Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,644 results · page 20 of 53
Mar 16, 2022wire-server provides back end services for Wire, an open source messenger.CVE-2022-23610 · Other software · wireapp · reported by GitHubCritical 9.1
wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft DSA Signatures to bypass SAML SSO and impersonate any Wire user with SAML credentials. In teams with SAML, but without SCIM, it was possible to create new accounts with fake SAML credentials. Under certain conditions that can be established by an attacker, an upstream library for parsing, rendering, signing, and validating SAML XML data was accepting public keys as trusted that were provided by the attacker in the signature. As a consequence, the attacker could login as any user in any Wire team with SAML SSO enabled. If SCIM was not enabled, the attacker could also create new users with new SAML NameIDs. In order to exploit this vulnerability, the attacker needs to know the SSO login code (distributed to all team members with SAML credentials and visible in the Team Management app), the SAML EntityID identifying the IdP (a URL not considered sensitive, but usually hard to guess, also visible in Team Management), and the SAML NameID of the user (usually an email address or a nick). The issue has been fixed in wire-server `20
- Product
- wire-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2022Wire-ios is a messaging application using the wire protocol on apple's ios platform.CVE-2022-23625 · Other software · wireapp · reported by GitHubMedium 6.5
Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifiers may render the iOS Wire Client completely unusable by causing it to repeatedly crash on launch. These malformed resource identifiers can be generated and sent between Wire users. The root cause lies in [wireapp/wire-ios-transport](https://github.com/wireapp/wire-ios-transport), where code responsible for removing sensible tokens before logging may fail and lead to a crash (Swift exception) of the application. This causes undesirable behavior, however the (greater) Wire system is still functional. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
- Product
- wire-ios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0.1.6 versions prior CVE-2022-21132 · Other software · pfSense · reported by vultures@jpcert.or.jpMedium 6.5
Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0.1.6 versions prior to 0.1.6_1 allows a remote authenticated attacker to lead a pfSense user to view a file outside the public folder.
- Product
- pfSense-pkg-WireGuard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2022wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger.CVE-2021-41193 · Other software · wireapp · reported by GitHubCritical 9.8
wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnerability in versions prior to 7.1.12 allows an attacker to cause a denial of service or possibly execute arbitrary code. The issue has been fixed in wire-avs 7.1.12. There are currently no known workarounds.
- Product
- wire-avs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removiCVE-2022-24610 · Other software · Alecto · reported by MITREHigh 8.6
Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal network connected to the camera.
- Product
- Dvc-215ip Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.alecto.nlsupport.alecto.nl
Feb 24, 2022A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.CVE-2020-27467 · Other software · Processwire · reported by MITREHigh 7.5
A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php.
- Product
- Processwire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Netmaker is a platform for creating and managing virtual overlay networks using WireGuard.CVE-2022-23650 · Other software · gravitl · reported by GitHubHigh 7.2
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.
- Product
- netmaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or crafted capture fileCVE-2022-0585 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 4.3
Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or crafted capture file
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comlists.debian.org
Feb 18, 2022A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload functCVE-2021-45401 · Network & remote access · Tendacn · reported by MITRECritical 9.8
A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function.
- Product
- Ac10u Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2022A cross-site scripting (XSS) vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the nCVE-2022-24227 · Other software · Boltwire · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the name and lastname parameters.
- Product
- Boltwire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture fileCVE-2022-0586 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 6.3
Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture fileCVE-2022-0583 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 6.3
Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capturCVE-2022-0582 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 6.3
Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture fileCVE-2022-0581 · Other software · Wireshark Foundation · reported by cve@gitlab.comMedium 6.3
Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbCVE-2022-0162 · Network & remote access · TP-Link · reported by vdisclose@cert-in.org.inHigh 8.4
The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbase64 format. Successful exploitation of this vulnerability could allow a remote attacker to intercept credentials and subsequently perform administrative operations on the affected device through web-based management interface.
- Product
- TL-WR841N
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-in.org.incert-in.org.in
Feb 9, 2022Improper input validation in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticaCVE-2021-33155 · Other software · Intel · reported by secure@intel.comMedium 5.7
Improper input validation in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.
- Product
- Ax211 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticaCVE-2021-33139 · Other software · Intel · reported by secure@intel.comMedium 5.7
Improper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.
