Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

2,805 results · page 31 of 57

May 31, 2023A vulnerability was found in yiwent Vip Video Analysis 1.0 and classified as problematic.CVE-2023-3016 · Other software · yiwent · reported by VulDBLow 3.5
A vulnerability was found in yiwent Vip Video Analysis 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/admincore.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230360.
Product
Vip Video Analysis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
May 31, 2023A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical.CVE-2023-3015 · Other software · yiwent · reported by VulDBMedium 6.3
A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230359.
Product
Vip Video Analysis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
May 31, 2023A vulnerability, which was classified as problematic, was found in BeipyVideoResolution up to 2.6.CVE-2023-3014 · Other software · Beipyvideoresolution Project · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, was found in BeipyVideoResolution up to 2.6. Affected is an unknown function of the file admin/admincore.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230358 is the identifier assigned to this vulnerability.
Product
Beipyvideoresolution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
May 30, 2023Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device.CVE-2023-33741 · Other software · Macro-video · reported by MITREHigh 7.5
Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device.
Product
V380 Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 26, 2023The video framework has memory overwriting caused by addition overflow.CVE-2021-46886 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The video framework has memory overwriting caused by addition overflow.CVE-2021-46885 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The video framework has memory overwriting caused by addition overflow.CVE-2021-46884 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The video framework has memory overwriting caused by addition overflow.CVE-2021-46883 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The video framework has memory overwriting caused by addition overflow.CVE-2021-46882 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 26, 2023The video framework has memory overwriting caused by addition overflow.CVE-2021-46881 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 20, 2023The multimedia video module has a vulnerability in data processing.Successful exploitation of this vulnerability may affect availability.CVE-2023-1696 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The multimedia video module has a vulnerability in data processing.Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
May 19, 2023Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.CVE-2023-26818 · Other software · Telegram · reported by MITREMedium 5.5
Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record danrevah.github.io danrevah.github.io
May 16, 2023Videostream macOS app 0.5.0 and 0.4.3 has a Race Condition.CVE-2023-25394 · Other software · Getvideostream · reported by MITREHigh 7
Videostream macOS app 0.5.0 and 0.4.3 has a Race Condition. The Updater privileged script attempts to update Videostream every 5 hours.
Product
Videostream
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record danrevah.github.io getvideostream.com
May 16, 2023Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter.CVE-2023-31679 · Other software · Videogo Project · reported by MITREHigh 7.5
Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter.
Product
Videogo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 16, 2023Incorrect access control in Videogo v6.8.1 allows attackers to bind shared devices after the connection has been ended.CVE-2023-31678 · Other software · Videogo Project · reported by MITREMedium 5.3
Incorrect access control in Videogo v6.8.1 allows attackers to bind shared devices after the connection has been ended.
Product
Videogo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 15, 2023video carousel slider with lightbox: Reflected Cross-Site ScriptingCVE-2023-2710 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32797 may be a duplicate of this.
Product
video carousel slider with lightbox
Affected
up to 1.0.22
What to do
Affects up to 1.0.22. Update video carousel slider with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com plugins.trac.wordpress.org
May 15, 2023Video Gallery: Reflected Cross-Site ScriptingCVE-2023-2708 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32597 may be a duplicate of this.
Product
Video Gallery
Affected
up to 1.0.10
What to do
Affects up to 1.0.10. Update Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com plugins.trac.wordpress.org
May 12, 2023Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter.CVE-2022-48020 · Other software · Vinteo · reported by MITREMedium 6.1
Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter. This vulnerability allows attackers to inject arbitrary code which will be executed by the victim user's browser.
Product
Video Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seq.team seq.team
May 12, 2023WWBN AVideo is an open source video platform.CVE-2023-32073 · Other software · WWBN · reported by GitHubHigh 8.8
WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-30854, which affects WWBN AVideo up to version 12.3. This issue is patched in commit 1df4af01f80d56ff2c4c43b89d0bac151e7fb6e3.
Product
AVideo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 10, 2023VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.CVE-2023-32570 · Other software · Videolan · reported by MITREMedium 5.9
VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.
