Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,281 results · page 26 of 26
Oct 28, 2021A component of the HarmonyOS has a Incomplete Cleanup vulnerability.CVE-2021-22450 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
A component of the HarmonyOS has a Incomplete Cleanup vulnerability. Local attackers may exploit this vulnerability to cause memory exhaustion.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Oct 22, 2021The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation.CVE-2021-30359 · Other software · Checkpoint · reported by cve@checkpoint.comHigh 7.8
The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. Because the MS Installer allows regular users to repair their installation, an attacker running an installer before 90.08.7405 can start the installation repair and place a specially crafted binary in the repair folder, which runs with the admin privileges.
- Product
- Harmony Browse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupportcontent.checkpoint.com
Sep 2, 2021A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prCVE-2021-22704 · Other software · Schneider-electric · reported by cybersecurity@se.comCritical 9.1
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all versions prior to V6.2 SP11 ), Vijeo Designer Basic (all versions prior to V1.2), or EcoStruxure Machine Expert (all versions prior to V2.0) that could cause a Denial of Service or unauthorized access to system information when connecting to the Harmony HMI over FTP.
- Product
- Vijeo Designer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Aug 6, 2021A component of the HarmonyOS has a permission bypass vulnerability.CVE-2021-22295 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
A component of the HarmonyOS has a permission bypass vulnerability. Local attackers may exploit this vulnerability to cause the device to hang due to the page error OsVmPageFaultHandler.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Aug 3, 2021A component of the HarmonyOS has a Double Free vulnerability.CVE-2021-22425 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
A component of the HarmonyOS has a Double Free vulnerability. Local attackers may exploit this vulnerability to cause Root Elevating Privileges.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Aug 3, 2021A component of the HarmonyOS has a Kernel Memory Leakage Vulnerability.CVE-2021-22424 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
A component of the HarmonyOS has a Kernel Memory Leakage Vulnerability. Local attackers may exploit this vulnerability to cause Kernel Denial of Service.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Aug 3, 2021A component of the HarmonyOS has a Out-of-bounds Write Vulnerability.CVE-2021-22423 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
A component of the HarmonyOS has a Out-of-bounds Write Vulnerability. Local attackers may exploit this vulnerability to cause integer overflow.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Aug 3, 2021A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability.CVE-2021-22422 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulnerability to cause memory overwriting.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Aug 3, 2021A component of the HarmonyOS has a Improper Privilege Management vulnerability.CVE-2021-22421 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulnerability to cause further Elevation of Privileges.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Aug 3, 2021A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability.CVE-2021-22420 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause the underlying trust of the application trustlist mechanism is missing..
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Aug 3, 2021A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability.CVE-2021-22419 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. Local attackers may exploit this vulnerability to cause persistent dos.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Aug 3, 2021A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability.CVE-2021-22418 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulnerability to cause memory overwriting.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Aug 3, 2021A component of the HarmonyOS has a Data Processing Errors vulnerability.CVE-2021-22417 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit this vulnerability to cause Kernel Memory Leakage.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Aug 3, 2021A component of the HarmonyOS has a Data Processing Errors vulnerability.CVE-2021-22416 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit this vulnerability to cause Kernel Code Execution.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Jul 14, 2021A component of the HarmonyOS 2.0 has a Null Pointer Dereference Vulnerability.CVE-2021-22318 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
A component of the HarmonyOS 2.0 has a Null Pointer Dereference Vulnerability. Local attackers may exploit this vulnerability to cause system denial of service.
- Product
- Harmonyos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Jun 30, 2021A component of the HarmonyOS has a Improper Privilege Management vulnerability.CVE-2021-22376 · Other software · Huawei · reported by psirt@huawei.comHigh 8.4
A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulnerability to bypass user restrictions.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Jun 30, 2021A component of the HarmonyOS has a Privilege Dropping / Lowering Errors vulnerability.CVE-2021-22326 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
A component of the HarmonyOS has a Privilege Dropping / Lowering Errors vulnerability. Local attackers may exploit this vulnerability to obtain Kernel space read/write capability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Apr 1, 2021node-etsy-client is a NodeJs Etsy ReST API Client.CVE-2021-21421 · Other software · creharmony · reported by GitHubHigh 8.1
node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later.
- Product
- node-etsy-client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2021A component of HarmonyOS 2.0 has a DoS vulnerability.CVE-2021-22296 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
A component of HarmonyOS 2.0 has a DoS vulnerability. Local attackers may exploit this vulnerability to mount a file system to the target device, causing DoS of the file system.
