Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,768exploited flaws on CISA’s list

34added in the last 30 days

342new WordPress flaws this week

393,460entries in the database

463 results · page 3 of 10

Mar 2, 2024Master Slider – Responsive Touch Slider: Stored Cross-Site ScriptingCVE-2024-0611 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slides callback functionality in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers, with editor-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.9.9
What to do
Affects up to 3.9.9. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record advisory.abay.sh plugins.trac.wordpress.org
Mar 2, 2024Master Slider – Responsive Touch Slider: Cross-Site Request ForgeryCVE-2023-6326 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.9.10. This is due to missing or incorrect nonce validation on the 'process_bulk_action' function. This makes it possible for unauthenticated attackers to duplicate or delete arbitrary sliders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-50900 and CVE-2024-6490 may be a duplicate of this issue.
Product
Master Slider – Responsive Touch Slider
Affected
up to 3.9.10
What to do
Affects up to 3.9.10. Update Master Slider – Responsive Touch Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Feb 28, 2024In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid touching checkpointed data in get_victim() In CP disabling mode, there CVE-2021-47004 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.1
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid touching checkpointed data in get_victim() In CP disabling mode, there are two issues when using LFS or SSR | AT_SSR mode to select victim: 1. LFS is set to find source section during GC, the victim should have no checkpointed data, since after GC, section could not be set free for reuse. Previously, we only check valid chpt blocks in current segment rather than section, fix it. 2. SSR | AT_SSR are set to find target segment for writes which can be fully filled by checkpointed and newly written blocks, we should never select such segment, otherwise it can cause panic or data corruption during allocation, potential case is described as below: a) target segment has 'n' (n < 512) ckpt valid blocks b) GC migrates 'n' valid blocks to other segment (segment is still in dirty list) c) GC migrates '512 - n' blocks to target segment (segment has 'n' cp_vblocks and '512 - n' vblocks) d) If GC selects target segment via {AT,}SSR allocator, however there is no free space in targe segment.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Feb 27, 2024In the Linux kernel, the following vulnerability has been resolved: Input: appletouch - initialize work before device registration Syzbot has reported warningCVE-2021-46932 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: Input: appletouch - initialize work before device registration Syzbot has reported warning in __flush_work(). This warning is caused by work->func == NULL, which means missing work initialization. This may happen, since input_dev->close() calls cancel_work_sync(&dev->work), but dev->work initalization happens _after_ input_register_device() call. So this patch moves dev->work initialization before registering input device
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Nov 30, 2023Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-48752 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Happyforms Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms allows Reflected XSS.This issue affects Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms: from n/a through 1.25.9.
Product
Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms
Affected
up to 1.25.9
What to do
Affects up to 1.25.9. Update Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Oct 4, 2023TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective LifetiCVE-2023-41094 · Other software · Silicon Labs · reported by product-security@silabs.comCritical 10
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration This issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected
Product
Ember ZNet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.silabs.com community.silabs.com
Aug 28, 2023ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php.CVE-2023-39560 · Other software · Ectouch · reported by MITRECritical 9.8
ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php.
Product
Ectouch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 16, 2023Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps toCVE-2023-34165 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps to forge a URI for unauthorized access with zero permissions.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record device.harmonyos.com device.harmonyos.com
Apr 25, 2023A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X Portable Music Player withCVE-2023-27105 · Other software · Shanling · reported by MITRECritical 9.8
A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X Portable Music Player with Shanling MTouch OS v3.3 allows attackers to arbitrarily read, delete, or modify any critical system files via directory traversal.
Product
Eddict Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record en.shanling.com hexavector.github.io
Apr 17, 2023The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.CVE-2022-44726 · Other software · Timesheets-for-jira · reported by MITREMedium 5.4
The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.
Product
Timesheet Tracking
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record syss.de syss.de
Mar 24, 2023In updateInputChannel of WindowManagerService.java, there is a possible way to set a touchable region beyond its own SurfaceControl due to a logic error in the CVE-2023-21026 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In updateInputChannel of WindowManagerService.java, there is a possible way to set a touchable region beyond its own SurfaceControl due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-254681548
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Mar 16, 2023Improper access control vulnerability in BixbyTouch prior to version 3.2.02.5 in China models allows untrusted applications access local files.CVE-2023-21465 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Improper access control vulnerability in BixbyTouch prior to version 3.2.02.5 in China models allows untrusted applications access local files.
Product
Bixby Touch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Feb 14, 2023Onekey Touch devices through 4.0.0 and Onekey Mini devices through 2.10.0 allow man-in-the-middle attackers to obtain the seed phase.CVE-2023-25758 · Other software · Onekey · reported by MITREMedium 4.2
Onekey Touch devices through 4.0.0 and Onekey Mini devices through 2.10.0 allow man-in-the-middle attackers to obtain the seed phase. The man-in-the-middle access can only be obtained after disassembling a device (i.e., here, "man-in-the-middle" does not refer to the attacker's position on an IP network). NOTE: the vendor states that "our hardware team has updated the security patch without anyone being affected."
