Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,625 results · page 25 of 53
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26802 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26801 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26798 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26797 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26796 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26795 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26794 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26793 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26792 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26791 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 21H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26790 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26789 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26787 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 15, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-26786 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2022Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection: Does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJACVE-2022-0949 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
- Product
- Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
- Fixed in
- 6.930
- What to do
- Update Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection to 6.930 or newer.
Apr 4, 2022Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitive information.CVE-2022-26572 · Other software · Xerox · reported by MITREHigh 7.5
Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitive information.
- Product
- Colorqube 8580 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, thrCVE-2022-1026 · Other software · Kyocera · reported by cve@rapid7.comHigh 8.6
Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.
- Product
- Multifunction Printer Net Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkyoceradocumentsolutions.comrapid7.com
Apr 3, 2022BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal.CVE-2022-28391 · Other software · Busybox · reported by MITREHigh 8.8
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors.
- Product
- Busybox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.alpinelinux.orggit.alpinelinux.org
Mar 23, 2022Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.CVE-2022-24293 · Other software · HP · reported by hp-security-alert@hp.comCritical 9.8
Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.
- Product
- Laserjet Pro M453-m454 W1y40a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Mar 23, 2022Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.CVE-2022-24292 · Other software · HP · reported by hp-security-alert@hp.comCritical 9.8
Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.
- Product
- Laserjet Pro M453-m454 W1y40a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Mar 23, 2022Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.CVE-2022-24291 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.5
Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.
- Product
- Laserjet Pro M453-m454 W1y40a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Mar 10, 2022A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perform brute force attack on screen lock pasCVE-2022-25820 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.2
A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perform brute force attack on screen lock password.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 10, 2022Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escalaCVE-2022-25090 · Other software · Kofax · reported by MITREHigh 8.1
Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading to privilege escalation because of a race condition.
- Product
- Printix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Mar 9, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-23284 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 2, 2022Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryDCVE-2022-25089 · Other software · Kofax · reported by MITRECritical 9.8
Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryData.
- Product
- Printix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 24, 2022A Site Scripting (XSS) vulnerability exists in the Xerte Project Xerte through 3.8.4 via the link parameter in print.php.CVE-2021-44662 · Other software · Nottingham.ac · reported by MITREMedium 6.1
A Site Scripting (XSS) vulnerability exists in the Xerte Project Xerte through 3.8.4 via the link parameter in print.php.
- Product
- Xerte Online Toolkits
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensitive inCVE-2022-24599 · Other software · Audiofile · reported by MITREMedium 6.5
In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensitive information via a crafted file. The printfileinfo function calls the copyrightstring function to get data, however, it dosn't use zero bytes to truncate the data.
- Product
- Audiofile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 15, 2022RICOH Printer series SP products 320DN, SP 325DNw, SP 320SN, SP 320SFN, SP 325SNw, SP 325SFNw, SP 330SN, Aficio SP 3500SF, SP 221S, SP 220SNw, SP 221SNw, SP 221CVE-2021-33945 · Other software · Ricoh · reported by MITRECritical 9.8
RICOH Printer series SP products 320DN, SP 325DNw, SP 320SN, SP 320SFN, SP 325SNw, SP 325SFNw, SP 330SN, Aficio SP 3500SF, SP 221S, SP 220SNw, SP 221SNw, SP 221SF, SP 220SFNw, SP 221SFNw v1.06 were discovered to contain a stack buffer overflow in the file /etc/wpa_supplicant.conf. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
- Product
- SP 320dn Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022Use after free in Printing in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced the user to engage is specific user interactions to poCVE-2022-0296 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Printing in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced the user to engage is specific user interactions to potentially exploit heap corruption via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Feb 9, 2022Microsoft Windows Print Spooler Privilege Escalation VulnerabilityCVE-2022-22718 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation.
- Product
- Windows
- On CISA’s list since
- Apr 19, 2022 (federal fix deadline May 10, 2022)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com
Feb 9, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-22717 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 9, 2022Microsoft Windows Print Spooler Privilege Escalation VulnerabilityCVE-2022-21999 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.
- Product
- Windows
- On CISA’s list since
- Mar 25, 2022 (federal fix deadline Apr 15, 2022)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com
Feb 9, 2022Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2022-21997 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Windows Print Spooler Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 8, 2022Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw,CVE-2021-20877 · Other software · Canon · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors.
