Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,383 results · page 39 of 68
Aug 9, 2022Visual Studio Remote Code Execution VulnerabilityCVE-2022-35826 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Visual Studio Remote Code Execution VulnerabilityCVE-2022-35825 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-35806 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-35779 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Visual Studio Remote Code Execution VulnerabilityCVE-2022-35777 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-35773 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022.NET Spoofing VulnerabilityCVE-2022-34716 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.9
.NET Spoofing Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-34687 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Information Disclosure VulnerabilityCVE-2022-34686 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Azure RTOS GUIX Studio Information Disclosure Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Information Disclosure VulnerabilityCVE-2022-34685 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Azure RTOS GUIX Studio Information Disclosure Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-30176 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 9, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-30175 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Aug 1, 2022In audio ipi, there is a possible memory corruption due to a race condition.CVE-2022-21789 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.4
In audio ipi, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06478101; Issue ID: ALPS06478101.
- Product
- MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6889, MT6891, MT6893, MT6895, MT6983, MT6985, MT8791, MT8797, MT8798
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Jul 28, 2022WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnCVE-2016-0796 · WordPress plugins & themes · reported by Red HatHigh 7.5
WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vulnerabilities because it fails to properly verify user-supplied input. An attacker may leverage these issues to hide attacks directed at a target site from behind vulnerable website or to perform otherwise restricted actions and subsequently download files with the extension mp3, mp4a, wav and ogg from anywhere the web server application has read access to the system. WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files version 1.7.6 is vulnerable; prior versions may also be affected.
- Affected
- up to 1.7.6
- What to do
- Affects up to 1.7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comacunetix.com
Jul 28, 2022Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station before 6.5.4-3367 allCVE-2022-27611 · Network & remote access · Synology · reported by security@synology.comMedium 5.4
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Audio Station before 6.5.4-3367 allows remote authenticated users to delete arbitrary files via unspecified vectors.
- Product
- Audio Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Jul 28, 2022Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4-3367 allows remote CVE-2022-27612 · Network & remote access · Synology · reported by security@synology.comHigh 7.3
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio Station before 6.5.4-3367 allows remote attackers to execute arbitrary commands via unspecified vectors.
- Product
- Audio Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Jul 21, 2022Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.CVE-2022-33198 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 17, 2022An issue was discovered in Poly Studio before 3.7.0.CVE-2022-26481 · Other software · Poly · reported by MITREHigh 8.8
An issue was discovered in Poly Studio before 3.7.0. Command Injection can occur via the CN field of a Create Certificate Signing Request (CSR) action.
- Product
- Studio X30 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec-consult.compoly.com
Jul 14, 2022An attacker with root account privileges can load any legitimately signed firmware image into the Audio Co-Processor (ACP,) irrespective of the respective signiCVE-2021-26382 · Other software · AMD · reported by psirt@amd.comMedium 4.4
An attacker with root account privileges can load any legitimately signed firmware image into the Audio Co-Processor (ACP,) irrespective of the respective signing key being declared as usable for authenticating an ACP firmware image, potentially resulting in a denial of service.
- Product
- Ryzen™ Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 11, 2022core plugin for kitestudio: Does not sanitise and escape some parameters before outputting them back in a response of an AJAX actionCVE-2022-1951 · WordPress plugins & themes · reported by WPScanMedium 6.1
The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting.
- Product
- core plugin for kitestudio
- Fixed in
- 2.3.1
- What to do
- Update core plugin for kitestudio to 2.3.1 or newer.
Jul 10, 2022The longmaoteamtf/audio_aligner_app repository through 2020-01-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafelyCVE-2022-31577 · Other software · Audio Aligner App Project · reported by MITRECritical 9.3
The longmaoteamtf/audio_aligner_app repository through 2020-01-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Audio Aligner App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2022The SummaLabs/DLS repository through 0.1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31525 · Other software · Deep Learning Studio Project · reported by MITRECritical 9.3
The SummaLabs/DLS repository through 0.1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Deep Learning Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2022In audio DSP, there is a possible out of bounds write due to a missing bounds check.CVE-2022-21787 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In audio DSP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558844; Issue ID: ALPS06558844.
- Product
- MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT6893, MT6895, MT6983, MT8791, MT8797, MT8798
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Jul 6, 2022In audio DSP, there is a possible memory corruption due to improper casting.CVE-2022-21786 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In audio DSP, there is a possible memory corruption due to improper casting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558822; Issue ID: ALPS06558822.
- Product
- MT6833, MT6853, MT6873, MT6877, MT6879, MT6885, MT6893, MT6895, MT6983, MT8791, MT8797, MT8798
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Jul 3, 2022Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 sCVE-2022-34151 · Other software · OMRON Corporation · reported by vultures@jpcert.or.jpHigh 8.1
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.
