Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,078 results · page 21 of 42
Jul 30, 2020The ABUS Secvest FUMO50110 hybrid module does not have any security mechanism that ensures confidentiality or integrity of RF packets that are exchanged with anCVE-2020-14158 · Other software · Abus · reported by MITRECritical 9.1
The ABUS Secvest FUMO50110 hybrid module does not have any security mechanism that ensures confidentiality or integrity of RF packets that are exchanged with an alarm panel. This makes it easier to conduct wAppLoxx authentication-bypass attacks.
- Product
- Secvest Hybrid Fumo50110 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 28, 2020Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble.CVE-2020-15899 · Other software · Grin · reported by MITREHigh 7.5
Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble.
- Product
- Grin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2020This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 V1.0.4.84_CVE-2020-10925 · Network & remote access · NETGEAR · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9647.
- Product
- R6700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Jul 24, 2020In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries.CVE-2020-10608 · Other software · Osisoft · reported by ics-cert@hq.dhs.govHigh 7.8
In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. This exploitation can target another local user of PI System software on the computer to escalate privilege and result in unauthorized information disclosure, deletion, or modification.
- Product
- PI API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jul 16, 2020A vulnerability in the web-based management interface for Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to impact the integrity ofCVE-2020-3378 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the web-based management interface for Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input that includes SQL statements to an affected system. A successful exploit could allow the attacker to modify entries in some database tables, affecting the integrity of the data.
- Product
- Cisco SD-WAN vManage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Jul 14, 2020Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check.CVE-2020-13847 · Other software · Sylabs · reported by MITREHigh 7.5
Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file.
- Product
- Singularity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jul 14, 2020Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value.CVE-2020-13845 · Other software · Sylabs · reported by MITREHigh 7.5
Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.
- Product
- Singularity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jun 24, 2020NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the service host component, in which the application resources integrity check may CVE-2020-5964 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.8
NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the service host component, in which the application resources integrity check may be missed. Such an attack may lead to code execution, denial of service or information disclosure.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Jun 19, 2020A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker tCVE-2020-8184 · Other software · Rack Project · reported by support@hackerone.comHigh 7.5
A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.
- Product
- Rack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comhackerone.com
Jun 18, 2020HUAWEI P30 and HUAWEI P30 Pro with versions earlier than 10.1.0.135(C00E135R2P11) and versions earlier than 10.1.0.135(C00E135R2P8) have an insufficient integriCVE-2020-1834 · Other software · Huawei · reported by psirt@huawei.comMedium 4.6
HUAWEI P30 and HUAWEI P30 Pro with versions earlier than 10.1.0.135(C00E135R2P11) and versions earlier than 10.1.0.135(C00E135R2P8) have an insufficient integrity check vulnerability. The system does not check certain software package's integrity sufficiently. Successful exploit could allow an attacker to load a crafted software package to the device.
- Product
- P30 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2020A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to injeCVE-2020-7505 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.2
A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to inject data with dangerous content into the firmware and execute arbitrary code on the system.
- Product
- Easergy T300 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2020An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software.CVE-2020-13835 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The Gatekeeper Trustlet allows a brute-force attack on user credentials. The Samsung ID is SVE-2020-16908 (June 2020).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 4, 2020An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (with TEEGRIS) software.CVE-2020-13834 · Computers, phones & browsers · Google · reported by MITREHigh 7.5
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (with TEEGRIS) software. Secure Folder does not properly restrict use of Android Debug Bridge (adb) for arbitrary installations. The Samsung ID is SVE-2020-17369 (June 2020).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 4, 2020An issue was discovered on Samsung mobile devices with Q(10.0) (with TEEGRIS on Exynos chipsets) software.CVE-2020-13832 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with Q(10.0) (with TEEGRIS on Exynos chipsets) software. The Widevine Trustlet allows arbitrary code execution because of memory disclosure, The Samsung IDs are SVE-2020-17117, SVE-2020-17118, SVE-2020-17119, and SVE-2020-17161 (June 2020).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jun 2, 2020GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05.CVE-2020-12017 · Other software · GE · reported by ics-cert@hq.dhs.govCritical 9.8
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system.
- Product
- Rt430 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
May 21, 2020In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments CVE-2020-7808 · Other software · RAONWIZ Inc · reported by vuln@krcert.or.krHigh 8.7
In RAONWIZ K Upload v2018.0.2.51 and prior, automatic update processing without integrity check on update module(web.js) allows an attacker to modify arguments which causes downloading a random DLL and injection on it.
- Product
- K Upload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2020A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integriCVE-2020-1994 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 4.1
A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbitrary system files affecting the integrity of the system. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.7.
