket.
Product
Community-skeleton
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com github.com
Apr 4, 2023Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server.CVE-2023-0265 · Other software · Uvdesk · reported by help@fluidattacks.comHigh 8.8
Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.
Product
Community-skeleton
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fluidattacks.com github.com
Mar 6, 2023Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.CVE-2023-1197 · Other software · uvdesk · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.
Product
uvdesk/community-skeleton
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Jan 31, 2023An issue was discovered in LIVEBOX Collaboration vDesk before v018.CVE-2022-45172 · Other software · Liveboxcloud · reported by MITRECritical 9.8
An issue was discovered in LIVEBOX Collaboration vDesk before v018. Broken Access Control can occur under the /api/v1/registration/validateEmail endpoint, the /api/v1/vdeskintegration/user/adduser endpoint, and the /api/v1/registration/changePasswordUser endpoint. The web application is affected by flaws in authorization logic, through which a malicious user (with no privileges) is able to perform privilege escalation to the administrator role, and steal the accounts of any users on the system.
Product
Vdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gruppotim.it gruppotim.it
Oct 7, 2022In vdec fmt, there is a possible use after free due to improper locking.CVE-2022-26473 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In vdec fmt, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07342197; Issue ID: ALPS07342197.
Product
MT6789, MT6855, MT6879, MT6895, MT6983, MT8168, MT8365, MT8695, MT8696, MT8798
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record corp.mediatek.com corp.mediatek.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.