Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
756 results · page 4 of 16
Jun 6, 2023Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-basCVE-2023-0666 · Other software · Wireshark Foundation · reported by cve@takeonme.orgMedium 6.5
Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark.
- Product
- Wireshark
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.comsecurity.gentoo.org
Apr 21, 2023There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number ofCVE-2023-30798 · Other software · Encode · reported by VulnCheckHigh 7.5
There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
- Product
- Starlette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023SmartPTT SCADA 1.1.0.0 allows remote code execution (when the attacker has administrator privileges) by writing a malicious C# script and executing it on the seCVE-2023-30459 · Other software · Smartptt · reported by MITREHigh 7.2
SmartPTT SCADA 1.1.0.0 allows remote code execution (when the attacker has administrator privileges) by writing a malicious C# script and executing it on the server (via server settings in the administrator control panel on port 8101, by default).
- Product
- Smartptt Scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsmartptt.com
Apr 12, 2023Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackerCVE-2023-30524 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them.
- Product
- Jenkins Report Portal Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Apr 12, 2023Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its confCVE-2023-30523 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
- Product
- Jenkins Report Portal Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 27, 2023Some smartphones have configuration issues.CVE-2022-48353 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which results in system service exceptions.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Mar 27, 2023Some smartphones have data initialization issues.CVE-2022-48352 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Some smartphones have data initialization issues. Successful exploitation of this vulnerability may cause a system panic.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 27, 2023ShortPixel Adaptive Images: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-0334 · WordPress plugins & themes · reported by WPScanMedium 6.1
The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin
- Product
- ShortPixel Adaptive Images
- Fixed in
- 3.6.3
- What to do
- Update ShortPixel Adaptive Images to 3.6.3 or newer.
Feb 11, 2023Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Group Arge Energy and Control Systems Smartpower Web allowCVE-2022-4557 · Other software · Group Arge Energy and Control Systems · reported by iletisim@usom.gov.trCritical 9.8
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01.
- Product
- Smartpower Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 11, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Group Arge Energy and Control Systems Smartpower Web allowCVE-2022-45091 · Other software · Group Arge Energy and Control Systems · reported by iletisim@usom.gov.trMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows Cross-Site Scripting (XSS). This issue affects Smartpower Web: before 23.01.01.
- Product
- Smartpower Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 11, 2023Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection.CVE-2022-45090 · Other software · Group Arge Energy and Control Systems · reported by iletisim@usom.gov.trHigh 8.8
Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01.
- Product
- Smartpower Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 11, 2023Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection.CVE-2022-45089 · Other software · Group Arge Energy and Control Systems · reported by iletisim@usom.gov.trHigh 8.8
Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01.
- Product
- Smartpower Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 11, 2023Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows PHP Local File Inclusion.CVE-2022-45088 · Other software · Group Arge Energy and Control Systems · reported by iletisim@usom.gov.trCritical 9.8
Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows PHP Local File Inclusion. This issue affects Smartpower Web: before 23.01.01.
- Product
- Smartpower Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 11, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Group Arge Energy and Control Systems Smartpower Web allowCVE-2022-45087 · Other software · Group Arge Energy and Control Systems · reported by iletisim@usom.gov.trMedium 6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows Cross-Site Scripting (XSS). This issue affects Smartpower Web: before 23.01.01.
- Product
- Smartpower Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 11, 2023Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Group Arge Energy and Control Systems Smartpower Web allowCVE-2022-45086 · Other software · Group Arge Energy and Control Systems · reported by iletisim@usom.gov.trMedium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows Cross-Site Scripting (XSS). This issue affects Smartpower Web: before 23.01.01.
- Product
- Smartpower Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Feb 11, 2023Server-Side Request Forgery (SSRF) vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery.CVE-2022-45085 · Other software · Group Arge Energy and Control Systems · reported by iletisim@usom.gov.trMedium 6.5
Server-Side Request Forgery (SSRF) vulnerability in Group Arge Energy and Control Systems Smartpower Web allows : Server Side Request Forgery. This issue affects Smartpower Web: before 23.01.01.
- Product
- Smartpower Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Dec 23, 2022PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, CVE-2022-23547 · Other software · pjsip · reported by GitHubMedium 6.5
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. This issue is similar to GHSA-9pfh-r8x4-w26w. Possible buffer overread when parsing a certain STUN message. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as commit in the master branch.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2022Some smartphones have the input validation vulnerability.CVE-2022-46328 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Some smartphones have the input validation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 20, 2022Some smartphones have configuration issues.CVE-2022-46327 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause privilege escalation, which results in system service exceptions.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 20, 2022Some smartphones have the out-of-bounds write vulnerability.CVE-2022-46326 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 20, 2022Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptions.CVE-2022-46325 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptions.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 20, 2022Some smartphones have the out-of-bounds write vulnerability.CVE-2022-46324 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 20, 2022Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptions.CVE-2022-46323 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptions.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 20, 2022Some smartphones have the out-of-bounds write vulnerability.CVE-2022-46322 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 20, 2022Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed.CVE-2022-41590 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed. Successful exploitation of this vulnerability affects the smartphone availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Dec 20, 2022PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, CVE-2022-23537 · Other software · pjsip · reported by GitHubMedium 6.5
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch (2.13.1).
