Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,578 results · page 29 of 52
Mar 2, 2022Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone.CVE-2022-23779 · Email & office · Zohocorp · reported by MITREMedium 5.3
Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Feb 18, 2022Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files.CVE-2022-25365 · Other software · Docker · reported by MITREHigh 7.8
Docker Desktop before 4.5.1 on Windows allows attackers to move arbitrary files. NOTE: this issue exists because of an incomplete fix for CVE-2022-23774.
- Product
- Docker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comsecurity.netapp.com
Feb 16, 2022Adobe Creative Cloud Desktop version 2.7.0.13 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary codeCVE-2022-23202 · Other software · Adobe · reported by AdobeHigh 7
Adobe Creative Cloud Desktop version 2.7.0.13 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must download a malicious DLL file. The attacker has to deliver the DLL on the same folder as the installer which makes it as a high complexity attack vector.
- Product
- Creative Cloud (desktop component)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Feb 16, 2022Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code executionCVE-2021-39297 · Other software · HP · reported by hp-security-alert@hp.comHigh 8.8
Potential vulnerabilities have been identified in UEFI firmware (BIOS) for some PC products which may allow escalation of privilege and arbitrary code execution.
- Product
- 260 G3 Desktop Mini PC Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Feb 7, 2022xrdp is an open source remote desktop protocol (RDP) server.CVE-2022-23613 · Other software · neutrinolabs · reported by GitHubHigh 7.8
xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in version 0.9.18.1 and above. Users are advised to upgrade. There are no known workarounds.
- Product
- xrdp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022Element Desktop is a Matrix client for desktop platforms with Element Web at its core.CVE-2022-23597 · Other software · Element · reported by GitHubHigh 8.3
Element Desktop is a Matrix client for desktop platforms with Element Web at its core. Element Desktop before 1.9.7 is vulnerable to a remote program execution bug with user interaction. The exploit is non-trivial and requires clicking on a malicious link, followed by another button click. To the best of our knowledge, the vulnerability has never been exploited in the wild. If you are using Element Desktop < 1.9.7, we recommend upgrading at your earliest convenience. If successfully exploited, the vulnerability allows an attacker to specify a file path of a binary on the victim's computer which then gets executed. Notably, the attacker does *not* have the ability to specify program arguments. However, in certain unspecified configurations, the attacker may be able to specify an URI instead of a file path which then gets handled using standard platform mechanisms. These may allow exploiting further vulnerabilities in those mechanisms, potentially leading to arbitrary code execution.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files.CVE-2022-23774 · Other software · Docker · reported by MITREMedium 5.3
Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comdocs.docker.com
Jan 28, 2022Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.CVE-2022-23863 · Email & office · Zohocorp · reported by MITREMedium 6.5
Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jan 25, 2022This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160.CVE-2021-34869 · Other software · Parallels · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13797.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.parallels.comzerodayinitiative.com
Jan 25, 2022This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160.CVE-2021-34868 · Other software · Parallels · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13712.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.parallels.comzerodayinitiative.com
Jan 25, 2022This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160.CVE-2021-34867 · Other software · Parallels · reported by zdi-disclosures@trendmicro.comHigh 8.2
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13672.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.parallels.comzerodayinitiative.com
Jan 18, 2022Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive infCVE-2021-44757 · Email & office · Zohocorp · reported by MITRECritical 9.1
Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.compitstop.manageengine.com
Jan 15, 2022ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution.CVE-2021-44537 · Other software · Owncloud · reported by MITREHigh 7.8
ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution.
- Product
- Owncloud Desktop Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jan 12, 2022Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login.CVE-2021-45449 · Other software · Docker · reported by MITREMedium 5.5
Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged in while on 4.3.0, 4.3.1. Gaining access to this data would require having access to the user’s local files.
- Product
- Docker Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.docker.comdocs.docker.com
Jan 11, 2022Remote Desktop Licensing Diagnoser Information Disclosure VulnerabilityCVE-2022-21964 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2022Remote Desktop Protocol Remote Code Execution VulnerabilityCVE-2022-21893 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Remote Desktop Protocol Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2022Remote Desktop Client Remote Code Execution VulnerabilityCVE-2022-21851 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Desktop Client Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2022Remote Desktop Client Remote Code Execution VulnerabilityCVE-2022-21850 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Desktop Client Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 10, 2022Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page.CVE-2021-46166 · Email & office · Zohocorp · reported by MITREMedium 6.5
Zoho ManageEngine Desktop Central before 10.0.662 allows authenticated users to obtain sensitive information from the database by visiting the Reports page.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jan 10, 2022Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly CVE-2021-46165 · Email & office · Zohocorp · reported by MITREHigh 7.8
Zoho ManageEngine Desktop Central before 10.0.662, during startup, launches an executable file from the batch files, but this file's path might not be properly defined.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jan 10, 2022Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module.CVE-2021-46164 · Email & office · Zohocorp · reported by MITREHigh 8.8
Zoho ManageEngine Desktop Central before 10.0.662 allows remote code execution by an authenticated user who has complete access to the Reports module.