- Product
- Ax211 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation for some Intel(R) PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of privilege via adjCVE-2021-33115 · Other software · Intel · reported by secure@intel.comHigh 8.8
Improper input validation for some Intel(R) PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- Uefi Wifi Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an authenticatCVE-2021-33114 · Other software · Intel · reported by secure@intel.comMedium 5.7
Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an authenticated user to potentially enable denial of service via adjacent access.
- Product
- AC 3165 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an unauthenticCVE-2021-33113 · Other software · Intel · reported by secure@intel.comHigh 8.1
Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service or information disclosure via adjacent access.
- Product
- AC 3165 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation for some Intel(R) Wireless Bluetooth(R) products and Killer(TM) Bluetooth(R) products in Windows 10 and 11 before version 22.80 may alCVE-2021-33110 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper input validation for some Intel(R) Wireless Bluetooth(R) products and Killer(TM) Bluetooth(R) products in Windows 10 and 11 before version 22.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AC 1550 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Specified Index, Position, or Offset in Input in software for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some CVE-2021-0183 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Validation of Specified Index, Position, or Offset in Input in software for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Use of Validation Framework in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user CVE-2021-0179 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Use of Validation Framework in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentiaCVE-2021-0178 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper input validation in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Consistency within input in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthentiCVE-2021-0177 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Validation of Consistency within input in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may aCVE-2021-0176 · Other software · Intel · reported by secure@intel.comMedium 4.4
Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable denial of service via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Specified Index, Position, or Offset in Input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some CVE-2021-0175 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Validation of Specified Index, Position, or Offset in Input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Use of Validation Framework in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 aCVE-2021-0174 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Use of Validation Framework in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Consistency within input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in WCVE-2021-0173 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Validation of Consistency within input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may aCVE-2021-0172 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper access control in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an authenticated user to potentially CVE-2021-0171 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper access control in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM)CVE-2021-0170 · Other software · Intel · reported by secure@intel.comMedium 5.5
Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Uncontrolled Search Path Element in software for Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalatioCVE-2021-0169 · Other software · Intel · reported by secure@intel.comMedium 6.7
Uncontrolled Search Path Element in software for Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may aCVE-2021-0168 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper access control in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enabCVE-2021-0167 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper access control in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM)CVE-2021-0166 · Other software · Intel · reported by secure@intel.comMedium 6.7
Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unCVE-2021-0165 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper access control in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauCVE-2021-0164 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper access control in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Consistency within input in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthentiCVE-2021-0163 · Other software · Intel · reported by secure@intel.comHigh 8.8
Improper Validation of Consistency within input in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentiaCVE-2021-0162 · Other software · Intel · reported by secure@intel.comHigh 8.8
Improper input validation in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow a priCVE-2021-0161 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Specified Index, Position, or Offset in Input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some CVE-2021-0076 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper Validation of Specified Index, Position, or Offset in Input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable denial of service via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may aCVE-2021-0072 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable information disclosure via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unCVE-2021-0066 · Other software · Intel · reported by secure@intel.comHigh 8.4
Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022Wire webapp is a web client for the wire messaging protocol.CVE-2022-23605 · Other software · wireapp · reported by GitHubMedium 4.4
Wire webapp is a web client for the wire messaging protocol. In versions prior to 2022-01-27-production.0 expired ephemeral messages were not reliably removed from local chat history of Wire Webapp. In versions before 2022-01-27-production.0 ephemeral messages and assets might still be accessible through the local search functionality. Any attempt to view one of these message in the chat view will then trigger the deletion. This issue only affects locally stored messages. On premise instances of wire-webapp need to be updated to 2022-01-27-production.0, so that their users are no longer affected. There are no known workarounds for this issue.
- Product
- wire-webapp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2022Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetWirelessRepeat.CVE-2022-24149 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetWirelessRepeat. This vulnerability allows attackers to cause a Denial of Service (DoS) via the wpapsk_crypto parameter.
- Product
- Ax3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2022This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link TL-WA1201 1.0.1 Build 20200709 rel.66244(5553) wirelesCVE-2021-35004 · Network & remote access · TP-Link · reported by zdi-disclosures@trendmicro.comCritical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link TL-WA1201 1.0.1 Build 20200709 rel.66244(5553) wireless access points. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14656.
- Product
- TL-WA1201
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jan 13, 2022Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute, SnaCVE-2021-30313 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 13, 2022Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdraCVE-2021-30285 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.3
Improper validation of memory region in Hypervisor can lead to incorrect region mapping in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Inf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 3, 2022Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon AutCVE-2021-30298 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Possible out of bound access due to improper validation of item size and DIAG memory pools data while switching between USB and PCIE interface in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
- Product
- Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.