Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
272 results · page 4 of 6
Dec 28, 2023 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.CVE-2023-23428 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Low 3.3
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.CVE-2023-23427 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by file writing vulnerability, successful exploitation could cause information disclosure.CVE-2023-23426 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 6.6
Some Honor products are affected by file writing vulnerability, successful exploitation could cause information disclosure.
- Product
- FRI-AN00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution CVE-2023-23424 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 6.5
Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution
- Product
- NTH-AN00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct systemCVE-2023-23436 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4High 7.3
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct systemCVE-2023-23435 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file
- Product
- Magic OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.CVE-2023-23434 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
- Product
- HonorBoardApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct systemCVE-2023-23433 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4Medium 4
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
- Product
- NTH-AN00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct systemCVE-2023-23432 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4High 7.3
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
- Product
- NTH-AN00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 28, 2023 Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct systemCVE-2023-23431 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4High 7.3
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.
- Product
- NTH-AN00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhihonor.comhihonor.com
Dec 14, 2023Hono is a web framework written in TypeScript.CVE-2023-50710 · Other software · honojs · reported by GitHubMedium 4.2
Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRouter is used either explicitly or when the application matches a pattern that is not supported by the default RegExpRouter. Version 3.11.7 includes the change to fix this issue. As a workaround, avoid using TrieRouter directly.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 9, 2023Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.CVE-2023-5551 · Other software · Moodle · reported by patrick@puiterwijk.orgLow 3.3
Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Oct 30, 2023An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via crafted Move and MoveWithOnoff commands.CVE-2023-45956 · Other software · govee · reported by MITREHigh 7.5
An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via crafted Move and MoveWithOnoff commands.
- Product
- led_strip_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team CVE-2023-27266 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.7
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the /api/v4/users/me/teams API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Feb 27, 2023Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team aCVE-2023-27265 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comLow 2.7
Mattermost fails to honor the ShowEmailAddress setting when constructing a response to the "Regenerate Invite Id" API endpoint, allowing an attacker with team admin privileges to learn the team owner's email address in the response.
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Dec 29, 2022Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and CVE-2022-38212 · Other software · Esri · reported by psirt@esri.comHigh 7.5
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38203.
- Product
- ArcGIS Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and CVE-2022-38211 · Other software · Esri · reported by psirt@esri.comHigh 7.5
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
- Product
- ArcGIS Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 29, 2022Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and CVE-2022-38203 · Other software · Esri · reported by psirt@esri.comHigh 7.5
Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
- Product
- Portal for ArcGIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022MaxQueryDuration not honoured in Samba AD DC LDAPCVE-2021-3670 · Other software · Samba · reported by Red HatMedium 6.5
MaxQueryDuration not honoured in Samba AD DC LDAP
- Product
- Samba
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.samba.org
Oct 8, 2021Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily withCVE-2021-41564 · Other software · Tad · reported by twcert@cert.org.twMedium 5.3
Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily without logging in.
- Product
- Tad Honor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Oct 4, 2021In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.CVE-2021-39874 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 4.3
In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.CVE-2021-38373 · Other software · KDE · reported by MITREMedium 5.3
In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authentication" is checked.
- Product
- Kmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.kde.orgnostarttls.secvuln.info
Jun 8, 2021In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.CVE-2020-26136 · Other software · Silverstripe · reported by MITREMedium 6.5
In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.
- Product
- Silverstripe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.silverstripe.orgsilverstripe.org
Jan 14, 2021The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when iCVE-2020-27220 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgHigh 8.8
The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configured giving permission for the gateway device to act on its behalf. This means an authenticated device of a certain tenant, notably also a non-gateway device acting like a gateway, may receive command & control messages targeted at a different device of the same tenant without corresponding permissions getting checked.
- Product
- Eclipse Hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.eclipse.orgbugs.eclipse.org
Jan 7, 2021NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidia.ko) in which it does not completely honor operatingCVE-2021-1056 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 7.1
NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidia.ko) in which it does not completely honor operating system file system permissions to provide GPU device-level isolation, which may lead to denial of service or information disclosure.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgnvidia.custhelp.com
Dec 29, 2020There is a denial of service vulnerability in some Huawei smartphones.CVE-2020-9223 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a denial of service vulnerability in some Huawei smartphones. Due to the improper processing of received abnormal messages, remote attackers may exploit this vulnerability to cause a denial of service (DoS) on the specific module.
- Product
- Honor 20 Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2020There is a buffer overflow vulnerability in several Huawei products.CVE-2020-9247 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain configuration parameter which is passed from user that would cause buffer overflow. The attacker should trick the user into installing and running a malicious application with a high privilege, successful exploit may cause code execution. Affected product include Huawei HONOR 20 PRO, Mate 20, Mate 20 Pro, Mate 20 X, P30, P30 Pro, Hima-L29C, Laya-AL00EP, Princeton-AL10B, Tony-AL00B, Yale-L61A, Yale-TL00B and YaleP-AL10B.