Product
Onekey Touch Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.onekey.so fortune.com
Feb 6, 2023BTicino Door Entry HOMETOUCH for iOS 1.4.2 was discovered to be missing an SSL certificate.CVE-2022-46496 · Other software · Bticino · reported by MITREMedium 5.9
BTicino Door Entry HOMETOUCH for iOS 1.4.2 was discovered to be missing an SSL certificate.
Product
Door Entry For Hometouch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record labs.integrity.pt labs.integrity.pt
Jan 9, 2023WPtouch: Unserialises the content of an imported settings fileCVE-2022-3417 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on the blog.
Product
WPtouch
Fixed in
4.3.45
What to do
Update WPtouch to 4.3.45 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jan 9, 2023WPtouch: Does not properly validate images to be uploadedCVE-2022-3416 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Product
WPtouch
Fixed in
4.3.45
What to do
Update WPtouch to 4.3.45 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 23, 2022AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network accessCVE-2022-23854 · Other software · AVEVA · reported by ics-cert@hq.dhs.govHigh 7.5
AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server.
Product
InTouch Access Anywhere
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record crisec.de aveva.com
Nov 23, 2022CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup.CVE-2022-45472 · Other software · Caehealthcare · reported by MITREMedium 5.4
CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup.
Product
Learningspace Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com caehealthcare.com
Nov 7, 2022ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a system crash by sendiCVE-2021-42205 · Other software · Lenovo · reported by MITREMedium 4.7
ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a system crash by sending a certain IOCTL request, because that request is handled twice.
Product
Elan Miniport Touchpad Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record emc.com.tw emc.com.tw
Oct 17, 2022WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-FilterinCVE-2022-3281 · Other software · WAGO · reported by info@cert.vde.comHigh 7.5
WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filtering after reboot. This may allow an remote attacker to circumvent the reach the network that should be protected by the MAC address filter.
Product
750-81xx/xxx-xxx Series PFC100/PFC200
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Sep 8, 2022UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo.CVE-2022-40297 · Other software · Ubports · reported by MITREHigh 7.8
UBports Ubuntu Touch 16.04 allows the screen-unlock passcode to be used for a privileged shell via Sudo. This passcode is only four digits, far below typical length/complexity for a user account's password. NOTE: a third party states "The described attack cannot be executed as demonstrated.
Product
Ubuntu Touch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 8, 2022mTouch Quiz: Does not sanitise and escape some of its settingsCVE-2022-2410 · WordPress plugins & themes · reported by WPScanMedium 4.8
The mTouch Quiz WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
mTouch Quiz
Affected
up to 3.1.3
What to do
Affects up to 3.1.3. Update mTouch Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.CVE-2022-27933 · Other software · Pexip · reported by MITREHigh 8.2
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
Product
Pexip Infinity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.pexip.com docs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.CVE-2022-27932 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
Product
Pexip Infinity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.pexip.com docs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.CVE-2022-26657 · Other software · Pexip · reported by MITREHigh 7.5
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.
Product
Pexip Infinity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.pexip.com docs.pexip.com
Jul 17, 2022Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.CVE-2022-26656 · Other software · Pexip · reported by MITREHigh 8.2
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.
Product
Pexip Infinity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.pexip.com docs.pexip.com
Jul 8, 2022In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation.CVE-2021-41037 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgCritical 10
In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoints during installation. Those touchpoints can, for example, alter the command-line used to start the application, injecting things like agent or other settings that usually require particular attention in term of security. Although p2 has built-in strategies to ensure artifacts are signed and then to help establish trust, there is no such strategy for the metadata part that does configure such touchpoints. As a result, it's possible to install a unit that will run malicious code during installation without user receiving any warning about this installation step being risky when coming from untrusted source.
Product
Eclipse Equinox p2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.eclipse.org github.com
Jun 2, 2022Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 allows attackers to execute arbitrary commands via a crafted HTTP request.CVE-2022-29735 · Other software · Deltacontrols · reported by MITREHigh 8.8
Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 allows attackers to execute arbitrary commands via a crafted HTTP request.
Product
Entelitouch Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record deltacontrols.com zeroscience.mk
Jun 2, 2022Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to transmit and store sensitive information in cleartext.CVE-2022-29733 · Other software · Deltacontrols · reported by MITREMedium 5.9
Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to transmit and store sensitive information in cleartext. This vulnerability allows attackers to intercept HTTP Cookie authentication credentials via a man-in-the-middle attack.
Product
Entelitouch Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record deltacontrols.com zeroscience.mk
Jun 2, 2022Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting (XSS) vulnerability via the Username parameter.CVE-2022-29732 · Other software · Deltacontrols · reported by MITREMedium 6.1
Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting (XSS) vulnerability via the Username parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Product
Entelitouch Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record deltacontrols.com zeroscience.mk
May 23, 2022Windows OS can be configured to overlay a “language bar” on top of any application.CVE-2022-1467 · Other software · AVEVA · reported by ics-cert@hq.dhs.govHigh 7.4
Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate the Windows OS language bar to launch an OS command prompt, resulting in a context-escape from application into OS.
Product
AVEVA InTouch Access Anywhere
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aveva.com cisa.gov
Mar 10, 2022Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local fileCVE-2022-25824 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview.
Product
BixbyTouch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Feb 24, 2022ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.CVE-2022-25098 · Other software · Ectouch · reported by MITRECritical 9.1
ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.
Product
Ectouch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 9, 2022A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manneCVE-2022-22809 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 5.3
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations. Affected Product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior)
Product
Spacelynk Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Jan 31, 2022Alps Alpine Touchpad Driver 10.3201.101.215 is vulnerable to DLL Injection.CVE-2021-27971 · Other software · Alpsalpine · reported by MITREHigh 7.8
Alps Alpine Touchpad Driver 10.3201.101.215 is vulnerable to DLL Injection.
Product
Touchpad Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 2, 2021An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android.CVE-2021-44518 · Other software · Digipas · reported by MITREMedium 6.8
An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android. The lock sends a pairing code before each operation (lock or unlock) activated via the companion app. The code is sent unencrypted, allowing any attacker with the same app (either Android or iOS) to add the lock and take complete control. For successful exploitation, the attacker must be able to touch the lock's power button, and must be able to capture BLE network communication.
Product
Egeetouch Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ashallen.net ashallen.net
Oct 6, 2021Improper authentication in InputManagerService prior to SMR Oct-2021 Release 1 allows monitoring the touch event.CVE-2021-25484 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Improper authentication in InputManagerService prior to SMR Oct-2021 Release 1 allows monitoring the touch event.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Oct 6, 2021In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free.CVE-2021-0684 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-179839665
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Sep 27, 2021The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device CVE-2021-22272 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.5
The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch remotely under very specific circumstances. The issue is fixed in the cloud side of the system. No firmware update is needed for customer products. If a user wants to understand if (s)he is affected, please read the advisory. This issue affects: ABB and Busch-Jaeger, ControlTouch
Product
mybuildings.abb.com
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record search.abb.com search.abb.com
Aug 5, 2021Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview.CVE-2021-25448 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview.
Product
Smart Touch Call
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 30, 2021SQL Injection Vulnerability in ECTouch v2 via the shop page in index.php..CVE-2020-21806 · Other software · Ectouch · reported by MITRECritical 9.8
SQL Injection Vulnerability in ECTouch v2 via the shop page in index.php..
Product
Ectouch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 14, 2021SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php.CVE-2020-18144 · Other software · Ectouch · reported by MITRECritical 9.8
SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php.
Product
Ectouch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 9, 2021The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user CVE-2021-32942 · Other software · AVEVA · reported by ics-cert@hq.dhs.govMedium 6.6
The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.
Product
InTouch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov aveva.com
Mar 10, 2021In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow.CVE-2021-0460 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-156739245
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Mar 10, 2021In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow.CVE-2021-0458 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In the FingerTipS touch screen driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-157156744
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com zerodayinitiative.com
Mar 10, 2021In the FingerTipS touch screen driver, there is a possible out of bounds write due to a heap buffer overflow.CVE-2021-0457 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In the FingerTipS touch screen driver, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-157155375
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com zerodayinitiative.com
Dec 25, 2020Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control.CVE-2020-25917 · Other software · Stratodesk · reported by MITREHigh 8.8
Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user with "helpdesk" privileges, can perform privileged operations including adding a new administrator to the platform via the easyadmin/user/submitCreateTCUser.do page.
Product
Notouch Center
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Dec 14, 2020In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check.CVE-2020-0465 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.8
In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-162844689References: Upstream kernel
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 2, 2020Uncontrolled Resource Consumption can be exploited to cause the Phoenix Contact HMIs BTP 2043W, BTP 2070W and BTP 2102W in all versions to become unresponsive aCVE-2020-12524 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 7.5
Uncontrolled Resource Consumption can be exploited to cause the Phoenix Contact HMIs BTP 2043W, BTP 2070W and BTP 2102W in all versions to become unresponsive and not accurately update the display content (Denial of Service).
Product
BTP Touch Panel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Nov 13, 2020Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack.CVE-2020-6157 · Computers, phones & browsers · Opera · reported by security@opera.comMedium 4.3
Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into showing an address of a different page. This may allow the malicious page to impersonate another page and trick a user into providing sensitive data.
Product
Opera Touch
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.opera.com security.opera.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.