- Product
- Harmonyos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comgitee.com
Mar 2, 2021A component API of the HarmonyOS 2.0 has a permission bypass vulnerability.CVE-2021-22294 · Other software · Huawei · reported by psirt@huawei.comLow 3.3
A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. Local attackers may exploit this vulnerability to issue commands repeatedly, exhausting system service resources.
- Product
- Harmonyos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2020A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-....CVE-2019-19278 · Other software · Siemens AG · reported by productcert@siemens.comMedium 6.8
A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-.... MLFB 6SR4...-.....-.... MLFB 6SR5...-.....-.... With option A30 (HMIs 12 inches or larger) (All versions), SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR325.-.....-.... (High Availability) (All versions). The affected device contains a vulnerability that could allow an unauthenticated attacker to restore the affected device to a point where predefined application and operating system protection mechanisms are not in place. Successful exploitation requires physical access to the system, but no system privileges and no user interaction. An attacker could use the vulnerability to compromise confidentialiy, integrity and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.
- Product
- SINAMICS PERFECT HARMONY GH180 Drives MLFB 6SR32..-.....-.... MLFB 6SR4...-.....-.... MLFB 6SR5...-.....-.... With option A30 (HMIs 12 inches or larger)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comus-cert.gov
May 14, 2019A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G28), SICVE-2019-6578 · Other software · Siemens AG · reported by productcert@siemens.comHigh 7.5
A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G28), SINAMICS PERFECT HARMONY GH180 with NXG II control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G28). A denial of service vulnerability exists in the affected products. The vulnerability could be exploited by an attacker with network access to the device. Successful exploitation requires no privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
- Product
- SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...-
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comics-cert.us-cert.gov
May 14, 2019A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G21, G22CVE-2019-6574 · Other software · Siemens AG · reported by productcert@siemens.comHigh 7.5
A vulnerability has been identified in SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G21, G22, G23, G26, G28, G31, G32, G38, G43 or G46), SINAMICS PERFECT HARMONY GH180 with NXG II control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...- (All Versions with option G21, G22, G23, G26, G28, G31, G32, G38, G43 or G46). An improperly configured Parameter Read/Write execution via Field bus network may cause the controller to restart. The vulnerability could be exploited by an attacker with network access to the device. Successful exploitation requires no privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
- Product
- SINAMICS PERFECT HARMONY GH180 with NXG I control, MLFBs: 6SR2...-, 6SR3...-, 6SR4...-
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Dec 20, 2018The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request.CVE-2018-15723 · Other software · Logitech · reported by vulnreport@tenable.comCritical 9.8
The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage this vulnerability to execute application defined commands (e.g. harmony.system?systeminfo).
- Product
- Logitech Harmony Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 20, 2018The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request.CVE-2018-15722 · Other software · Logitech · reported by vulnreport@tenable.comHigh 8.1
The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. A remote server or man in the middle can inject OS commands with a properly formatted response.
- Product
- Logitech Harmony Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 20, 2018The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request.CVE-2018-15721 · Other software · Logitech · reported by vulnreport@tenable.comCritical 9.8
The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. Remote attackers can use this vulnerability to gain access to the local API.
- Product
- Logitech Harmony Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 20, 2018Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API.CVE-2018-15720 · Other software · Logitech · reported by vulnreport@tenable.comCritical 9.8
Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API.
- Product
- Logitech Harmony Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 22, 2015Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScriCVE-2014-7939 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.3
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglechromereleases.blogspot.comlists.opensuse.org
Oct 16, 2014The Harmonizers Planet (aka uk.co.pixelkicks.fifthharmony) application 2.3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-iCVE-2014-7035 · Other software · Harmonizers Planet Project · reported by cret@cert.orgMedium 5.4
The Harmonizers Planet (aka uk.co.pixelkicks.fifthharmony) application 2.3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Harmonizers Planet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Oct 2, 2014The H2O Human Harmony Organization (aka com.netpia.ha.theh2o) application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows maCVE-2014-6905 · Other software · H2o Human Harmony Organization Project · reported by cret@cert.orgMedium 5.4
The H2O Human Harmony Organization (aka com.netpia.ha.theh2o) application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- H2o Human Harmony Organization
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Apr 29, 2014The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java in theCVE-2013-7372 · Websites & servers · Apache · reported by MITREMedium 5
The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture (JCA) in Android before 4.4 and other products, when no seed is provided by the user, uses an incorrect offset value, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging the resulting PRNG predictability, as exploited in the wild against Bitcoin wallet applications in August 2013.
- Product
- Harmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid-developers.blogspot.com.aunds.rub.de
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.