Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,383 results · page 34 of 68
Aug 10, 2023EZ softmagic MP3 Audio Converter 2.7.3.700 was discovered to contain a buffer overflow.CVE-2023-37734 · Other software · Ezsoftmagic · reported by MITRECritical 9.8
EZ softmagic MP3 Audio Converter 2.7.3.700 was discovered to contain a buffer overflow.
- Product
- Mp3 Audio Converter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comexploit-db.com
Aug 8, 2023Microsoft .NET Core and Visual Studio Denial-of-Service VulnerabilityCVE-2023-38180 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.5
Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).
- Product
- .NET Core and Visual Studio
- On CISA’s list since
- Aug 9, 2023 (federal fix deadline Aug 30, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comlists.fedoraproject.org
Aug 8, 2023ASP.NET Core SignalR and Visual Studio Information Disclosure VulnerabilityCVE-2023-35391 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.2
ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023.NET Core and Visual Studio Denial of Service VulnerabilityCVE-2023-38178 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET Core and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023Visual Studio Tools for Office Runtime Spoofing VulnerabilityCVE-2023-36897 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Visual Studio Tools for Office Runtime Spoofing Vulnerability
- Product
- Microsoft 365 Apps for Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 8, 2023.NET and Visual Studio Remote Code Execution VulnerabilityCVE-2023-35390 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
.NET and Visual Studio Remote Code Execution Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
Aug 8, 2023Transient DOS in Audio while remapping channel buffer in media codec decoding.CVE-2023-28555 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS in Audio while remapping channel buffer in media codec decoding.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Aug 8, 2023Memory corruption while allocating memory in COmxApeDec module in Audio.CVE-2023-28537 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption while allocating memory in COmxApeDec module in Audio.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Aug 8, 2023Memory Corruption in Audio while playing amrwbplus clips with modified content.CVE-2023-22666 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory Corruption in Audio while playing amrwbplus clips with modified content.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Aug 8, 2023Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.CVE-2022-40510 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Aug 7, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla.CVE-2023-38045 · Other software · admiror-design-studio.com · reported by security@joomla.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements.
- Product
- Admiror Gallery component for Joomla
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordextensions.joomla.orgextensions.joomla.org
Aug 7, 2023In audio, there is a possible out of bounds write due to a missing bounds check.CVE-2023-20785 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.4
In audio, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628524; Issue ID: ALPS07628524.
- Product
- MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT8168, MT8781, MT8791, MT8797
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Aug 5, 2023Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.CVE-2023-4190 · Other software · admidio · reported by security@huntr.devMedium 6.5
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.2.11.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 4, 2023Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the bCVE-2023-33379 · Other software · connectedio · reported by MITRECritical 9.8
Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's devices.
- Product
- connected_io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comconnectedio.com
Aug 4, 2023Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling attackers to execute arbCVE-2023-33378 · Other software · Connectedio · reported by MITRECritical 9.8
Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices.
- Product
- Connected IO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comconnectedio.com
Aug 4, 2023Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers toCVE-2023-33377 · Other software · Connectedio · reported by MITRECritical 9.8
Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers to execute arbitrary OS commands on devices.
- Product
- Connected IO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comconnectedio.com
Aug 4, 2023Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execuCVE-2023-33376 · Other software · Connectedio · reported by MITRECritical 9.8
Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices.
- Product
- Connected IO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comconnectedio.com
Aug 4, 2023Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling attackers to take control over devices.CVE-2023-33375 · Other software · Connectedio · reported by MITRECritical 9.8
Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling attackers to take control over devices.
- Product
- Connected IO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comconnectedio.com
Aug 4, 2023Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices CVE-2023-33374 · Other software · Connectedio · reported by MITRECritical 9.8
Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices to execute. Attackers abusing this dangerous functionality may issue all devices OS commands to execute, resulting in arbitrary remote command execution.
- Product
- Connected IO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comconnectedio.com
Aug 4, 2023Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonateCVE-2023-33373 · Other software · connectedio · reported by MITRECritical 9.8
Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use them to impersonate the devices.
- Product
- connected_io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comconnectedio.com
Aug 4, 2023Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT.CVE-2023-33372 · Other software · Connectedio · reported by MITRECritical 9.8
Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT. An attacker who gained access to these credentials is able to connect to the MQTT broker and send messages on behalf of devices, impersonating them. in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.
- Product
- Connected IO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordclaroty.comconnectedio.com
Jul 27, 2023An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or CVE-2022-43703 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comHigh 7.8
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
- Product
- Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF),
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comintel.com
Jul 27, 2023When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to executCVE-2022-43702 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comHigh 7.8
When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify (or replace) the installer to execute malicious code.
- Product
- Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF),
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comintel.com
Jul 27, 2023When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause exeCVE-2022-43701 · Computers, phones & browsers · Arm Ltd · reported by arm-security@arm.comHigh 7.8
When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code.
- Product
- Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF),
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.arm.comintel.com
Jul 20, 2023Omnis Studio 10.22.00 has incorrect access control.CVE-2023-38335 · Other software · Omnis · reported by MITREMedium 5.3
Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private" - this is supposed to be an irreversible operation. However, due to implementation issues, "always private" Omnis libraries can be opened by the Omnis Studio browser by bypassing specific checks. This violates the expected behavior of an "irreversible operation".