- Product
- PAN-OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
May 11, 2020An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software.CVE-2020-12752 · Computers, phones & browsers · Google · reported by MITREHigh 7.5
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. Attackers can determine user credentials via a brute-force attack against the Gatekeeper trustlet. The Samsung ID is SVE-2020-16908 (May 2020).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
May 5, 2020Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.CVE-2020-12439 · Other software · Grin · reported by MITREMedium 5.3
Grin before 3.1.0 allows attackers to adversely affect availability of data on a Mimblewimble blockchain.
- Product
- Grin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2020SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an attacker under certain conditions to modify tCVE-2020-6228 · Network & remote access · SAP SE · reported by cna@sap.comHigh 7.5
SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an attacker under certain conditions to modify the installer.
- Product
- SAP Business Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Apr 13, 2020Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the applicatioCVE-2019-1866 · Network & remote access · Cisco · reported by psirt@cisco.comLow 3.1
Cisco Webex Business Suite before 39.1.0 contains a vulnerability that could allow an unauthenticated, remote attacker to affect the integrity of the application. The vulnerability is due to improper validation of host header values. An attacker with a privileged network position, either a man-in-the-middle or by intercepting wireless network traffic, could exploit this vulnerability to manipulate header values sent by a client to the affected application. The attacker could cause the application to use input from the header to redirect a user from the Cisco Webex Meetings Online site to an arbitrary site of the attacker's choosing.
- Product
- Cisco Webex Business Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordquickview.cloudapps.cisco.comquickview.cloudapps.cisco.com
Apr 10, 2020There is an insufficient integrity validation vulnerability in several products.CVE-2020-1802 · Other software · Huawei · reported by psirt@huawei.comMedium 4.6
There is an insufficient integrity validation vulnerability in several products. The device does not sufficiently validate the integrity of certain file in certain loading processes, successful exploit could allow the attacker to load a crafted file to the device through USB.Affected product versions include:OSCA-550 versions 1.0.1.23(SP2);OSCA-550A versions 1.0.1.23(SP2);OSCA-550AX versions 1.0.1.23(SP2);OSCA-550X versions 1.0.1.23(SP2).
- Product
- Osca-550 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2020An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (incorporating TEEGRIS) software.CVE-2020-11604 · Computers, phones & browsers · Google · reported by MITRECritical 9.1
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (incorporating TEEGRIS) software. There is an Out-of-bounds read in the MLDAP Trustlet. The Samsung ID is SVE-2019-16565 (April 2020).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Apr 8, 2020An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (incorporating TEEGRIS) software.CVE-2020-11603 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (incorporating TEEGRIS) software. Type confusion in the MLDAP Trustlet allows arbitrary code execution. The Samsung ID is SVE-2020-16599 (April 2020).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comtuttoandroid.net
Mar 25, 2020Adobe Genuine Integrity Service versions Version 6.4 and earlier have an insecure file permissions vulnerability.CVE-2020-3766 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Genuine Integrity Service versions Version 6.4 and earlier have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.
- Product
- Adobe Genuine Integrity Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comzerodayinitiative.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software.CVE-2019-20589 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the SKPM Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14892 (August 2019).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software.CVE-2019-20588 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the SEM Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14891 (August 2019).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (with TEEGRIS) software.CVE-2019-20587 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (with TEEGRIS) software. There is type confusion in the MLDAP Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14867 (August 2019).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (with TEEGRIS) software.CVE-2019-20586 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (with TEEGRIS) software. There is type confusion in the FINGERPRINT Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14864 (August 2019).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software.CVE-2019-20585 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the SEC_FR Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14851 (August 2019).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software.CVE-2019-20584 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the HDCP Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14850 (August 2019).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software.CVE-2019-20583 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the EXT_FR Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14847 (August 2019).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software.CVE-2019-20571 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. There is type confusion in the WVDRM Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14885 (September 2019).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software.CVE-2019-20563 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. The SEC_FR trustlet has an out of bounds write. The Samsung ID is SVE-2019-15272 (October 2019).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with P(9.0) (with TEEGRIS) software.CVE-2019-20562 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with P(9.0) (with TEEGRIS) software. There is a buffer overflow in the BIOSUB Trustlet. The Samsung ID is SVE-2019-15264 (October 2019).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software.CVE-2019-20560 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. The BIOSUB Trustlet has an out of bounds write. The Samsung ID is SVE-2019-15261 (October 2019).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software.CVE-2020-10837 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. The Esecomm Trustlet allows a stack overflow and arbitrary code execution. The Samsung ID is SVE-2019-15984 (February 2020).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 24, 2020An issue was discovered on Samsung mobile devices with P(9.0) (TEEGRIS and Qualcomm chipsets).CVE-2019-20537 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
An issue was discovered on Samsung mobile devices with P(9.0) (TEEGRIS and Qualcomm chipsets). There is arbitrary memory overwrite in the SEM Trustlet, leading to arbitrary code execution. The Samsung IDs are SVE-2019-14651, SVE-2019-14666 (November 2019).
