Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
272 results · page 3 of 6
Feb 26, 2025In the Linux kernel, the following vulnerability has been resolved: Revert "Revert "block, bfq: honor already-setup queue merges"" A crash [1] happened to be CVE-2021-47646 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: Revert "Revert "block, bfq: honor already-setup queue merges"" A crash [1] happened to be triggered in conjunction with commit 2d52c58b9c9b ("block, bfq: honor already-setup queue merges"). The latter was then reverted by commit ebc69e897e17 ("Revert "block, bfq: honor already-setup queue merges""). Yet, the reverted commit was not the one introducing the bug. In fact, it actually triggered a UAF introduced by a different commit, and now fixed by commit d29bd41428cf ("block, bfq: reset last_bfqq_created on group change"). So, there is no point in keeping commit 2d52c58b9c9b ("block, bfq: honor already-setup queue merges") out. This commit restores it. [1] https://bugzilla.kernel.org/show_bug.cgi?id=214503
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 26, 2024Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.CVE-2024-47150 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Low 3.3
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.CVE-2024-47149 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Low 3.3
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.CVE-2024-8994 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 6.2
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.CVE-2024-8993 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 6.2
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.CVE-2024-8992 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.CVE-2024-47157 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Low 2.9
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.CVE-2024-47155 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 5.5
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.CVE-2024-47154 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 5.5
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.CVE-2024-47153 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 6.2
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.CVE-2024-47148 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.CVE-2024-47156 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Low 3.3
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
- Product
- MagicOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024Some Honor products are affected by file writing vulnerability, successful exploitation could cause code executionCVE-2024-47151 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 6.3
Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2024Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoureCVE-2024-6219 · Other software · Canonical Ltd. · reported by security@ubuntu.comLow 3.8
Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2024Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header.CVE-2024-48913 · Other software · honojs · reported by GitHubMedium 5.9
Hono, a web framework, prior to version 4.6.5 is vulnerable to bypass of cross-site request forgery (CSRF) middleware by a request without Content-Type header. Although the CSRF middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe. This can allow an attacker to bypass CSRF protection implemented with Hono CSRF middleware. Version 4.6.5 fixes this issue.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024In the Linux kernel, the following vulnerability has been resolved: tracing: Have format file honor EVENT_FILE_FL_FREED When eventfs was introduced, special cCVE-2024-43891 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: tracing: Have format file honor EVENT_FILE_FL_FREED When eventfs was introduced, special care had to be done to coordinate the freeing of the file meta data with the files that are exposed to user space. The file meta data would have a ref count that is set when the file is created and would be decremented and freed after the last user that opened the file closed it. When the file meta data was to be freed, it would set a flag (EVENT_FILE_FL_FREED) to denote that the file is freed, and any new references made (like new opens or reads) would fail as it is marked freed. This allowed other meta data to be freed after this flag was set (under the event_mutex). All the files that were dynamically created in the events directory had a pointer to the file meta data and would call event_release() when the last reference to the user space file was closed. This would be the time that it is safe to free the file meta data. A shortcut was made for the "format" file. It's i_private would point to the "call" entry directly and not point to the file's meta data. This is because all format files are the same for the same "call
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Aug 22, 2024Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2024-43787 · Other software · honojs · reported by GitHubMedium 5
Hono is a Web application framework that provides support for any JavaScript runtime. Hono CSRF middleware can be bypassed using crafted Content-Type header. MIME types are case insensitive, but isRequestedByFormElementRe only matches lower-case. As a result, attacker can bypass csrf middleware using upper-case form-like MIME type. This vulnerability is fixed in 4.5.8.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2024In the Linux kernel, the following vulnerability has been resolved: btrfs: make cow_file_range_inline() honor locked_page on error The btrfs buffered write paCVE-2024-42266 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: btrfs: make cow_file_range_inline() honor locked_page on error The btrfs buffered write path runs through __extent_writepage() which has some tricky return value handling for writepage_delalloc(). Specifically, when that returns 1, we exit, but for other return values we continue and end up calling btrfs_folio_end_all_writers(). If the folio has been unlocked (note that we check the PageLocked bit at the start of __extent_writepage()), this results in an assert panic like this one from syzbot: BTRFS: error (device loop0 state EAL) in free_log_tree:3267: errno=-5 IO failure BTRFS warning (device loop0 state EAL): Skipping commit of aborted transaction. BTRFS: error (device loop0 state EAL) in cleanup_transaction:2018: errno=-5 IO failure assertion failed: folio_test_locked(folio), in fs/btrfs/subpage.c:871 ------------[ cut here ]------------ kernel BUG at fs/btrfs/subpage.c:871! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 PID: 5090 Comm: syz-executor225 Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jun 15, 2024In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitaCVE-2024-38395 · Other software · iterm2 · reported by MITRECritical 9.8
In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."