- Product
- Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 20, 2023Omnis Studio 10.22.00 has incorrect access control.CVE-2023-38334 · Other software · Omnis · reported by MITREMedium 6.5
Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Omnis libraries: it should be no longer possible to delete, view, change, copy, rename, duplicate, or print a locked class. Due to implementation issues, locked classes in Omnis libraries can be unlocked, and thus further analyzed and modified by Omnis Studio. This allows for further analyzing and also deleting, viewing, changing, copying, renaming, duplicating, or printing previously locked Omnis classes. This violates the expected behavior of an "irreversible operation."
- Product
- Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 15, 2023Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10.CVE-2023-3692 · Other software · admidio · reported by security@huntr.devHigh 7.2
Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2023In startInput of AudioPolicyInterfaceImpl.cpp, there is a possible way of erroneously displaying the microphone privacy indicator due to a race condition.CVE-2023-21262 · Computers, phones & browsers · Google · reported by security@android.comLow 3.1
In startInput of AudioPolicyInterfaceImpl.cpp, there is a possible way of erroneously displaying the microphone privacy indicator due to a race condition. This could lead to false user expectations. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Jul 12, 2023In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a logic error in the cCVE-2023-20942 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In openMmapStream of AudioFlinger.cpp, there is a possible way to record audio without displaying the microphone privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Jul 11, 2023Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution VulnerabilityCVE-2023-36867 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability
- Product
- Visual Studio Code - GitHub Pull Requests and Issues Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023USB Audio Class System Driver Remote Code Execution VulnerabilityCVE-2023-35303 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
USB Audio Class System Driver Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023ASP.NET and Visual Studio Security Feature Bypass VulnerabilityCVE-2023-33170 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
ASP.NET and Visual Studio Security Feature Bypass Vulnerability
- Product
- Microsoft Visual Studio 2022 version 17.2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
Jul 11, 2023.NET and Visual Studio Elevation of Privilege VulnerabilityCVE-2023-33127 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
.NET and Visual Studio Elevation of Privilege Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Reservation.Studio Reservation.Studio widget plugin <= 1.0.11 versions.CVE-2023-25468 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Reservation.Studio Reservation.Studio widget plugin <= 1.0.11 versions.
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 6, 2023Use After Free (UAF) vulnerability in the audio PCM driver module under special conditions.CVE-2022-48511 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Use After Free (UAF) vulnerability in the audio PCM driver module under special conditions. Successful exploitation of this vulnerability may cause audio features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jul 5, 2023Improper access control in Audio system service prior to SMR Jul-2023 Release 1 allows attacker to send broadcast with system privilege.CVE-2023-30667 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Improper access control in Audio system service prior to SMR Jul-2023 Release 1 allows attacker to send broadcast with system privilege.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jul 4, 2023Memory Corruption in Audio while allocating the ion buffer during the music playback.CVE-2023-22667 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory Corruption in Audio while allocating the ion buffer during the music playback.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jul 4, 2023Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions.CVE-2023-21672 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jul 4, 2023Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.CVE-2023-21639 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jul 3, 2023File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigatiCVE-2020-22153 · Other software · Thedaylightstudio · reported by MITRECritical 9.8
File Upload vulnerability in FUEL-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted .php file to the upload parameter in the navigation function.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description CVE-2020-22152 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in daylight studio FUEL- CMS v.1.4.6 allows a remote attacker to execute arbitrary code via the page title, meta description and meta keywords of the pages function.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2023Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload fCVE-2020-22151 · Other software · Thedaylightstudio · reported by MITRECritical 9.8
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2023Radio Buttons for Taxonomies: Cross-Site Request ForgeryCVE-2020-36740 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Radio Buttons for Taxonomies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the save_single_term() function. This makes it possible for unauthenticated attackers to save terms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Radio Buttons for Taxonomies
- Affected
- up to 2.0.5
- What to do
- Affects up to 2.0.5. Update Radio Buttons for Taxonomies to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comblog.nintechnet.com
Jun 28, 2023In BuildGetRadioNode of protocolmiscbulider.cpp, there is a possible out of bounds read due to improper input validation.CVE-2023-21156 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In BuildGetRadioNode of protocolmiscbulider.cpp, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure from the modem with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-264540759References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 28, 2023In BuildSetRadioNode of protocolmiscbuilder.cpp, there is a possible out of bounds read due to a missing null check.CVE-2023-21155 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In BuildSetRadioNode of protocolmiscbuilder.cpp, there is a possible out of bounds read due to a missing null check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-264540700References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 27, 2023Accordion & FAQ: Does not escape various generated URLsCVE-2023-1891 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Accordion & FAQ WordPress plugin before 1.9.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting
- Product
- Accordion & FAQ
- Fixed in
- 1.9.9
- What to do
- Update Accordion & FAQ to 1.9.9 or newer.
Jun 23, 2023Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.CVE-2023-3304 · Other software · admidio · reported by security@huntr.devMedium 5.4
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.CVE-2023-3303 · Other software · admidio · reported by security@huntr.devLow 3.5
Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.CVE-2023-3302 · Other software · admidio · reported by security@huntr.devHigh 7.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.
- Product
- admidio/admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2023A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30.CVE-2023-25747 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below version 30. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox for Android < 110.1.0.
- Product
- Firefox for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.