Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
304 results · page 3 of 7
Nov 27, 2024The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forgCVE-2024-42332 · Other software · Zabbix · reported by security@zabbix.comLow 3.7
The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attack requires an SNMP item to be configured as text on the target host.
- Product
- Zabbix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zabbix.comlists.debian.org
Oct 22, 2024Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08.CVE-2024-49211 · Other software · Archerirm · reported by MITREMedium 5.2
Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and executed by the web browser in the context of the vulnerable web application.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Oct 22, 2024Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09.CVE-2024-49210 · Other software · Archerirm · reported by MITREMedium 5.2
Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and executed by the web browser in the context of the vulnerable web application.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Oct 22, 2024Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application files.CVE-2024-49209 · Other software · Archerirm · reported by MITREMedium 6.5
Archer Platform 2024.03 before version 2024.09 is affected by an API authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker could potentially exploit this vulnerability to elevate their privileges and upload additional system icons.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Oct 22, 2024Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files.CVE-2024-49208 · Other software · Archerirm · reported by MITREMedium 5.9
Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker could potentially exploit this vulnerability to elevate their privileges and delete system icons.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Oct 2, 2024According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping.CVE-2024-44097 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comCritical 9.8
According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certificate properly while initializing the TLS connection. This allows for a network attacker to intercept the connection and read the data. The attacker could the either send the client a malicious response, or forward the (possibly modified) data to the real server."
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2024Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitrary files unto the sCVE-2024-44825 · Other software · invesalius · reported by MITREHigh 7.5
Directory Traversal vulnerability in Centro de Tecnologia da Informaco Renato Archer InVesalius3 v3.1.99995 allows attackers to write arbitrary files unto the system via a crafted .inv3 file.
- Product
- invesalius
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2024An issue was discovered in Archer Platform 6 before 2024.06.CVE-2024-41707 · Other software · Archerirm · reported by MITREMedium 4.8
An issue was discovered in Archer Platform 6 before 2024.06. Authenticated users can achieve HTML content injection. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Jul 25, 2024A stored XSS issue was discovered in Archer Platform 6 before version 2024.06.CVE-2024-41706 · Other software · archerirm · reported by MITREHigh 7.3
A stored XSS issue was discovered in Archer Platform 6 before version 2024.06. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 P4 (6.14.0.4) is also a fixed release.
- Product
- archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Jul 25, 2024A stored XSS issue was discovered in Archer Platform 6.8 before 2024.06.CVE-2024-41705 · Other software · archerirm · reported by MITREHigh 7.1
A stored XSS issue was discovered in Archer Platform 6.8 before 2024.06. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14.P4 (6.14.0.4) and 6.13 P4 (6.13.0.4) are also fixed releases. This vulnerability is similar to, but not identical to, CVE-2023-30639.
- Product
- archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Jul 3, 2024Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup fileCVE-2024-38471 · Network & remote access · TP-LINK · reported by vultures@jpcert.or.jpMedium 6.8
Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.
- Product
- Archer AX3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2024badmonkey, a Security Researcher has found a flaw that allows for a unauthenticated DoS attack on the camera.CVE-2023-5038 · Other software · Hanwha Vision Co., Ltd. · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882High 8.7
badmonkey, a Security Researcher has found a flaw that allows for a unauthenticated DoS attack on the camera. An attacker runs a crafted URL, nobody can access the web management page of the camera. and must manually restart the device or re-power it. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
- Product
- A-Series, Q-Series, PNM-series Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavision.comhanwhavision.com
May 27, 2024The affected device expose a network service called "rftest" that is vulnerable to unauthenticated command injection on ports TCP/8888, TCP/8889, and TCP/8890.CVE-2024-5035 · Network & remote access · TP-Link · reported by research@onekey.comHigh 8.8
The affected device expose a network service called "rftest" that is vulnerable to unauthenticated command injection on ports TCP/8888, TCP/8889, and TCP/8890. By successfully exploiting this flaw, remote unauthenticated attacker can gain arbitrary command execution on the device with elevated privileges.This issue affects Archer C4500X: through 1_1.1.6.