- Product
- Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2022Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controCVE-2022-33971 · Other software · OMRON Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can analyze the communication between the controller and the specific software used by OMRON internally to cause a denial-of-service (DoS) condition or execute a malicious program.
- Product
- Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2022Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controCVE-2022-33208 · Other software · OMRON Corporation · reported by vultures@jpcert.or.jpHigh 8.1
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who can analyze the communication between the affected controller and automation software 'Sysmac Studio' and/or a Programmable Terminal (PT) to access the controller.
- Product
- Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).CVE-2022-23896 · Other software · Admidio · reported by MITREMedium 5.4
Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).
- Product
- Admidio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2022.NET and Visual Studio Information Disclosure VulnerabilityCVE-2022-30184 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
.NET and Visual Studio Information Disclosure Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
Jun 15, 2022Azure RTOS GUIX Studio Information Disclosure VulnerabilityCVE-2022-30180 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Information Disclosure Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 15, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-30179 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 15, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-30178 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure Real Time Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 15, 2022Azure RTOS GUIX Studio Remote Code Execution VulnerabilityCVE-2022-30177 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- Product
- Azure RTOS GUIX Studio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 14, 2022SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x.CVE-2022-29615 · Network & remote access · SAP SE · reported by cna@sap.comLow 3.4
SAP NetWeaver Developer Studio (NWDS) - version 7.50, is based on Eclipse, which contains the logging framework log4j in version 1.x. The application's confidentiality and integrity could have a low impact due to the vulnerabilities associated with version 1.x.
- Product
- SAP NetWeaver Developer Studio (NWDS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 14, 2022Memory corruption in audio due to use after free while managing buffers from internal cache in Snapdragon Compute, Snapdragon Connectivity, Snapdragon MobileCVE-2022-22090 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption in audio due to use after free while managing buffers from internal cache in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
- Product
- Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 14, 2022Memory corruption when extracting qcp audio file due to lack of check on data length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdragonCVE-2022-22084 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Memory corruption when extracting qcp audio file due to lack of check on data length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 14, 2022Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SCVE-2021-35104 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 12, 2022A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /inCVE-2021-41750 · Other software · Nystudio107 · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.
- Product
- Seomatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2022In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remoCVE-2021-41749 · Other software · Nystudio107 · reported by MITRECritical 9.8
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
- Product
- Seomatic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2022A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4.CVE-2021-44117 · Other software · Thedaylightstudio · reported by MITREHigh 8.8
A Cross Site Request Forgery (CSRF) vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgetfuelcms.com
May 17, 2022Nextcloud Talk is a video and audio conferencing app for Nextcloud.CVE-2022-24890 · Other software · nextcloud · reported by GitHubLow 2.4
Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moderator can indirectly enable user webcams by granting permissions, if they were enabled before removing the permissions. A patch is available in versions 13.0.5 and 14.0.0. There are currently no known workarounds.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands viaCVE-2021-23267 · Other software · Crafter Software · reported by security@craftersoftware.comHigh 7.6
Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods.
- Product
- Crafter CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.craftercms.orgdocs.craftercms.org
May 13, 2022The audio module has a vulnerability in verifying the parameters passed by the application space.Successful exploitation of this vulnerability may cause out-of-CVE-2021-46786 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The audio module has a vulnerability in verifying the parameters passed by the application space.Successful exploitation of this vulnerability may cause out-of-bounds memory access.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 11, 2022A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU.CVE-2021-3611 · Other software · Qemu · reported by Red HatMedium 6.5
A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgitlab.com
May 10, 2022Visual Studio Code Remote Code Execution VulnerabilityCVE-2022-30129 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Visual Studio Code Remote Code Execution Vulnerability
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comblog.sonarsource.com
May 10, 2022Visual Studio Remote Code Execution VulnerabilityCVE-2022-29148 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
- Product
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
May 10, 2022.NET and Visual Studio Denial of Service VulnerabilityCVE-2022-29145 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
May 10, 2022.NET and Visual Studio Denial of Service VulnerabilityCVE-2022-29117 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- .NET 6.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
May 10, 2022.NET and Visual Studio Denial of Service VulnerabilityCVE-2022-23267 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
.NET and Visual Studio Denial of Service Vulnerability
- Product
- .NET Core 3.1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comlists.fedoraproject.org
May 3, 2022A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stoCVE-2022-28599 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 that allows an authenticated user to upload a malicious .pdf file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger a XSS attack.
- Product
- Fuel CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.