Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,805 results · page 35 of 57
Apr 25, 2022Videos sync PDF: Does not validate the p parameter before using it in an include statementCVE-2022-1392 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include statement, which could lead to Local File Inclusion issues
- Product
- Videos sync PDF
- Affected
- up to 1.7.4
- What to do
- Affects up to 1.7.4. Update Videos sync PDF to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
Apr 15, 2022HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-24532 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 6, 2022Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) couldCVE-2022-20755 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Apr 6, 2022Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) couldCVE-2022-20754 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities, see the Details section of this advisory.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Apr 6, 2022OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" parameterCVE-2022-27107 · Other software · Orangehrm · reported by MITREMedium 5.4
OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" parameter
- Product
- Orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the logiCVE-2022-27463 · Other software · Wwbn · reported by MITREMedium 6.1
Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.
- Product
- Avideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2022Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/includCVE-2022-27462 · Other software · Wwbn · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php.
- Product
- Avideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022Seyeon Tech Co., Ltd FlexWATCH FW3170-PS-E Network Video System 4.23-3000_GY allows attackers to access sensitive information.CVE-2022-25584 · Other software · Flexwatch · reported by MITREHigh 7.5
Seyeon Tech Co., Ltd FlexWATCH FW3170-PS-E Network Video System 4.23-3000_GY allows attackers to access sensitive information.
- Product
- Fw3170-ps-e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022FV Flowplayer Video Player: Authenticated Persistent Cross-Site Scripting (XSS)CVE-2022-25613 · WordPress plugins & themes · reported by PatchstackMedium 4.1
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.
- Product
- FV Flowplayer Video Player
- Affected
- up to 7.5.18.727
- What to do
- Affects up to 7.5.18.727. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 4, 2022Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to login as root users viCVE-2022-25569 · Other software · Bettinivideo · reported by MITRECritical 9.8
Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to login as root users via extracting a key from the software.
- Product
- Sgsetup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandreabruschi.netandreabruschi.net
Apr 1, 2022There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions.CVE-2021-33657 · Other software · Libsdl · reported by securities@openeuler.orgHigh 8.8
There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple DirectMedia Layer) 2.x to 2.0.18 versions. By crafting a malicious .BMP file, an attacker can cause the application using this library to crash, denial of service or Code execution.
- Product
- Simple Directmedia Layer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Mar 28, 2022NUUO v03.11.00 was discovered to contain access control issue.CVE-2022-25521 · Other software · Nuuo · reported by MITRECritical 9.8
NUUO v03.11.00 was discovered to contain access control issue.
- Product
- Network Video Recorder Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2022Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to injectCVE-2022-25609 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with contributor or higher user role to inject the malicious code.
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 23, 2022Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to trick authenticated users into unwanted sliCVE-2022-25608 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to trick authenticated users into unwanted slider duplicate or delete action.
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 18, 2022Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727)CVE-2022-25607 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727).
- Affected
- up to 7.5.15.727
- What to do
- Affects up to 7.5.15.727. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Mar 16, 2022There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos.CVE-2021-45787 · Other software · Maccms · reported by MITREMedium 5.4
There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name and remarks.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022In video decoder, there is a possible out of bounds write due to a missing bounds check.CVE-2022-20048 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 7.8
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05917502; Issue ID: ALPS05917502.
- Product
- MT5816, MT5835, MT6885, MT6893, MT9900, MT9901, MT9950, MT9969, MT9970, MT9980
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Mar 10, 2022In video decoder, there is a possible out of bounds write due to a missing bounds check.CVE-2022-20047 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comHigh 7.8
In video decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05917489; Issue ID: ALPS05917489.