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2022In MiscService::DoOemSetRtpPktlossThreshold of miscservice.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2022-42515 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In MiscService::DoOemSetRtpPktlossThreshold of miscservice.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-241763503References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 2, 2022Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the setSmartPowerManagement function.CVE-2022-45661 · Network & remote access · Tendacn · reported by MITREHigh 7.5
Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the setSmartPowerManagement function.
- Product
- Ac6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022Tasmota before commit 066878da4d4762a9b6cb169fdf353e804d735cfd was discovered to contain a stack overflow via the ClientPortPtr parameter at lib/libesp32/rtsp/CCVE-2022-43294 · Other software · Tasmota Project · reported by MITRECritical 9.8
Tasmota before commit 066878da4d4762a9b6cb169fdf353e804d735cfd was discovered to contain a stack overflow via the ClientPortPtr parameter at lib/libesp32/rtsp/CRtspSession.cpp.
- Product
- Tasmota
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.CVE-2022-43107 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.
- Product
- Ac23 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2022 The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocolsCVE-2022-41627 · Other software · AliveCor · reported by ics-cert@hq.dhs.govMedium 4.8
The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encryption for its data-over-sound protocols. Exploiting this vulnerability could allow an attacker to read patient EKG results or create a denial-of-service condition by emitting sounds at similar frequencies as the device, disrupting the smartphone microphone’s ability to accurately read the data. To carry out this attack, the attacker must be close (less than 5 feet) to pick up and emit sound waves.
- Product
- KardiaMobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function setSmartPowerManagement with the request /goform/PowerSaveSetCVE-2022-40864 · Network & remote access · Tendacn · reported by MITRECritical 9.8
Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function setSmartPowerManagement with the request /goform/PowerSaveSet
- Product
- Ac15 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: setSmartPowerManagement.CVE-2022-40072 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: setSmartPowerManagement.
- Product
- Ac21 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file.CVE-2022-1115 · Other software · Imagemagick · reported by Red HatMedium 5.5
A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered when an attacker passes a specially crafted TIFF image file to ImageMagick for conversion, potentially leading to a denial of service.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Aug 25, 2022Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the time parameter at the function setSmartPowerManagement.CVE-2022-37799 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AC1206 V15.03.06.23 was discovered to contain a stack overflow via the time parameter at the function setSmartPowerManagement.
- Product
- Ac1206 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, CVE-2022-31031 · Other software · pjsip · reported by GitHubCritical 9.8
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their applications, either by: setting a STUN server in their account/media config in PJSUA/PJSUA2 level, or directly using `pjlib-util/stun_simple` API. A patch is available in commit 450baca which should be included in the next release. There are no known workarounds for this issue.
- Product
- pjproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization.CVE-2021-43938 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govHigh 8.1
Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization.
- Product
- SmartPTT SCADA Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provCVE-2021-43937 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govHigh 7.6
Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
- Product
- SmartPTT SCADA Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired CVE-2021-43939 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govHigh 8.8
Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints.
- Product
- SmartPTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload CVE-2021-43934 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govCritical 9.8
Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially upload arbitrary files.
- Product
- SmartPTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main pCVE-2021-43932 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govCritical 9
Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page.
- Product
- SmartPTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traveCVE-2021-43930 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govMedium 4.9
Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path traversal attacks and potentially download arbitrary files from the system.
- Product
- SmartPTT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at: Plugin Settings UpdateCVE-2022-29417 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at WordPress allows an attacker with a low user role like a subscriber or higher to change the plugin settings.
- Product
- ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at
- Affected
- up to 3.3.1
- What to do
- Affects up to 3.3.1. Update ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 20, 2022gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box.CVE-2022-29537 · Other software · Gpac · reported by MITREMedium 5.5
gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box.
- Product
- Gpac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2022Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow in the setSmartPowerManagement function.CVE-2022-26243 · Network & remote access · Tendacn · reported by MITREHigh 7.5
Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow in the setSmartPowerManagement function.
- Product
- Ac10 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnoob3xploiter.medium.comnoob3xploiter.medium.com
Feb 25, 2022TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.CVE-2022-25060 · Network & remote access · Tp-link · reported by MITRECritical 9.8
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing.
- Product
- Tl-wr840n Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeast-trowel-102.notion.siteeast-trowel-102.notion.site
Feb 25, 2022Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-service condition on the system.CVE-2022-0615 · Other software · ESET, spol. s r.o. · reported by security@eset.comMedium 5.9
Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-service condition on the system.
- Product
- Endpoint Antivirus for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.eset.comsupport.eset.com
Feb 25, 2022There is a DoS vulnerability in smartphones.CVE-2021-37027 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Feb 25, 2022There is a DoS vulnerability in smartphones.CVE-2021-22489 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service availability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 25, 2022There is an improper verification vulnerability in smartphones.CVE-2021-22448 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
There is an improper verification vulnerability in smartphones. Successful exploitation of this vulnerability may cause unauthorized read and write of some files.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.