Product
Dav1d
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code.videolan.org code.videolan.org
May 9, 2023AV1 Video Extension Remote Code Execution VulnerabilityCVE-2023-29341 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
AV1 Video Extension Remote Code Execution Vulnerability
Product
AV1 Video Extension
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
May 9, 2023AV1 Video Extension Remote Code Execution VulnerabilityCVE-2023-29340 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
AV1 Video Extension Remote Code Execution Vulnerability
Product
AV1 Video Extension
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
May 9, 2023A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12CVE-2023-30899 · Other software · Siemens · reported by productcert@siemens.comCritical 9.9
A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Management Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.
Product
Siveillance Video 2020 R2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
May 9, 2023A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12CVE-2023-30898 · Other software · Siemens · reported by productcert@siemens.comCritical 9.9
A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3 HotfixRev12), Siveillance Video 2021 R1 (All versions < V21.1 HotfixRev12), Siveillance Video 2021 R2 (All versions < V21.2 HotfixRev8), Siveillance Video 2022 R1 (All versions < V22.1 HotfixRev7), Siveillance Video 2022 R2 (All versions < V22.2 HotfixRev5), Siveillance Video 2022 R3 (All versions < V22.3 HotfixRev2), Siveillance Video 2023 R1 (All versions < V23.1 HotfixRev1). The Event Server component of affected applications deserializes data without sufficient validations. This could allow an authenticated remote attacker to execute code on the affected system.
Product
Siveillance Video 2020 R2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
May 8, 2023WWBN AVideo is an open source video platform.CVE-2023-30860 · Other software · WWBN · reported by GitHubHigh 8
WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert malicious scripts. Since any USER including the ADMIN can see the meeting room that was created by the attacker this can lead to cookie hijacking and takeover of any accounts. Version 12.4 contains a patch for this issue.
Product
AVideo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com youtu.be
May 8, 2023Video List Manager: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-1408 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
Video List Manager
Affected
up to 1.7
What to do
Affects up to 1.7. Update Video List Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
May 4, 2023Improper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to CVE-2023-21485 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper export of android application components vulnerability in VideoPreviewActivity in Call Settings to SMR May-2023 Release 1 allows physical attackers to access some media data stored in sandbox.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Apr 28, 2023AVideo is an open source video platform.CVE-2023-30854 · Other software · WWBN · reported by GitHubHigh 8.8
AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CloneSite/cloneClient.json.php` allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4.
Product
AVideo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 25, 2023Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success paraCVE-2023-25314 · Other software · Wwbn · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information via the success parameter to /user.
Product
Avideo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 25, 2023OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to thCVE-2023-25313 · Other software · Wwbn · reported by MITRECritical 9.8
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the video link field to the Embed a video link feature.
Product
Avideo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 24, 2023Video Central for: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-0418 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Central for WordPress plugin through 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Video Central for
Affected
up to 1.3.0
What to do
Affects up to 1.3.0. Update Video Central for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 19, 2023Stargate-Bukkit is a mod for the minecraft video game which adds a portal focused environment.CVE-2021-43819 · Other software · stargate-bukkit · reported by GitHubHigh 7.5
Stargate-Bukkit is a mod for the minecraft video game which adds a portal focused environment. In affected versions Minecarts with chests will drop their items when teleporting through a portal; when they reappear, they will still have their items impacting the integrity of the game world. The teleport code has since been rewritten and is available in release `0.11.5.1`. Users are advised to upgrade. There are no known workarounds for this issue.
Product
Stargate-Bukkit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 17, 2023Nextcloud Talk is a chat, video & audio call extension for Nextcloud.CVE-2023-30540 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud Talk is a chat, video & audio call extension for Nextcloud. In affected versions a user that was added later to a conversation can use this information to get access to data that was deleted before they were added to the conversation. This issue has been patched in version 15.0.5 and it is recommended that users upgrad to 15.0.5. There are no known workarounds for this issue.
Product
security-advisories
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 15, 2023TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603.CVE-2022-37255 · Network & remote access · Tp-link · reported by MITREHigh 7.5
TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603.