- Product
- MT5816, MT5835, MT6885, MT6893, MT9900, MT9901, MT9950, MT9969, MT9970, MT9980
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Mar 10, 2022There is an improper access control vulnerability in the video module.CVE-2021-40063 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an improper access control vulnerability in the video module. Successful exploitation of this vulnerability may affect confidentiality.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Mar 10, 2022There is a vulnerability of copying input buffer without checking its size in the video framework.CVE-2021-40062 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a vulnerability of copying input buffer without checking its size in the video framework. Successful exploitation of this vulnerability may affect availability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Mar 10, 2022There is a heap-based buffer overflow vulnerability in the video framework.CVE-2021-40060 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a heap-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Mar 10, 2022There is a heap-based buffer overflow vulnerability in the video framework.CVE-2021-40058 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a heap-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Mar 10, 2022There is a heap-based and stack-based buffer overflow vulnerability in the video framework.CVE-2021-40057 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a heap-based and stack-based buffer overflow vulnerability in the video framework. Successful exploitation of this vulnerability may affect availability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Mar 10, 2022There is a vulnerability of copying input buffer without checking its size in the video framework.CVE-2021-40056 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a vulnerability of copying input buffer without checking its size in the video framework. Successful exploitation of this vulnerability may affect availability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Mar 10, 2022There is an incorrect buffer size calculation vulnerability in the video framework.Successful exploitation of this vulnerability may affect availability.CVE-2021-40052 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an incorrect buffer size calculation vulnerability in the video framework.Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Mar 10, 2022There is an incorrect buffer size calculation vulnerability in the video framework.CVE-2021-40048 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an incorrect buffer size calculation vulnerability in the video framework. Successful exploitation of this vulnerability will affect availability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Mar 9, 2022VP9 Video Extensions Remote Code Execution VulnerabilityCVE-2022-24501 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
VP9 Video Extensions Remote Code Execution Vulnerability
- Product
- VP9 Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-24456 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-24453 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-24452 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022VP9 Video Extensions Remote Code Execution VulnerabilityCVE-2022-24451 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
VP9 Video Extensions Remote Code Execution Vulnerability
- Product
- VP9 Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-23301 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-22007 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 9, 2022HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-22006 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 7, 2022Video Conferencing with Zoom: Does not have authorisation in its vczapi_get_wp_users AJAX actionCVE-2022-0384 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog
- Product
- Video Conferencing with Zoom
- Fixed in
- 3.8.17
- What to do
- Update Video Conferencing with Zoom to 3.8.17 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 24, 2022Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow a video replay attack after ARP cache poisoning has been achieved.CVE-2021-39363 · Other software · Honeywell · reported by MITRECritical 9.8
Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow a video replay attack after ARP cache poisoning has been achieved.
- Product
- Hdzp252di Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbuildings.honeywell.combuildings.honeywell.com
Feb 14, 2022K-Box is a web-based application to manage documents, images, videos and geodata.CVE-2022-23637 · Other software · k-box · reported by GitHubMedium 6.1
K-Box is a web-based application to manage documents, images, videos and geodata. Prior to version 0.33.1, a stored Cross-Site-Scripting (XSS) vulnerability is present in the markdown editor used by the document abstract and markdown file preview. A specifically crafted anchor link can, if clicked, execute untrusted javascript actions, like retrieving user cookies. Version 0.33.1 includes a patch that allows discarding unsafe links.
- Product
- k-box
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files without permission.CVE-2022-24927 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4.2
Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files without permission.
- Product
- Samsung Video Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Feb 11, 2022In startVideoStream() there is a possibility of an OOB Read in the heap, when the camera buffer is ‘zero’ in size.Product: AndroidVersions: Android-11Android IDCVE-2021-39677 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In startVideoStream() there is a possibility of an OOB Read in the heap, when the camera buffer is ‘zero’ in size.Product: AndroidVersions: Android-11Android ID: A-205097028
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 9, 2022The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS befoCVE-2022-22780 · Other software · Zoom Video Communications Inc · reported by security@zoom.usMedium 4.7
The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before version 5.6.3. This could lead to availability issues on the client host by exhausting system resources.
- Product
- Zoom Client for Meetings for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Feb 9, 2022The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user.CVE-2022-22779 · Other software · Zoom Video Communications Inc · reported by security@zoom.usLow 3.7
The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a non-chat feature and places the host in a sleep state before the sending user explodes the messages. This could lead to disclosure of sensitive information which was meant to be deleted from a user’s filesystem.
- Product
- Keybase Client for macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexplore.zoom.usexplore.zoom.us
Feb 9, 2022VP9 Video Extensions Remote Code Execution VulnerabilityCVE-2022-22709 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
VP9 Video Extensions Remote Code Execution Vulnerability
- Product
- VP9 Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 9, 2022HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-21927 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 9, 2022HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-21926 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 9, 2022HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-21844 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jan 28, 2022HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3.CVE-2021-23863 · Other software · Bosch · reported by psirt@bosch.comMedium 6.1
HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. or earlier, when successfully exploited allows an attacker to inject random HTML code into a component loaded by WebView, thus allowing the Application to display web resources controlled by the attacker.
- Product
- Video Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jan 14, 2022Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop.CVE-2021-36199 · Other software · Johnson Controls · reported by productsecurity@jci.comMedium 5.3
Running a vulnerability scanner against VideoEdge NVRs can cause some functionality to stop.
- Product
- VideoEdge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govjohnsoncontrols.com
Jan 14, 2022A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebook View application.CVE-2021-24046 · Other software · Meta Platforms, Inc · reported by cve-assign@fb.comMedium 5.3
A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebook View application. This issue affected versions of device software before 2107460.6810.0.
- Product
- Ray-Ban® Stories Smart Glasses
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comfacebook.com
Jan 11, 2022HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-21917 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comgithub.com
Jan 10, 2022A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function, which allows attackers to possibly haCVE-2021-36412 · Other software · Gpac · reported by MITREHigh 7.8
A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function, which allows attackers to possibly have unspecified other impact via a crafted file in the MP4Box command,
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.