- Product
- Manageengine Desktop Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jan 4, 2022The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp BusCVE-2021-24042 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior to v2.21.230, WhatsApp for KaiOS prior to v2.2143, WhatsApp Desktop prior to v2.2146 could have allowed an out-of-bounds write if a user makes a 1:1 call to a malicious actor.
- Product
- WhatsApp Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhatsapp.comwhatsapp.com
Dec 27, 2021In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requeCVE-2021-45884 · Other software · Brave · reported by MITREHigh 7.5
In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue exists because of an incomplete fix for CVE-2021-21323 and CVE-2021-22916.
- Product
- Brave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2021NetApp Virtual Desktop Service (VDS) when used with an HTML5 gateway is susceptible to a vulnerability which when successfully exploited could allow an unauthenCVE-2021-27007 · Other software · Netapp · reported by security-alert@netapp.comCritical 9.8
NetApp Virtual Desktop Service (VDS) when used with an HTML5 gateway is susceptible to a vulnerability which when successfully exploited could allow an unauthenticated attacker to takeover a Remote Desktop Session.
- Product
- Virtual Desktop Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.comsecurity.netapp.com
Dec 23, 2021A cryptographic weakness existed in the authentication protocol of Remote Desktop.CVE-2017-2488 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A cryptographic weakness existed in the authentication protocol of Remote Desktop. This issue was addressed by implementing the Secure Remote Password authentication protocol. This issue is fixed in Apple Remote Desktop 3.9. An attacker may be able to capture cleartext passwords.
- Product
- Apple Remote Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 22, 2021An issue was discovered in Quest KACE Desktop Authority before 11.2.CVE-2021-44031 · Other software · Quest · reported by MITRECritical 9.8
An issue was discovered in Quest KACE Desktop Authority before 11.2. /dacomponentui/profiles/profileitems/outlooksettings/Insertimage.aspx contains a vulnerability that could allow pre-authentication remote code execution. An attacker could upload a .ASP file to reside at /images/{GUID}/{filename}.
- Product
- Kace Desktop Authority
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.quest.comsupport.quest.com
Dec 22, 2021Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.CVE-2021-44030 · Other software · Quest · reported by MITREMedium 6.1
Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.
- Product
- Kace Desktop Authority
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.quest.comsupport.quest.com
Dec 22, 2021An issue was discovered in Quest KACE Desktop Authority before 11.2.CVE-2021-44029 · Other software · Quest · reported by MITRECritical 9.8
An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known (due to the presence of CVE-2017-11317, CVE-2017-11357, or other means). A default setting for the type whitelisting feature in more current versions of ASP.NET AJAX prevents exploitation.
- Product
- Kace Desktop Authority
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.quest.comsupport.quest.com
Dec 22, 2021XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-2018CVE-2021-44028 · Other software · Quest · reported by MITREMedium 5.5
XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a related issue to CVE-2018-1285.
- Product
- Kace Desktop Authority
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.quest.comsupport.quest.com
Dec 15, 2021Remote Desktop Client Remote Code Execution VulnerabilityCVE-2021-43233 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Remote Desktop Client Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 12, 2021Zoho Desktop Central Authentication Bypass VulnerabilityCVE-2021-44515 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
- Product
- Desktop Central
- On CISA’s list since
- Dec 10, 2021 (federal fix deadline Dec 24, 2021)
- What to do
- Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpitstop.manageengine.comcisa.gov
Dec 7, 2021NoMachine Enterprise Desktop is affected by Integer Overflow.CVE-2021-42977 · Other software · Nomachine · reported by MITREHigh 8.8
NoMachine Enterprise Desktop is affected by Integer Overflow. IOCTL Handler 0x22001B in the NoMachine Enterprise Desktop above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
- Product
- Enterprise Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsentinelone.comsentinelone.com
Dec 7, 2021NoMachine Enterprise Desktop is affected by Buffer Overflow.CVE-2021-42976 · Other software · Nomachine · reported by MITREHigh 8.8
NoMachine Enterprise Desktop is affected by Buffer Overflow. IOCTL Handler 0x22001B in the NoMachine Enterprise Desktop above 4.0.346 and below 7.7.4 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
- Product
- Enterprise Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsentinelone.comsentinelone.com
Nov 23, 2021Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service.CVE-2021-43019 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability on the product installer. User interaction is required before product installation to abuse this vulnerability.
