Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,805 results · page 38 of 57
Apr 13, 2021Windows Media Video Decoder Remote Code Execution VulnerabilityCVE-2021-27095 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Media Video Decoder Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Ampache is a web based audio/video streaming application and file manager.CVE-2021-21399 · Other software · ampache · reported by GitHubCritical 9.1
Ampache is a web based audio/video streaming application and file manager. Versions prior to 4.4.1 allow unauthenticated access to Ampache using the subsonic API. To successfully make the attack you must use a username that is not part of the site to bypass the auth checks. For more details and workaround guidance see the referenced GitHub security advisory.
- Product
- ampache
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter the specific parameter.CVE-2021-28209 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Delete video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter.CVE-2021-28208 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Get video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter.CVE-2021-28206 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Record video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter.CVE-2021-28205 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Delete SOL video file function) does not filter the specific parameter. As obtaining the administrator permission, remote attackers can use the means of path traversal to access system files.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Remote video storage function) does not verify the string length entered by users, resulting iCVE-2021-28192 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Remote video storage function) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for ASMB9-iKVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2021The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resultCVE-2021-28181 · Network & remote access · ASUS · reported by twcert@cert.org.twMedium 4.9
The specific function in ASUS BMC’s firmware Web management page (Remote video configuration setting) does not verify the string length entered by users, resulting in a Buffer overflow vulnerability. As obtaining the privileged permission, remote attackers use the leakage to abnormally terminate the Web service.
- Product
- BMC firmware for Z10PR-D16
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2021Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including version 6.45.10 potentiallyCVE-2020-6790 · Other software · Bosch · reported by psirt@bosch.comHigh 7.8
Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including version 6.45.10 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious exe in the same directory where the installer is started from.
- Product
- Video Streaming Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Mar 25, 2021Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Client installer up to and including version 1.7.6.079 potentially allows an attackCVE-2020-6787 · Other software · Bosch · reported by psirt@bosch.comHigh 7.8
Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Client installer up to and including version 1.7.6.079 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same directory where the installer is started from.
- Product
- Video Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Mar 25, 2021Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to aCVE-2020-6786 · Other software · Bosch · reported by psirt@bosch.comHigh 7.8
Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to and including version 3.81.0064 for 3.81 and 3.71 and older potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same directory where the installer is started from.
- Product
- Video Recording Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Mar 17, 2021Buffer overflow can occur in video while playing the non-standard clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,CVE-2020-11299 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Buffer overflow can occur in video while playing the non-standard clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Mar 11, 2021HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2021-27062 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2021-27061 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2021-27051 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2021-27050 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2021-27049 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2021-27048 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2021-27047 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2021-26902 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2021-24110 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 11, 2021HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2021-24089 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 4, 2021Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupported format.CVE-2021-25345 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupported format.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Feb 26, 2021Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset CVE-2019-11684 · Other software · Bosch · reported by MITRECritical 9.9
Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.
- Product
- Video Recording Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Feb 25, 2021When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed informCVE-2021-23973 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.5
When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
Feb 22, 2021Arbitrary memory write issue in video driver while setting the internal buffers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon ConsCVE-2020-11253 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Arbitrary memory write issue in video driver while setting the internal buffers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Feb 18, 2021Opencast is a free, open-source platform to support the management of educational audio and video content.CVE-2021-21318 · Other software · opencast · reported by GitHubMedium 5.4
Opencast is a free, open-source platform to support the management of educational audio and video content. In Opencast before version 9.2 there is a vulnerability in which publishing an episode with strict access rules will overwrite the currently set series access. This allows for an easy denial of access for all users without superuser privileges, effectively hiding the series. Access to series and series metadata on the search service (shown in media module and player) depends on the events published which are part of the series. Publishing an event will automatically publish a series and update access to it. Removing an event or republishing the event should do the same. Affected versions of Opencast may not update the series access or remove a published series if an event is being removed. On removal of an episode, this may lead to an access control list for series metadata with broader access rules than the merged access rules of all remaining events, or the series metadata still being available although all episodes of that series have been removed. This problem is fixed in Opencast 9.2.
- Product
- opencast
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2021Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing AgorCVE-2020-25605 · Other software · Agora · reported by MITREMedium 5.9
Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing Agora video call through observation of cleartext network traffic.
- Product
- Video Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.agora.iomcafee.com
Feb 17, 2021A vulnerability of uPrism.io CURIX(Video conferecing solution) could allow an unauthenticated attacker to execute arbitrary code.CVE-2020-7849 · Other software · uPrism.io · reported by vuln@krcert.or.krHigh 8
A vulnerability of uPrism.io CURIX(Video conferecing solution) could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient input(server domain) validation. An attacker could exploit this vulnerability through crafted URL.
- Product
- CURIX 7.0 Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2021Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially crafted requestCVE-2021-20623 · Other software · Panasonic Corporation · reported by vultures@jpcert.or.jpCritical 9.8
Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially crafted request.
- Product
- Video Insight VMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2021Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell alloCVE-2020-8101 · Other software · ADT · reported by cve-requests@bitdefender.comMedium 6.9
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on the device. This issue affects: ADT LifeShield DIY HD Video Doorbell version 1.0.02R09 and prior versions.