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 20, 2020There is an improper integrity checking vulnerability on some huawei products.CVE-2020-1879 · Other software · Huawei · reported by psirt@huawei.comLow 3.9
There is an improper integrity checking vulnerability on some huawei products. The software of the affected product has an improper integrity check which may allow an attacker with high privilege to make malicious modifications.Affected product versions include:HEGE-560 versions 1.0.1.21(SP3);HEGE-570 versions 1.0.1.22(SP3);OSCA-550 versions 1.0.1.21(SP3);OSCA-550A versions 1.0.1.21(SP3);OSCA-550AX versions 1.0.1.21(SP3);OSCA-550X versions 1.0.1.21(SP3).
- Product
- Hege-560 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2020The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache.CVE-2019-15608 · Other software · Yarnpkg · reported by support@hackerone.comMedium 5.9
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.
- Product
- Yarn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2020StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability which allows an unautCVE-2020-8571 · Other software · NetApp · reported by security-alert@netapp.comHigh 7.5
StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible to a vulnerability which allows an unauthenticated remote attacker to cause a Denial of Service (DoS).
- Product
- StorageGRID (formerly StorageGRID Webscale)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Feb 19, 2020IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code which couCVE-2019-4640 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code which could result in an attacker executing malicious code. IBM X-Force ID: 170046.
- Product
- Security Secret Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 7, 2020The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-integrity level proceCVE-2020-8808 · Other software · Corsair · reported by MITREHigh 7.8
The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-integrity level processes) to read and write to arbitrary physical memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, via a function call such as MmMapIoSpace.
- Product
- Icue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.corsair.comgithub.com
Jan 26, 2020A vulnerability in the web interface for Cisco SD-WAN Solution vManage could allow an authenticated, remote attacker to impact the integrity of an affected systCVE-2019-12619 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the web interface for Cisco SD-WAN Solution vManage could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input that includes SQL statements to an affected system. A successful exploit could allow the attacker to modify entries in some database tables, affecting the integrity of the data.
- Product
- Cisco SD-WAN Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Jan 21, 2020Grin through 2.1.1 has Insufficient Validation.CVE-2020-6638 · Other software · Grin · reported by MITREHigh 7.5
Grin through 2.1.1 has Insufficient Validation.
- Product
- Grin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2020On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system components.CVE-2020-5851 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 4.6
On impacted versions and platforms the Trusted Platform Module (TPM) system integrity check cannot detect modifications to specific system components. This issue only impacts specific engineering hotfixes and platforms. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affected Engineering Hotfix builds are as follows: Hotfix-BIGIP-14.1.0.2.0.45.4-ENG Hotfix-BIGIP-14.1.0.2.0.62.4-ENG
- Product
- Big-ip Local Traffic Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.f5.comsupport.f5.com
Dec 31, 2019An issue was discovered in Sylius products.CVE-2019-12186 · Other software · Sylius · reported by MITREMedium 4.8
An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x through 1.2.16, 1.3.x through 1.3.11, and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18, 1.1.x through 1.1.18, 1.2.x through 1.2.17, 1.3.x through 1.3.12, 1.4.x through 1.4.4, and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the "string" field type. The contents are an object, with malicious code returned by the __toString() method of that object.
- Product
- Grid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2019USG9500 with versions of V500R001C30;V500R001C60 have a missing integrity checking vulnerability.CVE-2019-5272 · Other software · Huawei · reported by psirt@huawei.comMedium 4.9
USG9500 with versions of V500R001C30;V500R001C60 have a missing integrity checking vulnerability. The software of the affected products does not check the integrity which may allow an attacker with high privilege to make malicious modifications without detection.
- Product
- USG9500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2019Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check.CVE-2019-18829 · Other software · Barco · reported by MITREHigh 7.8
Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The Barco signed 'Clickshare_For_Windows.exe' binary on the ClickShare Button (R9861500D01) loads a number of DLL files dynamically without verifying their integrity.
- Product
- Clickshare Button R9861500d01 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.f-secure.combarco.com
Dec 17, 2019Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check.CVE-2019-18824 · Other software · Barco · reported by MITREMedium 6.6
Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The ClickShare Button does not verify the integrity of the mutable content on the UBIFS partition before being used.
- Product
- Clickshare Button R9861500d01 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.f-secure.combarco.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.