- Product
- HONOR 20 PRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2020In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices.CVE-2020-27217 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgHigh 7.5
In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated during link establishment. While the AMQP 1.0 protocol explicitly disallows a peer to send such messages, a hand crafted AMQP 1.0 client could exploit this behavior in order to send a message of unlimited size to the adapter, eventually causing the adapter to fail with an out of memory exception.
- Product
- Eclipse Hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.eclipse.orgbugs.eclipse.org
Sep 10, 2020node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the liCVE-2020-15168 · Other software · node-fetch · reported by GitHubLow 2.6
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
- Product
- node-fetch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2020Huawei smartphones HONOR 20 PRO Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C185E3CVE-2020-9235 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Huawei smartphones HONOR 20 PRO Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C185E3R5P1),Versions earlier than 10.1.0.231(C636E3R3P1);Versions earlier than 10.1.0.212(C432E10R3P4),Versions earlier than 10.1.0.213(C636E3R4P3),Versions earlier than 10.1.0.214(C10E5R4P3),Versions earlier than 10.1.0.214(C185E3R3P3);Versions earlier than 10.1.0.212(C00E210R5P1);Versions earlier than 10.1.0.160(C00E160R2P11);Versions earlier than 10.1.0.160(C00E160R2P11);Versions earlier than 10.1.0.160(C01E160R2P11);Versions earlier than 10.1.0.160(C00E160R2P11);Versions earlier than 10.1.0.160(C00E160R8P12);Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2),Versions earlier than 10.1.0.231(C636E3R3P1);Versions earlier than 10.1.0.225(C431E3R1P2),Versions earlier than 10.1.0.225(C432E3R1P2) contain an information vulnerability. A module has a design error that is lack of control of input. Attackers can exploit this vulnerability to obtain some information. This can lead to information leak.
- Product
- Honor 20 Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2020Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection.CVE-2020-17367 · Other software · Firejail Project · reported by MITREHigh 7.8
Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection.
- Product
- Firejail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orggithub.com
Jul 17, 2020Huawei Honor V30 smartphones with versions earlier than 10.1.0.212(C00E210R5P1) have an improper authentication vulnerability.CVE-2020-9259 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Huawei Honor V30 smartphones with versions earlier than 10.1.0.212(C00E210R5P1) have an improper authentication vulnerability. The system does not sufficiently validate certain parameter passed from the bottom level, the attacker should trick the user into installing a malicious application and control the bottom level, successful exploit could cause information disclosure.
- Product
- Honor V30
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2020Huawei Honor 10 smartphones with versions earlier than 10.0.0.178(C00E178R1P4) have a denial of service vulnerability.CVE-2020-9255 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Huawei Honor 10 smartphones with versions earlier than 10.0.0.178(C00E178R1P4) have a denial of service vulnerability. Certain service in the system does not sufficiently validate certain parameter which is received, the attacker should trick the user into installing a malicious application, successful exploit could cause a denial of service condition.
- Product
- Honor 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2020In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memoryCVE-2020-14152 · Other software · IJG · reported by MITREHigh 7.1
In IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.
- Product
- Libjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordijg.orgbugs.gentoo.org
Jun 8, 2020It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profilCVE-2020-10754 · Other software · [Red Hat] · reported by Red HatMedium 4.3
It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and the connection is made insecurely.
- Product
- NetworkManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.fedoraproject.org
Jun 5, 2020Huawei Smartphones HONOR 20 PRO;Honor View 20;HONOR 20 have an improper handling of exceptional condition Vulnerability.CVE-2020-9074 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Huawei Smartphones HONOR 20 PRO;Honor View 20;HONOR 20 have an improper handling of exceptional condition Vulnerability. A component cannot deal with an exception correctly. Attackers can exploit this vulnerability by sending malformed message. This could compromise normal service of affected phones.
- Product
- Honor 20 Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2020Honor 9X smartphones with versions earlier than 9.1.1.172(C00E170R8P1) have an improper authentication vulnerability.CVE-2020-1833 · Other software · Huawei · reported by psirt@huawei.comLow 2.4
Honor 9X smartphones with versions earlier than 9.1.1.172(C00E170R8P1) have an improper authentication vulnerability. A logic error occurs when handling clock function, an attacker should do a series of crafted operations quickly before the phone is unlocked, successful exploit could allow the attacker to access clock information without unlock the phone.
- Product
- Honor 9X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2020Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 smartphones with versions earlier than 10.0.0.187(C00E60R4P11); versCVE-2020-1808 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 smartphones with versions earlier than 10.0.0.187(C00E60R4P11); versions earlier than 10.0.0.187(C00E60R4P11); versions earlier than 10.0.0.176(C00E60R2P11);9.1.0.135(C00E133R2P1); versions earlier than 10.1.0.123(C431E22R3P5), versions earlier than 10.1.0.126(C636E5R3P4), versions earlier than 10.1.0.160(C00E160R2P11); versions earlier than 10.1.0.126(C185E8R5P1), versions earlier than 10.1.0.126(C636E9R2P4), versions earlier than 10.1.0.160(C00E160R2P8); versions earlier than 10.0.0.179(C636E3R4P3), versions earlier than 10.0.0.180(C185E3R3P3), versions earlier than 10.0.0.180(C432E10R3P4), versions earlier than 10.0.0.181(C675E5R1P2) have an out of bound read vulnerability. The software reads data past the end of the intended buffer. The attacker tricks the user into installing a crafted application, successful exploit may cause information disclosure or service abnormal.