- Product
- Creative Cloud (desktop component)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Nov 18, 2021Adobe Creative Cloud version 5.5 (and earlier) are affected by an Application denial of service vulnerability in the Creative Cloud Desktop installer.CVE-2021-43017 · Other software · Adobe · reported by AdobeMedium 4.2
Adobe Creative Cloud version 5.5 (and earlier) are affected by an Application denial of service vulnerability in the Creative Cloud Desktop installer. An authenticated attacker with root privileges could leverage this vulnerability to achieve denial of service by planting a malicious file on the victim's local machine. User interaction is required before product installation to abuse this vulnerability.
- Product
- GoCart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Nov 17, 2021Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability.CVE-2021-42955 · Email & office · Zohocorp · reported by MITREHigh 7.3
Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability. Because of the designed password reset mechanism, any non-admin Windows user can reset the password of the Remote Access Plus Server Admin account.
- Product
- Manageengine Remote Access Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control.CVE-2021-42954 · Email & office · Zohocorp · reported by MITREHigh 7.8
Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group (non-admin or any guest users), thereby allowing privilege escalation, unauthorized password reset, stealing of sensitive data, access to credentials in plaintext, access to registry values, tampering with configuration files, etc.
- Product
- Manageengine Remote Access Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability.CVE-2021-42956 · Email & office · Zoho · reported by MITREHigh 7.8
Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper privilege management, the process launches as the logged in user, so memory dump can be done by non-admin also. Remotely, an attacker can dump all sensitive information including DB Connection string, entire IT infrastructure details, commands executed by IT admin including credentials, secrets, private keys and more.
- Product
- Manageengine Remote Access Plus Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BCVE-2021-3519 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.4
A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.
- Product
- Desktop BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 9, 2021Windows Remote Desktop Protocol (RDP) Information Disclosure VulnerabilityCVE-2021-41371 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.4
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 9, 2021Remote Desktop Client Remote Code Execution VulnerabilityCVE-2021-38666 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Desktop Client Remote Code Execution Vulnerability
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 9, 2021Remote Desktop Protocol Client Information Disclosure VulnerabilityCVE-2021-38665 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.4
Remote Desktop Protocol Client Information Disclosure Vulnerability
- Product
- Remote Desktop client for Windows Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 9, 2021Windows Remote Desktop Protocol (RDP) Information Disclosure VulnerabilityCVE-2021-38631 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.4
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
- Product
- Windows 10 Version 1507
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 9, 2021Windows Desktop Bridge Elevation of Privilege VulnerabilityCVE-2021-36957 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Desktop Bridge Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 25, 2021This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160).CVE-2021-34864 · Other software · Parallels · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the WinAppHelper component. The issue results from the lack of proper access control. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13543.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Oct 25, 2021This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160).CVE-2021-34857 · Other software · Parallels · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13601.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.parallels.comzerodayinitiative.com
Oct 25, 2021This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160).CVE-2021-34856 · Other software · Parallels · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the virtio-gpu virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13581.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.parallels.comzerodayinitiative.com
Oct 25, 2021This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.1.3 (49160).CVE-2021-34855 · Other software · Parallels · reported by zdi-disclosures@trendmicro.comMedium 6.5
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13592.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.parallels.comzerodayinitiative.com
Oct 25, 2021This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160).CVE-2021-34854 · Other software · Parallels · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data, which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13544.
- Product
- Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.parallels.comzerodayinitiative.com
Oct 21, 2021FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license.CVE-2021-41160 · Other software · FreeRDP · reported by GitHubMedium 5.3
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious server might trigger out of bound writes in a connected client. Connections using GDI or SurfaceCommands to send graphics updates to the client might send `0` width/height or out of bound rectangles to trigger out of bound writes. With `0` width or heigth the memory allocation will be `0` but the missing bounds checks allow writing to the pointer at this (not allocated) region. This issue has been patched in FreeRDP 2.4.1.
- Product
- FreeRDP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.