Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
290 results · page 3 of 6
Feb 10, 2024IBM Storage Defender - Resiliency Service 2.0 could allow a privileged user to perform unauthorized actions after obtaining encrypted data from clear text key sCVE-2023-50957 · Other software · IBM · reported by psirt@us.ibm.comHigh 8
IBM Storage Defender - Resiliency Service 2.0 could allow a privileged user to perform unauthorized actions after obtaining encrypted data from clear text key storage. IBM X-Force ID: 275783.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 18, 2024IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.CVE-2023-50963 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Storage Defender - Data Protect 1.0.0 through 1.4.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 276101.
- Product
- Storage Defender - Data Protect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 8, 2024Defender Security – Malware Scanner, Login Security & Firewall: Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-51490 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.
- Product
- Defender Security – Malware Scanner, Login Security & Firewall
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Defender Security – Malware Scanner, Login Security & Firewall to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 12, 2023Microsoft Defender Denial of Service VulnerabilityCVE-2023-36010 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft Defender Denial of Service Vulnerability
- Product
- Microsoft Malware Protection Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 14, 2023Microsoft Windows Defender Elevation of Privilege VulnerabilityCVE-2023-36422 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Windows Defender Elevation of Privilege Vulnerability
- Product
- Windows Defender Antimalware Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 16, 2023Defender Security: Does not prevent redirects to the login page via the auth_redirect WordPress functionCVE-2023-5089 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
- Product
- Defender Security
- Fixed in
- 4.1.0
- What to do
- Update Defender Security to 4.1.0 or newer.
Full record and what to do →NVD recordwpscan.comsprocketsecurity.com
Sep 15, 2023An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996.CVE-2023-36659 · Other software · Opswat · reported by MITRECritical 9.8
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly processed, which allows remote attackers to cause a denial of service (loss of communication).
- Product
- Metadefender Kiosk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opswat.comdocs.opswat.com
Sep 15, 2023An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996.CVE-2023-36657 · Other software · Opswat · reported by MITRECritical 9.8
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows (desktop shortcuts, narrator) can be abused for privilege escalation.
- Product
- Metadefender Kiosk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opswat.comdocs.opswat.com
Sep 15, 2023An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996.CVE-2023-36658 · Other software · Opswat · reported by MITREHigh 7.8
An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path that can be abused locally.
- Product
- Media Validation Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opswat.comdocs.opswat.com
Sep 12, 2023Windows Defender Attack Surface Reduction Security Feature BypassCVE-2023-38163 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Defender Attack Surface Reduction Security Feature Bypass
- Product
- Microsoft Defender Security Intelligence Updates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023Microsoft Windows Defender Elevation of Privilege VulnerabilityCVE-2023-38175 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Windows Defender Elevation of Privilege Vulnerability
- Product
- Windows Defender Antimalware Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 14, 2023An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash.CVE-2023-3633 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.1
An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines version 7.94791 and lower.
- Product
- Engines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Jul 12, 2023Defender Security: Cross-Site Request ForgeryCVE-2021-4425 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Defender Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.6. This is due to missing or incorrect nonce validation on the verify_otp_login_time() function. This makes it possible for unauthenticated attackers to verify a one time login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Defender Security
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jul 11, 2023Microsoft Defender Elevation of Privilege VulnerabilityCVE-2023-33156 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
Microsoft Defender Elevation of Privilege Vulnerability
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023Microsoft Windows Defender SmartScreen Security Feature Bypass VulnerabilityCVE-2023-32049 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.
- Product
- Windows
- On CISA’s list since
- Jul 11, 2023 (federal fix deadline Aug 1, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com
May 24, 2023Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender CVE-2022-0357 · Other software · Bitdefender · reported by cve-requests@bitdefender.comMedium 6.7
Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to 26.0.10.45. Bitdefender Internet Security versions prior to 26.0.10.45. Bitdefender Antivirus Plus versions prior to 26.0.10.45.