- Product
- Archer C4500X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2024An issue was discovered in Archer Platform 6 before 2024.03.CVE-2024-34093 · Other software · archerirm · reported by MITREMedium 5.3
An issue was discovered in Archer Platform 6 before 2024.03. There is an X-Forwarded-For Header Bypass vulnerability. An unauthenticated attacker could potentially bypass intended whitelisting when X-Forwarded-For header is enabled.
- Product
- archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.comarcherirm.community
May 6, 2024An issue was discovered in Archer Platform 6 before 2024.04.CVE-2024-34092 · Other software · Archerirm · reported by MITREHigh 8.8
An issue was discovered in Archer Platform 6 before 2024.04. Authentication was mishandled because lock did not terminate an existing session. 6.14 P3 (6.14.0.3) is also a fixed release.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.comarcherirm.community
May 6, 2024An issue was discovered in Archer Platform 6 before 2024.04.CVE-2024-34091 · Other software · archer · reported by MITREHigh 7.3
An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed in the background of the application and renders content inaccessible. 6.14 P3 (6.14.0.3) is also a fixed release.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.comarcherirm.community
May 6, 2024An issue was discovered in Archer Platform 6 before 2024.04.CVE-2024-34090 · Other software · Archerirm · reported by MITREHigh 7.3
An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. The login banner in the Archer Control Panel (ACP) did not previously escape content appropriately. 6.14 P3 (6.14.0.3) is also a fixed release.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.comarcherirm.community
May 6, 2024An issue was discovered in Archer Platform 6 before 2024.04.CVE-2024-34089 · Other software · archer · reported by MITREHigh 7.3
An issue was discovered in Archer Platform 6 before 2024.04. There is a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 P3 (6.14.0.3) is also a fixed release.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.comarcherirm.community
May 6, 2024Archer Platform 6 before 2024.03 contains a sensitive information disclosure vulnerability.CVE-2024-26312 · Other software · archer · reported by MITREMedium 4.3
Archer Platform 6 before 2024.03 contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.comarcherirm.community
May 2, 2024TP-Link Archer A54 libcmm.so dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2023-44448 · Network & remote access · TP-Link · reported by zdi-disclosures@trendmicro.comMedium 6.8
TP-Link Archer A54 libcmm.so dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A54 routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the file libcmm.so. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22262.
- Product
- Archer A54
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024TP-Link Archer AX21 tmpServer Command 0x422 Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2023-27333 · Network & remote access · TP-Link · reported by zdi-disclosures@trendmicro.comMedium 6.8
TP-Link Archer AX21 tmpServer Command 0x422 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer AX21 routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of command 0x422 provided to the tmpServer service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-19905.
- Product
- Archer AX21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024TP-Link Archer AX21 tdpServer Logging Stack-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2023-27332 · Network & remote access · TP-Link · reported by zdi-disclosures@trendmicro.comHigh 8.8
TP-Link Archer AX21 tdpServer Logging Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer AX21 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the logging functionality of the tdpServer program, which listens on UDP port 20002. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-19898.
- Product
- Archer AX21
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Apr 26, 2024 Vladimir Kononovich, a Security Researcher has found a flaw that using a inappropriate encryption logic on the DVR.CVE-2023-6096 · Other software · Hanwha Vision Co., Ltd. · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882High 7.4
Vladimir Kononovich, a Security Researcher has found a flaw that using a inappropriate encryption logic on the DVR. firmware encryption is broken and allows to decrypt. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
- Product
- HRX-1620
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavision.comhanwhavision.com
Apr 26, 2024 Vladimir Kononovich, a Security Researcher has found a flaw that allows for a remote code execution on the DVR.CVE-2023-6095 · Other software · Hanwha Vision Co., Ltd. · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882High 8.9
Vladimir Kononovich, a Security Researcher has found a flaw that allows for a remote code execution on the DVR. An attacker could inject malicious HTTP headers into request packets to execute arbitrary code. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
- Product
- HRX-1620
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavision.comhanwhavision.com
Mar 28, 2024Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC1CVE-2023-6437 · Network & remote access · TP-Link · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TP-Link TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u allows authenticated OS Command Injection. This issue affects TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3 : through 20240328. Also the vulnerability continues in the TP-Link VX220-G2u and TP-Link VN020-G2u models due to the products not being produced and supported.