- Product
- Canon laser printers and small office multifunctional printers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2022PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticateCVE-2021-42642 · Other software · Printerlogic · reported by MITREHigh 7.5
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to disclose the plaintext console username and password for a printer.
- Product
- Web Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportswigger.netsecurityaffairs.co
Feb 2, 2022PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticateCVE-2021-42641 · Other software · Printerlogic · reported by MITREHigh 7.5
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to disclose the username and email address of all users.
- Product
- Web Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportswigger.netsecurityaffairs.co
Feb 2, 2022PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticateCVE-2021-42640 · Other software · Printerlogic · reported by MITRECritical 9.1
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to reassign drivers for any printer.
- Product
- Web Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportswigger.netsecurityaffairs.co
Feb 2, 2022PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to multiple reflected cross site scripting vulnerabilities.CVE-2021-42639 · Other software · Printerlogic · reported by MITREMedium 6.1
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to multiple reflected cross site scripting vulnerabilities. Attacker controlled input is reflected back in the page without sanitization.
- Product
- Web Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportswigger.netsecurityaffairs.co
Feb 2, 2022PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use user-controlled input to craft a URL, resulting in a Server Side Request Forgery (SSRF) vulnerabilitCVE-2021-42637 · Other software · Printerlogic · reported by MITRECritical 9.8
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use user-controlled input to craft a URL, resulting in a Server Side Request Forgery (SSRF) vulnerability.
- Product
- Web Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportswigger.netsecurityaffairs.co
Feb 2, 2022PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to SQL Injection, which may allow an attacker to access additional audit records.CVE-2021-42633 · Other software · Printerlogic · reported by MITREMedium 5.3
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to SQL Injection, which may allow an attacker to access additional audit records.
- Product
- Web Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportswigger.netsecurityaffairs.co
Feb 1, 2022PrinterLogic Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting in pre-auth remote code execution.CVE-2021-42638 · Other software · Printerlogic · reported by MITREHigh 8.1
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting in pre-auth remote code execution.
- Product
- Web Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportswigger.netsecurityaffairs.co
Jan 31, 2022PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading to pre-auth remote code execution.CVE-2021-42635 · Other software · Printerlogic · reported by MITREHigh 8.1
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading to pre-auth remote code execution.
- Product
- Web Stack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportswigger.netsecurityaffairs.co
Jan 31, 2022PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code execution.CVE-2021-42631 · Other software · Printerlogic · reported by MITREHigh 8.1
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code execution.
- Product
- Virtual Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportswigger.netsecurityaffairs.co
Jan 27, 2022Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_print at src/mjs_builtin.c.CVE-2021-46542 · Other software · Cesanta · reported by MITREMedium 5.5
Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_print at src/mjs_builtin.c. This vulnerability can lead to a Denial of Service (DoS).
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via c_vsnprintf at mjs/src/common/str_util.c.CVE-2021-46521 · Other software · Cesanta · reported by MITREHigh 7.8
Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via c_vsnprintf at mjs/src/common/str_util.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_jprintf at src/mjs_util.c.CVE-2021-46520 · Other software · Cesanta · reported by MITREHigh 7.8
Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_jprintf at src/mjs_util.c.
- Product
- MJS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2022Espruino 2v10.246 was discovered to contain a stack buffer overflow via src/jsutils.c in vcbprintf.CVE-2021-46325 · Other software · Espruino · reported by MITREHigh 7.8
Espruino 2v10.246 was discovered to contain a stack buffer overflow via src/jsutils.c in vcbprintf.
- Product
- Espruino
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022Certain HP DesignJet products may be vulnerable to unauthenticated HTTP requests which allow viewing and downloading of print job previews.CVE-2021-3965 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.5
Certain HP DesignJet products may be vulnerable to unauthenticated HTTP requests which allow viewing and downloading of print job previews.
- Product
- Designjet T920 Cr355a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Jan 13, 2022Possible buffer overflow while printing the HARQ memory partition detail due to improper validation of buffer size in Snapdragon Auto, Snapdragon Compute, SnapdCVE-2021-30308 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Possible buffer overflow while printing the HARQ memory partition detail due to improper validation of buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 12, 2022In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage an arbitrary file uCVE-2021-45411 · Other software · Printable Staff ID Card Creator System Project · reported by MITRECritical 9.8
In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage an arbitrary file upload vulnerability to obtain remote code execution.
- Product
- Printable Staff ID Card Creator System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comsourcecodester.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.