- Product
- Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Apr 14, 2023Microsoft Defender Security Feature Bypass VulnerabilityCVE-2023-24934 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.2
Microsoft Defender Security Feature Bypass Vulnerability
- Product
- Microsoft Malware Protection Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 11, 2023Microsoft Defender Denial of Service VulnerabilityCVE-2023-24860 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Microsoft Defender Denial of Service Vulnerability
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 14, 2023Microsoft Defender Elevation of Privilege VulnerabilityCVE-2023-23389 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.3
Microsoft Defender Elevation of Privilege Vulnerability
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Microsoft Defender for IoT Elevation of Privilege VulnerabilityCVE-2023-23379 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Defender for IoT Elevation of Privilege Vulnerability
- Product
- Microsoft Defender for IoT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 14, 2023Microsoft Defender for Endpoint Security Feature Bypass VulnerabilityCVE-2023-21809 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
- Product
- Microsoft Defender Security Intelligence Updates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 13, 2022Microsoft Defender SmartScreen Security Feature Bypass VulnerabilityCVE-2022-44698 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 5.4
Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
- Product
- Defender
- On CISA’s list since
- Dec 13, 2022 (federal fix deadline Jan 3, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.commsrc.microsoft.com
Nov 1, 2022An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privilegedCVE-2022-3369 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.6
An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bitdefender Engines versions prior to 7.92659. It also affects Bitdefender Antivirus Free, Bitdefender Antivirus Plus, Bitdefender Internet Security, Bitdefender Total Security, as well as Bitdefender Endpoint Security Tools for Windows with engine versions prior to 7.92659.
- Product
- Engines
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Oct 11, 2022Microsoft Windows Defender Elevation of Privilege VulnerabilityCVE-2022-37971 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft Windows Defender Elevation of Privilege Vulnerability
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 21, 2022A time-of-check-time-of-use (TOCTOU) race condition vulnerability was found in networkd-dispatcher.CVE-2022-29800 · Computers, phones & browsers · Microsoft · reported by patrick@puiterwijk.orgMedium 4.7
A time-of-check-time-of-use (TOCTOU) race condition vulnerability was found in networkd-dispatcher. This flaw exists because there is a certain time between the scripts being discovered and them being run. An attacker can abuse this vulnerability to replace scripts that networkd-dispatcher believes to be owned by root with ones that are not.
- Product
- Windows Defender For Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrosoft.commicrosoft.com
Sep 21, 2022A vulnerability was found in networkd-dispatcher.CVE-2022-29799 · Computers, phones & browsers · Microsoft · reported by patrick@puiterwijk.orgMedium 5.5
A vulnerability was found in networkd-dispatcher. This flaw exists because no functions are sanitized by the OperationalState or the AdministrativeState of networkd-dispatcher. This attack leads to a directory traversal to escape from the “/etc/networkd-dispatcher” base directory.
- Product
- Windows Defender For Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrosoft.commicrosoft.com
Sep 19, 2022A stored Cross-Site Scripting (XSS) vulnerability in OPSWAT MetaDefender ICAP Server before 4.13.0 allows attackers to execute arbitrary JavaScript or HTML becaCVE-2022-40778 · Other software · Opswat · reported by MITREMedium 5.4
A stored Cross-Site Scripting (XSS) vulnerability in OPSWAT MetaDefender ICAP Server before 4.13.0 allows attackers to execute arbitrary JavaScript or HTML because of the blocked page response.
- Product
- Metadefender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opswat.comopswat.com
Sep 13, 2022Microsoft Defender for Endpoint for Mac Elevation of Privilege VulnerabilityCVE-2022-35828 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability
- Product
- Microsoft Defender for Endpoint for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Sep 5, 2022Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commandCVE-2022-2830 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.8
Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commands to the environment. This issue affects: Bitdefender GravityZone Console On-Premise versions prior to 6.29.2-1. Bitdefender GravityZone Cloud Console versions prior to 6.27.2-2.