- Product
- iterm2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgitlab.com
May 20, 2024In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor table dormant flag from netdev release event path Check for taCVE-2024-36005 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor table dormant flag from netdev release event path Check for table dormant flag otherwise netdev release event path tries to unregister an already unregistered hook. [524854.857999] ------------[ cut here ]------------ [524854.858010] WARNING: CPU: 0 PID: 3386599 at net/netfilter/core.c:501 __nf_unregister_net_hook+0x21a/0x260 [...] [524854.858848] CPU: 0 PID: 3386599 Comm: kworker/u32:2 Not tainted 6.9.0-rc3+ #365 [524854.858869] Workqueue: netns cleanup_net [524854.858886] RIP: 0010:__nf_unregister_net_hook+0x21a/0x260 [524854.858903] Code: 24 e8 aa 73 83 ff 48 63 43 1c 83 f8 01 0f 85 3d ff ff ff e8 98 d1 f0 ff 48 8b 3c 24 e8 8f 73 83 ff 48 63 43 1c e9 26 ff ff ff <0f> 0b 48 83 c4 18 48 c7 c7 00 68 e9 82 5b 5d 41 5c 41 5d 41 5e 41 [524854.858914] RSP: 0018:ffff8881e36d79e0 EFLAGS: 00010246 [524854.858926] RAX: 0000000000000000 RBX: ffff8881339ae790 RCX: ffffffff81ba524a [524854.858936] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff8881c8a16438 [524854.858945] RBP: ffff8881c8a16438 R08: 0000000000000001 R09: ffffed103c6daf34 [524854.858954] R10: ffff8881e36d79a7 R11: 0000000000
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Apr 23, 2024Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2024-32869 · Other software · honojs · reported by GitHubMedium 5.3
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 19, 2024The adapter @hono/node-server allows you to run your Hono application on Node.js.CVE-2024-32652 · Other software · honojs · reported by GitHubHigh 7.5
The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue.
- Product
- node-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2024By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request.CVE-2024-29006 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This could lead to authentication bypass and other operational problems should an attacker decide to spoof their IP address this way. Users are recommended to upgrade to CloudStack version 4.18.1.1 or 4.19.0.1, which fixes this issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Apr 2, 2024IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configurCVE-2023-50313 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274812.
- Product
- WebSphere Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 18, 2024In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: sdio: Honor the host max_req_size in the RX path Lukas reports skb_over_panicCVE-2023-52611 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: sdio: Honor the host max_req_size in the RX path Lukas reports skb_over_panic errors on his Banana Pi BPI-CM4 which comes with an Amlogic A311D (G12B) SoC and a RTL8822CS SDIO wifi/Bluetooth combo card. The error he observed is identical to what has been fixed in commit e967229ead0e ("wifi: rtw88: sdio: Check the HISR RX_REQUEST bit in rtw_sdio_rx_isr()") but that commit didn't fix Lukas' problem. Lukas found that disabling or limiting RX aggregation works around the problem for some time (but does not fully fix it). In the following discussion a few key topics have been discussed which have an impact on this problem: - The Amlogic A311D (G12B) SoC has a hardware bug in the SDIO controller which prevents DMA transfers. Instead all transfers need to go through the controller SRAM which limits transfers to 1536 bytes - rtw88 chips don't split incoming (RX) packets, so if a big packet is received this is forwarded to the host in it's original form - rtw88 chips can do RX aggregation, meaning more multiple incoming packets can be pulled by the host from the card with one MMC/SDIO transfer. Thi
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Feb 20, 2024Set-Cookie response headers were being incorrectly honored in multipart HTTP responses.CVE-2024-1551 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Feb 19, 2024Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups.CVE-2024-25981 · Other software · Moodle · reported by patrick@puiterwijk.orgMedium 4.3
Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Feb 19, 2024Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups.CVE-2024-25980 · Other software · moodle · reported by patrick@puiterwijk.orgMedium 4.3
Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.
- Product
- h5p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Jan 22, 2024@hono/node-server is an adapter that allows users to run Hono applications on Node.js.CVE-2024-23340 · Other software · honojs · reported by GitHubMedium 5.3
@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called "double dots", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.
- Product
- node-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024An issue was discovered in the Phonos extension in MediaWiki before 1.40.2.CVE-2024-23178 · Other software · Mediawiki · reported by MITREMedium 5.4
An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js allows i18n-based XSS via the phonos-purge-needed-error message.
- Product
- Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.wikimedia.orgphabricator.wikimedia.org
Dec 28, 2023 Some Honor products are affected by type confusion vulnerability, successful exploitation could cause denial of service.CVE-2023-6939 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4
Some Honor products are affected by type confusion vulnerability, successful exploitation could cause denial of service.
- Product
- Magic UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.CVE-2023-51435 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4High 7.1
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.
- Product
- Magic UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by buffer overflow vulnerability, successful exploitation could cause code execution.CVE-2023-51434 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Critical 9.3
Some Honor products are affected by buffer overflow vulnerability, successful exploitation could cause code execution.
- Product
- Magic UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.CVE-2023-51433 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Low 2.9
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.
- Product
- Magic UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.CVE-2023-51432 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Low 3.2
Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.
- Product
- Magic UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.CVE-2023-51431 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4High 7
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
- Product
- com.hihonor.phoneservice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.CVE-2023-51430 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4.4
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.
- Product
- Magic UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.CVE-2023-51429 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 6
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.CVE-2023-51428 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4.6
Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.CVE-2023-51427 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4.6
Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.CVE-2023-51426 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4.6
Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.CVE-2023-23443 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4.6
Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.CVE-2023-23442 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4.6
Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.CVE-2023-23441 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 6
Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.
- Product
- Magic UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.CVE-2023-23440 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Low 3.3
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
- Product
- LGE-AN00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.CVE-2023-23439 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
- Product
- LGE-AN00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions CVE-2023-23438 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions
- Product
- LGE-AN00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak CVE-2023-23437 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Low 3.3
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak
- Product
- com.hihonor.vmall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.CVE-2023-23430 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Low 3.3
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
- Product
- com.hihonor.magichome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.CVE-2023-23429 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.