- Product
- Honor View 20 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2020Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities.CVE-2020-1806 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities. Certain driver program does not sufficiently validate certain parameters received, that would lead to several bytes out of bound read. Successful exploit may cause information disclosure or service abnormal. This is 3 out of 3 out of bounds vulnerabilities found. Different than CVE-2020-1804 and CVE-2020-1805.
- Product
- Honor V10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2020Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities.CVE-2020-1805 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities. Certain driver program does not sufficiently validate certain parameters received, that would lead to several bytes out of bound read. Successful exploit may cause information disclosure or service abnormal. This is 2 out of 3 out of bounds vulnerabilities found. Different than CVE-2020-1804 and CVE-2020-1806.
- Product
- Honor V10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2020Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities.CVE-2020-1804 · Other software · Huawei · reported by psirt@huawei.comHigh 7.1
Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities. Certain driver program does not sufficiently validate certain parameters received, that would lead to several bytes out of bound read. Successful exploit may cause information disclosure or service abnormal. This is 1 out of 3 out of bounds vulnerabilities found. Different than CVE-2020-1805 and CVE-2020-1806.
- Product
- Honor V10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2020Huawei smartphones Honor V20 with versions earlier than 10.0.0.179(C636E3R4P3),versions earlier than 10.0.0.180(C185E3R3P3),versions earlier than 10.0.0.180(C43CVE-2020-1803 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Huawei smartphones Honor V20 with versions earlier than 10.0.0.179(C636E3R4P3),versions earlier than 10.0.0.180(C185E3R3P3),versions earlier than 10.0.0.180(C432E10R3P4) have an information disclosure vulnerability. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, successful exploit could cause information disclosure.
- Product
- Honor V20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2020A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored.CVE-2019-14887 · Other software · Red Hat · reported by Red HatCritical 9.1
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.
- Product
- wildfly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comissues.redhat.com
Mar 12, 2020Huawei smartphone Honor V30 with versions earlier than OxfordS-AN00A 10.0.1.167(C00E166R4P1) have an improper authentication vulnerability.CVE-2020-9064 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Huawei smartphone Honor V30 with versions earlier than OxfordS-AN00A 10.0.1.167(C00E166R4P1) have an improper authentication vulnerability. Authentication to target component is improper when device performs an operation. Attackers exploit this vulnerability to obtain some information by loading malicious application, leading to information leak.
- Product
- Honor V30
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2020Honor V10 smartphones with versions earlier than BKL-AL20 10.0.0.156(C00E156R2P4) and versions earlier than BKL-L09 10.0.0.146(C432E4R1P4) have an out of boundsCVE-2020-1792 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Honor V10 smartphones with versions earlier than BKL-AL20 10.0.0.156(C00E156R2P4) and versions earlier than BKL-L09 10.0.0.146(C432E4R1P4) have an out of bounds write vulnerability. The software writes data past the end of the intended buffer because of insufficient validation of certain parameter when initializing certain driver program. An attacker could trick the user into installing a malicious application, successful exploit could cause the device to reboot.
- Product
- Honor V10 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2020Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability.CVE-2020-1788 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability. Certain applications do not properly validate the identity of another application who would call its interface. An attacker could trick the user into installing a malicious application. Successful exploit could allow unauthorized actions leading to information disclosure.
- Product
- Honor V30 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2020Huawei Honor Magic2 mobile phones with versions earlier than 10.0.0.175(C00E59R2P11) have an information leak vulnerability.CVE-2020-1826 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
Huawei Honor Magic2 mobile phones with versions earlier than 10.0.0.175(C00E59R2P11) have an information leak vulnerability. Due to a module using weak encryption tool, an attacker with the root permission may exploit the vulnerability to obtain some information.
- Product
- Honor Magic2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2020Mate 10 Pro;Honor V10;Honor 10;Nova 4 smartphones have a denial of service vulnerability.CVE-2020-1785 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Mate 10 Pro;Honor V10;Honor 10;Nova 4 smartphones have a denial of service vulnerability. The system does not properly check the status of certain module during certain operations, an attacker should trick the user into installing a malicious application, successful exploit could cause reboot of the smartphone.
- Product
- Mate 10 Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2019cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the systemCVE-2012-6094 · Other software · cups · reported by Red HatCritical 9.8
cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system
- Product
- cups
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Dec 13, 2019There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro).CVE-2019-5252 · Other software · Huawei · reported by psirt@huawei.comLow 3.5
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
- Product
- Enjoy 8 Plus Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.