Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,625 results · page 23 of 53
Feb 3, 2023sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size.CVE-2023-25139 · Other software · Siemens · reported by MITRECritical 9.8
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size. This is unrelated to CWE-676. It may write beyond the bounds of the destination buffer when attempting to write a padded, thousands-separated string representation of a number, if the buffer is allocated the exact size required to represent that number as a string. For example, 1,234,567 (with padding to 13) overflows by two bytes.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurity.netapp.com
Jan 26, 2023The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build.CVE-2022-20458 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() could contain sensitive information. However, CarNotificationListener.java, it prints out the StatusBarNotification.getKey() directly in logs, which could contain user's account name (i.e. PII), in Android "user" build.Product: AndroidVersions: Android-12LAndroid ID: A-205567776
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 26, 2023Qlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions.CVE-2021-41988 · Other software · Qlik · reported by MITREHigh 7.8
Qlik NPrinting Designer through 21.14.3.0 creates a Temporary File in a Directory with Insecure Permissions.
- Product
- Nprinting Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2023Print-O-Matic: Does not validate and escape some of its shortcode attributes before outputting them back in the pageCVE-2022-4753 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
- Product
- Print-O-Matic
- Fixed in
- 2.1.8
- What to do
- Update Print-O-Matic to 2.1.8 or newer.
Jan 20, 2023dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during listing of the names of available printers.CVE-2023-24040 · Other software · Opengroup · reported by MITREHigh 7.1
dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during listing of the names of available printers. This allows low-privileged local users to inject arbitrary printer names via the $HOME/.printers file. This injection allows those users to manipulate the control flow and disclose memory contents on Solaris 10 systems. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Common Desktop Environment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Jan 20, 2023A stack-based buffer overflow in ParseColors in libXm in Common Desktop Environment 1.6 can be exploited by local low-privileged users via the dtprintinfo setuiCVE-2023-24039 · Other software · Opengroup · reported by MITREHigh 7.8
A stack-based buffer overflow in ParseColors in libXm in Common Desktop Environment 1.6 can be exploited by local low-privileged users via the dtprintinfo setuid binary to escalate their privileges to root on Solaris 10 systems. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- Common Desktop Environment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orggithub.com
Jan 10, 2023Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2023-21765 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 2023Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2023-21760 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 10, 2023Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2023-21678 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 5, 2023A vulnerability was found in eprintsug ulcc-core.CVE-2021-4304 · Other software · eprintsug · reported by VulDBMedium 6.3
A vulnerability was found in eprintsug ulcc-core. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file cgi/toolbox/toolbox. The manipulation of the argument password leads to command injection. The attack can be launched remotely. The patch is named 811edaae81eb044891594f00062a828f51b22cb1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217447.
- Product
- ulcc-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2023A vulnerability classified as problematic has been found in ethitter WP-Print-Friendly up to 0.5.2.CVE-2013-10007 · Other software · ethitter · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in ethitter WP-Print-Friendly up to 0.5.2. This affects an unknown part of the file wp-print-friendly.php. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. Upgrading to version 0.5.3 is able to address this issue. The identifier of the patch is 437787292670c20b4abe20160ebbe8428187f2b4. It is recommended to upgrade the affected component. The identifier VDB-217269 was assigned to this vulnerability.
- Product
- WP-Print-Friendly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2022A vulnerability was found in Exciting Printer and classified as critical.CVE-2017-20156 · Other software · Exciting · reported by VulDBMedium 5.5
A vulnerability was found in Exciting Printer and classified as critical. This issue affects some unknown processing of the file lib/printer/jobs/prepare_page.rb of the component Argument Handler. The manipulation of the argument URL leads to command injection. The patch is named 5f8c715d6e2cc000f621a6833f0a86a673462136. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217139.
- Product
- Printer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2022Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification promptCVE-2022-45404 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
- Product
- Firefox ESR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 22, 2022If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending CVE-2022-42929 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
If a website called `window.print()` in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending on the user's session restore settings. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 21, 2022A vulnerability was found in Imprint CMS.CVE-2021-4270 · Other software · unspecified · reported by VulDBLow 3.5
A vulnerability was found in Imprint CMS. It has been classified as problematic. Affected is the function SearchForm of the file ImprintCMS/Models/ViewHelpers.cs. The manipulation of the argument query leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 6140b140ccd02b5e4e7d6ba013ac1225724487f4. It is recommended to apply a patch to fix this issue. VDB-216474 is the identifier assigned to this vulnerability.
- Product
- Imprint CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2022Fingerprint calibration has a vulnerability of lacking boundary judgment.CVE-2022-46319 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Fingerprint calibration has a vulnerability of lacking boundary judgment. Successful exploitation of this vulnerability may cause out-of-bounds write.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 16, 2022Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or eCVE-2022-45796 · Other software · SHARP · reported by ART@zuso.aiCritical 9.1
Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 or earlier, 120 or earlier, 600 or earlier, 121 or earlier, 500 or earlier, 402 or earlier, 790 or earlier, and Digital Multifunctional System (Monochrome) 200 or earlier, 211 or earlier, 102 or earlier, 453 or earlier, 400 or earlier, 202 or earlier, 602 or earlier, 500 or earlier, 401 or earlier allows remote attackers to execute arbitrary commands via unspecified vectors.
- Product
- SHARP multifunction printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgglobal.sharp
Dec 13, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-44681 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-44678 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 12, 2022Helloprint: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2022-3908 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
- Product
- Helloprint
- Fixed in
- 1.4.7
- What to do
- Update Helloprint to 1.4.7 or newer.
Dec 12, 2022Certain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack.CVE-2022-43780 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.5
Certain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack.