Product
Tapo C310 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com tp-link.com
Apr 14, 2023mp4v2 v2.0.0 was discovered to contain a heap buffer overflow via the MP4GetVideoProfileLevel function at /src/mp4.cpp.CVE-2023-29584 · Other software · Mp4v2 Project · reported by MITREHigh 8.8
mp4v2 v2.0.0 was discovered to contain a heap buffer overflow via the MP4GetVideoProfileLevel function at /src/mp4.cpp.
Product
Mp4v2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 13, 2023Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback.CVE-2022-33282 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback.
Product
Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Mar 31, 2023Nextcloud talk is a video & audio conferencing app for Nextcloud.CVE-2023-28845 · Other software · nextcloud · reported by GitHubLow 3.5
Nextcloud talk is a video & audio conferencing app for Nextcloud. In affected versions the talk app does not properly filter access to a conversations member list. As a result an attacker could use this vulnerability to gain information about the members of a Talk conversation, even if they themselves are not members. It is recommended that the Nextcloud Talk is upgraded to 14.0.9 or 15.0.4. There are no known workarounds for this vulnerability.
Product
security-advisories
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 27, 2023pymedusa is an automatic video library manager for TV Shows.CVE-2023-28627 · Other software · pymedusa · reported by GitHubHigh 8.3
pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ > advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute arbitrary OS commands as the user running the pymedusa program. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
Medusa
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 27, 2023Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability.CVE-2023-28597 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 8.3
Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution.
Product
Zoom (for Android, iOS, Linux, macOS, and Windows)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Mar 27, 2023Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability.CVE-2023-28596 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.8
Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to privileges to root.
Product
Zoom Client for Meetings for IT Admin macOS installers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Mar 21, 2023Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pagCVE-2023-1532 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com chromereleases.googleblog.com
Mar 16, 2023Zoom Client for IT Admin Windows installers before version 5.13.5 contain a local privilege escalation vulnerability.CVE-2023-22883 · Other software · Zoom Video Communications Inc · reported by security@zoom.usHigh 7.2
Zoom Client for IT Admin Windows installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to the SYSTEM user.
Product
Zoom Client for Meetings for IT Admin Windows installers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Mar 16, 2023Zoom clients before version 5.13.5 contain a STUN parsing vulnerability.CVE-2023-22882 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 6.5
Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service.
Product
Zoom (for Android, iOS, Linux, macOS, and Windows) clients before version 5.13.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Mar 16, 2023Zoom clients before version 5.13.5 contain a STUN parsing vulnerability.CVE-2023-22881 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 6.5
Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service.
Product
Zoom (for Android, iOS, Linux, macOS, and Windows) clients before version 5.13.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Mar 16, 2023Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an iCVE-2023-22880 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 6.8
Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior.
Product
Zoom for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record explore.zoom.us explore.zoom.us
Mar 13, 2023The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video.CVE-2023-0349 · Other software · Akuvox · reported by ics-cert@hq.dhs.govHigh 7.5
The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video. This could allow an attacker to view and record image and video from the camera.
Product
E11
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Mar 13, 2023Video Background: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2022-4652 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Video Background WordPress plugin before 2.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Video Background
Fixed in
2.7.5
What to do
Update Video Background to 2.7.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 10, 2023Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.CVE-2022-40515 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.3
Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
Product
Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Mar 6, 2023 quickentity-editor-next is an open source, system local, video game asset editor.CVE-2023-27472 · Other software · atampy25 · reported by GitHubHigh 8.2
quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in entity names are not sanitised (XSS vulnerability). Allows arbitrary code execution within the browser sandbox, among other things, simply from loading a file containing a script tag in any entity name. This issue has been patched in version 1.28.1 of the application. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Product
quickentity-editor-next
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 27, 2023Nextcloud Talk is a fully on-premises audio/video and chat communication service.CVE-2023-26041 · Other software · nextcloud · reported by GitHubLow 2.6
Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages are not expired, the API would still return them while they were then hidden by the frontend code. It is recommended that the Nextcloud Talk is upgraded to 15.0.3. There are no workaround available.
Product
security-advisories
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.