Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,625 results · page 22 of 53
Apr 11, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24925 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24924 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24887 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24886 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24885 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24884 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24883 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the authCVE-2023-27520 · Other software · SEIKO EPSON CORPORATION · reported by vultures@jpcert.or.jpMedium 6.5
Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attacker to hijack the authentication and perform unintended operations by having a logged-in user view a malicious page. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.
- Product
- SEIKO EPSON printers/network interface Web Config
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2023Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege CVE-2023-23572 · Other software · SEIKO EPSON CORPORATION · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.
- Product
- SEIKO EPSON printers/network interface Web Config
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable chCVE-2023-1708 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.7
An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2023An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides remote unauthenticated CVE-2023-23594 · Other software · Sato-global · reported by MITRECritical 9.8
An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides remote unauthenticated attackers with access to execute commands intended only for valid/authenticated users, such as file uploads and configuration changes.
- Product
- Cl4nx Plus Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd2n1rly8br52rx.cloudfront.nethackandpwn.com
Mar 30, 2023Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Virames Vira-Investing allows Account Footprinting.CVE-2023-1014 · Other software · Virames · reported by iletisim@usom.gov.trHigh 7.5
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Virames Vira-Investing allows Account Footprinting. This issue affects Vira-Investing: before 1.0.84.86.
- Product
- Vira-Investing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 29, 2023This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 printers.CVE-2022-43608 · Other software · Canon · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BJNP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16032.
- Product
- imageCLASS MF644Cdw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.canonzerodayinitiative.com
Mar 28, 2023This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers.CVE-2022-24674 · Other software · Canon · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privet API. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15834.
- Product
- imageCLASS MF644Cdw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusa.canon.comzerodayinitiative.com
Mar 28, 2023This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers.CVE-2022-24673 · Other software · Canon · reported by zdi-disclosures@trendmicro.comCritical 9.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.
- Product
- imageCLASS MF644Cdw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusa.canon.comzerodayinitiative.com
Mar 28, 2023This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers.CVE-2022-24672 · Other software · Canon · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.
- Product
- imageCLASS MF644Cdw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusa.canon.comzerodayinitiative.com
Mar 24, 2023In parse_printerAttributes of ipphelper.c, there is a possible out of bounds read due to a string without a null-terminator.CVE-2023-21028 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In parse_printerAttributes of ipphelper.c, there is a possible out of bounds read due to a string without a null-terminator. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-180680572
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 24, 2023In captureImage of CustomizedSensor.cpp, there is a possible way to bypass the fingerprint unlock due to a logic error in the code.CVE-2023-20995 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In captureImage of CustomizedSensor.cpp, there is a possible way to bypass the fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-241910279
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24913 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24911 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24909 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24907 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24906 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24876 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24872 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24870 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24868 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-24867 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24866 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24865 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Elevation of Privilege VulnerabilityCVE-2023-24864 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24863 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24858 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24857 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-24856 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-23413 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-23406 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-23403 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 10, 2023Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing iCVE-2023-27904 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023 Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privilege escalation vulnerability that could beCVE-2023-24575 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privilege escalation vulnerability that could be exploited by malicious users to compromise the affected system
- Product
- Dell Multifunction Printer E525w Driver and Software Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023Print 3D Remote Code Execution VulnerabilityCVE-2023-23378 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Print 3D Remote Code Execution Vulnerability
- Product
- Print 3D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-21801 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityCVE-2023-21693 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.7
Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityCVE-2023-21684 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 10, 2023Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).CVE-2022-44261 · Other software · Averydennison · reported by MITREMedium 6.1
Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).
- Product
- Monarch Printer M9855 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2023Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via CVE-2023-21435 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.4
Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via log.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Feb 6, 2023**UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B allows CVE-2022-48311 · Other software · HP · reported by MITRECritical 9
**UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B allows authenticated attacker to inject their own script into the page via HTTP configuration page. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Deskjet 2540 A9u23b Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes.CVE-2022-42909 · Other software · WEPA · reported by cve-coordination@incibe.esMedium 6.5
WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in.
- Product
- Wepa Print Away
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordenrique.wtfincibe-cert.es
Feb 3, 2023WEPA Print Away is vulnerable to a stored XSS.CVE-2022-42908 · Other software · WEPA · reported by cve-coordination@incibe.esMedium 6.3
WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persistent across victim sessions.
- Product
- Wepa Print Away
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordenrique.wtfincibe-cert.es
Feb 3, 2023Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sprint in /hdf5/tools/CVE-2021-37501 · Other software · Hdfgroup · reported by MITREHigh 7.5
Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sprint in /hdf5/tools/lib/h5tools_str.c.
- Product
- Hdf5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.