- Product
- TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD-W9970, Tp-Link TD-W9970v3, TP-Link VX220-G2u, TP-Link VN020-G2u
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 7, 2024Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored cross-site scripting (XSS) vulnerability.CVE-2024-26313 · Other software · Archerirm · reported by MITREHigh 7.3
Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.13.P3 HF1 (6.13.0.3.1) is also a fixed release.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.comarcherirm.community
Mar 7, 2024Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a sensitive information disclosure vulnerability.CVE-2024-26309 · Other software · archerirm · reported by MITREMedium 5.3
Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a sensitive information disclosure vulnerability. An unauthenticated attacker could potentially obtain access to sensitive information via an internal URL.
- Product
- archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.comarcherirm.community
Mar 5, 2024Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052.CVE-2024-2188 · Network & remote access · TP-Link · reported by cve-coordination@incibe.esMedium 6.1
Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052. This vulnerability could allow an unauthenticated attacker to create a port mapping rule via a SOAP request and store a malicious JavaScript payload within that rule, which could result in an execution of the JavaScript payload when the rule is loaded.
- Product
- Archer AX50
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2024Archer Platform 6.x before 6.14 P2 HF1 (6.14.0.2.1) contains a reflected XSS vulnerability.CVE-2024-26311 · Other software · Archerirm · reported by MITREMedium 5.7
Archer Platform 6.x before 6.14 P2 HF1 (6.14.0.2.1) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this by tricking a victim application user into supplying malicious JavaScript code to the vulnerable web application. This code is then reflected to the victim and gets executed by the web browser in the context of the vulnerable web application.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.comarcherirm.community
Feb 21, 2024Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability.CVE-2024-26310 · Other software · archer · reported by MITREMedium 4.3
Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability. A remote authenticated malicious user could potentially exploit this to gain access to API information that should only be accessible with extra privileges.
- Product
- platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.comarcherirm.community
Jan 10, 2024Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands.CVE-2024-21833 · Network & remote access · TP-Link · reported by vultures@jpcert.or.jpHigh 8.8
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.
- Product
- Archer AX3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024Multiple TP-LINK products allow a network-adjacent authenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commandsCVE-2024-21821 · Network & remote access · TP-Link · reported by vultures@jpcert.or.jpHigh 8
Multiple TP-LINK products allow a network-adjacent authenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands.
- Product
- Archer AX3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commanCVE-2024-21773 · Network & remote access · TP-Link · reported by vultures@jpcert.or.jpHigh 8.8
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has pre-specified target devices and blocked URLs in parental control settings.
- Product
- Archer AX3000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2023Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability.CVE-2023-48642 · Other software · Archerirm · reported by MITREMedium 5.4
Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is also a fixed release.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Dec 12, 2023Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability.CVE-2023-48641 · Other software · Archerirm · reported by MITREHigh 7.5
Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability. An authenticated malicious user in a multi-instance installation could potentially exploit this vulnerability by manipulating application resource references in user requests to bypass authorization checks, in order to gain execute access to AWF application resources.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Nov 16, 2023Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption.CVE-2023-48053 · Other software · Archerydms · reported by MITREHigh 7.5
Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
- Product
- Archery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgxx777.github.iogxx777.github.io
Nov 13, 2023Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device.CVE-2023-5747 · Other software · Hanwha Vision Co., Ltd. · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882High 7.2
Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing an attacker to run arbitrary code. HanwhaVision has released patched firmware for the highlighted flaw. Please refer to the hanwhavision security report for more information and solution."