- Product
- Certain HP ENVY, OfficeJet, and DeskJet printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Dec 12, 2022Certain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack.CVE-2022-2794 · Other software · HP Inc. · reported by hp-security-alert@hp.comHigh 7.5
Certain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack.
- Product
- Certain HP PageWide Pro printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Dec 12, 2022Certain HP Print products and Digital Sending products may be vulnerable to potential remote code execution and buffer overflow with use of Link-Local MulticastCVE-2021-3942 · Other software · HP Inc. · reported by hp-security-alert@hp.comCritical 9.8
Certain HP Print products and Digital Sending products may be vulnerable to potential remote code execution and buffer overflow with use of Link-Local Multicast Name Resolution or LLMNR.
- Product
- HP Print products and Digital Sending products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Dec 12, 2022A potential security vulnerability has been identified for certain HP multifunction printers (MFPs).CVE-2021-3821 · Other software · HP Inc. · reported by hp-security-alert@hp.comCritical 9.8
A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Denial of Service when running HP Workpath solutions on potentially affected products.
- Product
- HP FutureSmart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Dec 6, 2022pdfmake is an open source client/server side PDF printing in pure JavaScript.CVE-2022-46161 · Other software · bpampuch · reported by GitHubCritical 10
pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of user controlled input. Users of pdfmake are thus subject to arbitrary code execution in the context of the process running the pdfmake code. There are no known fixes for this issue. Users are advised to restrict access to trusted user input.
- Product
- pdfmake
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Dec 4, 2022Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privilegCVE-2022-41830 · Other software · KYOCERA Document Solutions Inc. · reported by vultures@jpcert.or.jpMedium 4.8
Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privilege to inject arbitrary script. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
- Product
- Kyocera Document Solutions MFPs and printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkyoceradocumentsolutions.co.jp
Dec 4, 2022Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to alter the product setCVE-2022-41807 · Other software · KYOCERA Document Solutions Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to alter the product settings without authentication by sending a specially crafted request. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
- Product
- Kyocera Document Solutions MFPs and printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkyoceradocumentsolutions.co.jp
Dec 4, 2022Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log inCVE-2022-41798 · Other software · KYOCERA Document Solutions Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log in to the product by spoofing a user with guessed session information. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci, TASKalfa 255c/205c, TASKalfa 256ci/206ci, ECOSYS M6526cdn/M6526cidn, FS-C2126MFP/C2126MFP+/C2026MFP/C2026MFP+, TASKalfa 8000i/6500i, TASKalfa 5500i/4500i/3500i, TASKalfa 305/255, TASKalfa 306i/256i, LS-3140MFP/3140MFP+/3640MFP, ECOSYS M2535dn, LS-1135MFP/1035MFP, LS-C8650DN/C8600DN, ECOSYS P6026cdn, FS-C5250DN, LS-4300DN/4200DN/2100DN, ECOSYS P4040dn, ECOSYS P2135dn, and FS-1370DN.
- Product
- Kyocera Document Solutions MFPs and printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpkyoceradocumentsolutions.co.jp
Dec 3, 2022AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.CVE-2022-46391 · Other software · Awstats · reported by MITREMedium 6.1
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
- Product
- Awstats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Nov 25, 2022In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verboCVE-2022-2721 · Other software · Octopus Deploy · reported by security@octopus.comHigh 7.5
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled.
- Product
- Octopus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.octopus.comadvisories.octopus.com
Nov 21, 2022Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php.CVE-2022-43214 · Other software · Billing System Project · reported by MITRECritical 9.8
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php.
- Product
- Billing System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Nov 9, 2022Microsoft Windows Print Spooler Privilege Escalation VulnerabilityCVE-2022-41073 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.
- Product
- Windows
- On CISA’s list since
- Nov 8, 2022 (federal fix deadline Dec 9, 2022)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.compacketstormsecurity.com
Nov 8, 2022PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioBasePrintf function in cstdlib/string.c when called from ExpressionParseFunctioCVE-2022-44319 · Other software · Picoc Project · reported by MITREMedium 5.5
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioBasePrintf function in cstdlib/string.c when called from ExpressionParseFunctionCall.
- Product
- Picoc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php_action/printOrder.php.CVE-2022-43331 · Other software · Canteen Management System Project · reported by MITREHigh 7.2
Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php_action/printOrder.php.
- Product
- Canteen Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2022Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /print.php.CVE-2022-43329 · Other software · Canteen Management System Project · reported by MITREHigh 7.2
Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /print.php.
- Product
- Canteen Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2022U-Office Force PrintMessage function has insufficient filtering for special characters.CVE-2022-39025 · Other software · e-Excellence Inc. · reported by twcert@cert.org.twMedium 6.1
U-Office Force PrintMessage function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack.
- Product
- U-Office Force
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 19, 2022Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.CVE-2022-3607 · Other software · octoprint · reported by security@huntr.devMedium 6
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.
- Product
- octoprint/octoprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41603 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41602 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41601 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41600 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41598 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41597 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41595 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41594 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41593 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41592 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022The fingerprint module has service logic errors.Successful exploitation of this vulnerability will cause the phone lock to be cracked.CVE-2022-38982 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The fingerprint module has service logic errors.Successful exploitation of this vulnerability will cause the phone lock to be cracked.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Oct 11, 2022Microsoft Windows Print Spooler Privilege Escalation Vulnerability CVE-2022-38028 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.
- Product
- Windows
- On CISA’s list since
- Apr 23, 2024 (federal fix deadline May 14, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comportal.msrc.microsoft.com
Sep 26, 2022Certain HP Print Products are potentially vulnerable to Buffer Overflow.CVE-2022-28722 · Other software · HP · reported by hp-security-alert@hp.comCritical 9.8
Certain HP Print Products are potentially vulnerable to Buffer Overflow.
- Product
- P4c78a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.