Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
167 results · page 4 of 4
Jan 5, 2022An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.CVE-2021-45969 · Other software · Siemens · reported by MITREHigh 8.2
An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the CommBuffer+8 location).
- Product
- RUGGEDCOM APE1808 - BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Jan 5, 2022An issue was discovered in SdLegacySmm in Insyde InsydeH2O with kernel 5.1 before 05.15.11, 5.2 before 05.25.11, 5.3 before 05.34.11, and 5.4 before 05.42.11.CVE-2020-5956 · Other software · Insyde · reported by MITREHigh 7.5
An issue was discovered in SdLegacySmm in Insyde InsydeH2O with kernel 5.1 before 05.15.11, 5.2 before 05.25.11, 5.3 before 05.34.11, and 5.4 before 05.42.11. The software SMI handler allows untrusted external input because it does not verify CommBuffer.
- Product
- Insydeh2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.cominsyde.com
Nov 2, 2021An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets.CVE-2020-5955 · Other software · Insyde · reported by MITRECritical 9.8
An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets. A caller may be able to escalate privileges.
- Product
- Insydeh2o Uefi Bios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.netapp.cominsyde.com
Jun 16, 2021In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt CVE-2020-27339 · Other software · Siemens · reported by MITREMedium 6.7
In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt either the firmware or the OS memory. The fixed versions for this issue in the AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe, and SdMmcDeviceDxe drivers are 05.16.25, 05.26.25, 05.35.25, 05.43.25, and 05.51.25 (for Kernel 5.1 through 5.5).
- Product
- RUGGEDCOM APE1808 - BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comsecurity.netapp.com
Aug 26, 2019Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure viCVE-2019-12532 · Other software · Insyde · reported by MITREHigh 7.8
Improper access control in the Insyde software tools may allow an authenticated user to potentially enable escalation of privilege, or information disclosure via local access. This is a software vulnerability, not a firmware issue. Affected tools include: H2OFFT version 3.02~5.28, 100.00.00.00~100.00.08.23 and 200.00.00.01~200.00.00.05, H2OOAE before version 200.00.00.02, H2OSDE before version 200.00.00.07, H2OUVE before version 200.00.02.02, H2OPCM before version 100.00.06.00, H2OELV before version 100.00.02.08.
- Product
- H2oelv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeclypsium.comsecurity.netapp.com
Jun 26, 2018Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.CVE-2018-0608 · Other software · Kazuho Oku · reported by vultures@jpcert.or.jpCritical 9.8
Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.
- Product
- H2O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2018index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL.CVE-2018-11647 · Other software · Oauth2orize-fprm Project · reported by MITREMedium 6.1
index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL.
- Product
- Oauth2orize-fprm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2017H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.CVE-2017-10908 · Other software · Kazuho Oku · reported by vultures@jpcert.or.jpHigh 7.5
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.
- Product
- H2O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2017H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via unspecified vectors.CVE-2017-10872 · Other software · Kazuho Oku · reported by vultures@jpcert.or.jpMedium 6.5
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via unspecified vectors.
- Product
- H2O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2017Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.CVE-2017-10869 · Other software · Kazuho Oku · reported by vultures@jpcert.or.jpHigh 7.5
Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.
- Product
- H2O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2017H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.CVE-2017-10868 · Other software · Kazuho Oku · reported by vultures@jpcert.or.jpHigh 7.5
H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.
- Product
- H2O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2017Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other infoCVE-2016-7835 · Other software · Kazuho Oku · reported by vultures@jpcert.or.jpCritical 9.1
Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information.
- Product
- H2O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
May 12, 2017H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specifiers in a templateCVE-2016-4864 · Other software · Kazuho Oku · reported by vultures@jpcert.or.jpHigh 7.5
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.
- Product
- H2O
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2016lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of servicCVE-2016-4817 · Other software · Dena · reported by vultures@jpcert.or.jpHigh 7.5
lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet.
- Product
- H2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2016CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to injectCVE-2016-1133 · Other software · Dena · reported by vultures@jpcert.or.jpLow 3.7
CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI.
- Product
- H2o
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2015Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbiCVE-2015-5638 · Other software · Dena · reported by vultures@jpcert.or.jpMedium 4.3
Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL.
- Product
- H20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2014The H2O Human Harmony Organization (aka com.netpia.ha.theh2o) application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows maCVE-2014-6905 · Other software · H2o Human Harmony Organization Project · reported by cret@cert.orgMedium 5.4
The H2O Human Harmony Organization (aka com.netpia.ha.theh2o) application 1.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- H2o Human Harmony Organization
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.