- Product
- PNV-A6081R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavision.comhanwhavision.com
Nov 13, 2023badmonkey, a Security Researcher has found a flaw that allows for a authenticated command injection on the camera.CVE-2023-5037 · Other software · Hanwha Vision Co., Ltd. · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882High 7.1
badmonkey, a Security Researcher has found a flaw that allows for a authenticated command injection on the camera. An attacker could inject malicious into request packets to execute command. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
- Product
- A-Series, Q-Series, PNM-series Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavision.comhanwhavision.com
Oct 17, 2023Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a stored cross-site scripting (XSS) vulnerability.CVE-2023-45358 · Other software · Archerirm · reported by MITREHigh 8.5
Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is also a fixed release.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Oct 17, 2023Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability.CVE-2023-45357 · Other software · Archerirm · reported by MITREMedium 4.3
Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message. 6.14 (6.14.0) is also a fixed release.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Sep 6, 2023Archer AX6000 firmware versions prior to 'Archer AX6000(JP)_V1_1.3.0 Build 20221208' allows a network-adjacent authenticated attacker to execute arbitrary OS coCVE-2023-40531 · Network & remote access · TP-LINK · reported by vultures@jpcert.or.jpHigh 8
Archer AX6000 firmware versions prior to 'Archer AX6000(JP)_V1_1.3.0 Build 20221208' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.
- Product
- Archer AX6000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands.CVE-2023-40357 · Network & remote access · TP-LINK · reported by vultures@jpcert.or.jpHigh 8
Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX50 firmware versions prior to 'Archer AX50(JP)_V1_230529', Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504', Archer AX10 firmware versions prior to 'Archer AX10(JP)_V1.2_230508', and Archer AX11000 firmware versions prior to 'Archer AX11000(JP)_V1_230523'.
- Product
- Archer AX50
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023Archer C5400 firmware versions prior to 'Archer C5400(JP)_V2_230506' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.CVE-2023-39935 · Network & remote access · TP-LINK · reported by vultures@jpcert.or.jpHigh 8
Archer C5400 firmware versions prior to 'Archer C5400(JP)_V2_230506' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.
- Product
- Archer C5400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated attacker to execute arCVE-2023-39224 · Network & remote access · TP-LINK · reported by vultures@jpcert.or.jpHigh 8
Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Note that Archer C5 is no longer supported, therefore the update for this product is not provided.
- Product
- Archer C5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023Archer C3150 firmware versions prior to 'Archer C3150(JP)_V2_230511' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.CVE-2023-38588 · Network & remote access · TP-LINK · reported by vultures@jpcert.or.jpHigh 8
Archer C3150 firmware versions prior to 'Archer C3150(JP)_V2_230511' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.
- Product
- Archer C3150
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504' allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands.CVE-2023-38568 · Network & remote access · TP-LINK · reported by vultures@jpcert.or.jpHigh 8.8
Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504' allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands.
- Product
- Archer A10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allow a network-adjacentCVE-2023-38563 · Network & remote access · TP-LINK · reported by vultures@jpcert.or.jpHigh 8.8
Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands.
- Product
- Archer C1200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023Improper authentication vulnerability in Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616' allows a network-adjacent unauthenticated attacker to CVE-2023-37284 · Network & remote access · TP-LINK · reported by vultures@jpcert.or.jpHigh 8.8
Improper authentication vulnerability in Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616' allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command via a crafted request to bypass authentication.
- Product
- Archer C20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506' use hard-coded credentialsCVE-2023-32619 · Network & remote access · TP-LINK · reported by vultures@jpcert.or.jpHigh 8.8
Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506' use hard-coded credentials to login to the affected device, which may allow a network-adjacent unauthenticated attacker to execute an arbitrary OS command.
- Product
- Archer C50
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2023Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands.CVE-2023-31188 · Network & remote access · TP-LINK · reported by vultures@jpcert.or.jpHigh 8
Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505', Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506', and Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616'.
- Product
- Archer C50
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.