- Product
- LifeShield DIY HD Video Doorbell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.bitdefender.comlabs.bitdefender.com
Feb 1, 2021AVideo Platform is an open-source Audio and Video platform.CVE-2021-21286 · Other software · WWBN · reported by GitHubHigh 7.7
AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the pass hash and the recoverPass hash.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021An issue was discovered in Apexis Streaming Video Web Application on Geeni GNC-CW013 doorbell 1.8.1 devices.CVE-2020-28999 · Other software · Mygeeni · reported by MITREHigh 7.2
An issue was discovered in Apexis Streaming Video Web Application on Geeni GNC-CW013 doorbell 1.8.1 devices. A remote attacker can take full control of the camera with a high-privileged account. The vulnerability exists because a static username and password are compiled into a shared library (libhipcam.so) used to provide the streaming camera service.
- Product
- Gnc-cw013 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsupport.mygeeni.com
Jan 21, 2021Buffer over read can happen in video driver when playing clip with atomsize having value UINT32_MAX in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectivCVE-2020-11216 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Buffer over read can happen in video driver when playing clip with atomsize having value UINT32_MAX in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 21, 2021Race condition occurs while calling user space ioctl from two different threads can results to use after free issue in video in Snapdragon Auto, Snapdragon CompCVE-2020-11151 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.4
Race condition occurs while calling user space ioctl from two different threads can results to use after free issue in video in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jan 19, 2021SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP fileCVE-2020-14410 · Other software · Libsdl · reported by MITREMedium 5.4
SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via a crafted .BMP file.
- Product
- Simple Directmedia Layer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.libsdl.orghg.libsdl.org
Jan 19, 2021SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a CVE-2020-14409 · Other software · Libsdl · reported by MITREHigh 7.8
SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SDL_blit_copy.c via a crafted .BMP file.
- Product
- Simple Directmedia Layer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.libsdl.orghg.libsdl.org
Jan 15, 2021Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authentCVE-2020-35748 · WordPress plugins & themes · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fv_wp_fvvideoplayer_src JSON field in the data parameter.
- Product
- Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player
- Fixed in
- 7.4.37.727
- What to do
- Update Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player to 7.4.37.727 or newer.
Full record and what to do →NVD recorddocs.google.comgithub.com
Jan 13, 2021A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attaCVE-2021-1131 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to cause an affected IP camera to reload. The vulnerability is due to missing checks when Cisco Discovery Protocol messages are processed. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected IP camera. A successful exploit could allow the attacker to cause the affected IP camera to reload unexpectedly, resulting in a denial of service (DoS) condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
- Product
- Cisco Video Surveillance 8000 Series IP Cameras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Jan 12, 2021Microsoft DTV-DVD Video Decoder Remote Code Execution VulnerabilityCVE-2021-1668 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft DTV-DVD Video Decoder Remote Code Execution Vulnerability
- Product
- Windows 10 Version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2021-1644 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2021-1643 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
HEVC Video Extensions Remote Code Execution Vulnerability
- Product
- HEVC Video Extensions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 8, 2021A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv fileCVE-2020-26664 · Other software · Videolan · reported by MITREHigh 7.8
A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
- Product
- VLC Media Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.githubusercontent.comlists.debian.org
Jan 7, 2021Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers.CVE-2020-26971 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Nov 18, 2020A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software could allow an unauthenticated, remote attacker toCVE-2020-3482 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software could allow an unauthenticated, remote attacker to bypass security controls and send network traffic to restricted destinations. The vulnerability is due to improper validation of specific connection information by the TURN server within the affected software. An attacker could exploit this issue by sending specially crafted network traffic to the affected software. A successful exploit could allow the attacker to send traffic through the affected software to destinations beyond the application, possibly allowing the attacker to gain unauthorized network access.
- Product
- Cisco TelePresence Video Communication Server (VCS) Expressway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Nov 17, 2020Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video stream.CVE-2020-27558 · Other software · Basetech · reported by MITREMedium 6.5
Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video stream.
- Product
- Ge-131 Bt-1837836 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfosec.rm-it.deinfosec.rm-it.de
Nov 17, 2020Unprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows local users to gain access to the video streaming usernaCVE-2020-27557 · Other software · Basetech · reported by MITREMedium 5.5
Unprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows local users to gain access to the video streaming username and password via SQLite files containing plain text credentials.
- Product
- Ge-131 Bt-1837836 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinfosec.rm-it.deinfosec.rm-it.de
Nov 16, 2020There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming.CVE-2020-23490 · Other software · Wwbn · reported by MITREHigh 7.5
There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming. An unauthenticated attacker can exploit this issue to read an arbitrary file on the server. Which could leak database credentials or other sensitive information such as /etc/passwd file.
- Product
- Avideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability.CVE-2020-23489 · Other software · Wwbn · reported by MITREHigh 8.8
The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, which leads to certain privilege checks not being in place, and therefore a user can escalate privileges to admin.
- Product
- Avideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2020u'Possible buffer overflow will occur in video while parsing mp4 clip with crafted esds atom size.' in Snapdragon Auto, Snapdragon Compute, Snapdragon IndustriaCVE-2020-11184 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
u'Possible buffer overflow will occur in video while parsing mp4 clip with crafted esds atom size.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile in QCM4290, QCS4290, QM215, QSM8350, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SDX55, SDX55M, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6250, SM6350, SM7125, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR2130, SXR2130P
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.