- Product
- GravityZone Console On-Premise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Aug 15, 2022Windows Defender Credential Guard Security Feature Bypass VulnerabilityCVE-2022-35822 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Windows Defender Credential Guard Security Feature Bypass Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 15, 2022Windows Defender Credential Guard Elevation of Privilege VulnerabilityCVE-2022-34711 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Defender Credential Guard Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Windows Defender Credential Guard Elevation of Privilege VulnerabilityCVE-2022-35771 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Defender Credential Guard Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Windows Defender Credential Guard Information Disclosure VulnerabilityCVE-2022-34712 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows Defender Credential Guard Information Disclosure Vulnerability
- Product
- Windows 10 Version 21H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Windows Defender Credential Guard Information Disclosure VulnerabilityCVE-2022-34710 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows Defender Credential Guard Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Windows Defender Credential Guard Security Feature Bypass VulnerabilityCVE-2022-34709 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6
Windows Defender Credential Guard Security Feature Bypass Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Windows Defender Credential Guard Elevation of Privilege VulnerabilityCVE-2022-34705 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Defender Credential Guard Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Windows Defender Credential Guard Information Disclosure VulnerabilityCVE-2022-34704 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Windows Defender Credential Guard Information Disclosure Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 12, 2022Microsoft Defender for Endpoint Tampering VulnerabilityCVE-2022-33637 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Defender for Endpoint Tampering Vulnerability
- Product
- Microsoft Defender for Endpoint for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 15, 2022Windows Defender Remote Credential Guard Elevation of Privilege VulnerabilityCVE-2022-30150 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.compacketstormsecurity.com
Jun 9, 2022OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resuCVE-2022-32272 · Other software · Opswat · reported by MITRECritical 9.8
OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender Email Gateway Security before 5.6.1 have incorrect access control, resulting in privilege escalation.
- Product
- Metadefender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdocs.opswat.com
Jun 8, 2022As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate filCVE-2022-32273 · Other software · Opswat · reported by MITREMedium 4.3
As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate filenames on the server.
- Product
- Metadefender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opswat.comopswat.com
Apr 15, 2022Microsoft Defender Denial of Service VulnerabilityCVE-2022-24548 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Defender Denial of Service Vulnerability
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 7, 2022Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityCVE-2022-0677 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 7.5
Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to 3.4.0.276. Bitdefender GravityZone versions prior to 26.4-1. Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.171. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.1.111.
- Product
- Update Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Mar 9, 2022Microsoft Defender for Endpoint Spoofing VulnerabilityCVE-2022-23278 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
Microsoft Defender for Endpoint Spoofing Vulnerability
- Product
- Microsoft Defender for Endpoint for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022Microsoft Defender for IoT Elevation of Privilege VulnerabilityCVE-2022-23266 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Defender for IoT Elevation of Privilege Vulnerability
- Product
- Microsoft Defender for IoT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022Microsoft Defender for IoT Remote Code Execution VulnerabilityCVE-2022-23265 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Microsoft Defender for IoT Remote Code Execution Vulnerability
- Product
- Microsoft Defender for IoT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 7, 2022Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, InternetCVE-2021-4199 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 7.8
Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools for Windows allows a remote attacker to escalate local privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to 26.0.10.45. Bitdefender Internet Security versions prior to 26.0.10.45. Bitdefender Antivirus Plus versions prior to 26.0.10.45. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.3.146.
- Product
- Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.comzerodayinitiative.com
Mar 7, 2022A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint SCVE-2021-4198 · Other software · Bitdefender · reported by cve-requests@bitdefender.comMedium 6.1
A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN Standalone allows an attacker to arbitrarily crash product processes and generate crashdump files. This issue affects: Bitdefender Total Security versions prior to 26.0.3.29. Bitdefender Internet Security versions prior to 26.0.3.29. Bitdefender Antivirus Plus versions prior to 26.0.3.29. Bitdefender Endpoint Security Tools versions prior to 7.2.2.92. Bitdefender VPN Standalone versions prior to 25.5.0.48.
- Product
- Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.comzerodayinitiative.com
Feb 18, 2022A Process Control vulnerability in ProductAgentUI.exe as used in Bitdefender Antivirus Plus allows an attacker to tamper with product settings via a specially cCVE-2020-8107 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.2
A Process Control vulnerability in ProductAgentUI.exe as used in Bitdefender Antivirus Plus allows an attacker to tamper with product settings via a specially crafted DLL file. This issue affects: Bitdefender Antivirus Plus versions prior to 24.0.26.136. Bitdefender Internet Security versions prior to 24.0.26.136. Bitdefender Total Security versions prior to 24.0.26.136.
- Product
- Antivirus Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Jan 11, 2022Windows Defender Credential Guard Security Feature Bypass VulnerabilityCVE-2022-21921 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.4
Windows Defender Credential Guard Security Feature Bypass Vulnerability
- Product
- Windows 10 Version 21H1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.