Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,781exploited flaws on CISA’s list

35added in the last 30 days

406new WordPress flaws this week

399,168entries in the database

25,502 results · page 432 of 511

Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, existing checks in place on partition size are incompCVE-2018-5861 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, existing checks in place on partition size are incomplete and can lead to heap overwrite vulnerabilities while loading a secure application from the boot loader.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, due to a race condition, a Use After Free condition cCVE-2018-5856 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, due to a race condition, a Use After Free condition can occur in Audio.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org source.codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a partition name-check variable is not reset for everCVE-2018-11995 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a partition name-check variable is not reset for every iteration which may cause improper termination in the META image.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper mounting lead to device node and executable CVE-2018-11956 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper mounting lead to device node and executable to be run from /dsp/ which presents a potential security issue.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, the UPnP daemon should not be running out of box becaCVE-2018-11946 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comMedium 6.5
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, the UPnP daemon should not be running out of box because it enables port forwarding without authentication.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing fastboot flash command, memory leak CVE-2018-11943 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing fastboot flash command, memory leak or unexpected behavior may occur due to processing of unintialized data buffers.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a potential heap overflow and memory corruptCVE-2018-11919 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a potential heap overflow and memory corruption due to improper error handling in SOC infrastructure.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org source.codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, memory allocated is automatically released by the kerCVE-2018-11918 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, memory allocated is automatically released by the kernel if the 'probe' function fails with an error code.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and eCVE-2018-11914 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and executable to be run from /systemrw/ which presents a potential security.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org source.codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of dev nodes may lead to potenCVE-2018-11913 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of dev nodes may lead to potential security issue.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org source.codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of daemons may lead to unpriviCVE-2018-11912 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of daemons may lead to unprivileged access.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of script may lead to unprivilCVE-2018-11911 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper configuration of script may lead to unprivileged access.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and eCVE-2018-11910 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and executable to be run from /persist/ which presents a potential issue.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and eCVE-2018-11909 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and executable to be run from /cache/ which presents a potential issue.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and eCVE-2018-11908 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and executable to be run from /data/ which presents a potential issue.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and eCVE-2018-11907 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper access control can lead to device node and executable to be run from /firmware/ which presents a potential issue.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a security concern with default privileged aCVE-2018-11906 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a security concern with default privileged access to ADB and debug-fs.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org source.codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, freeing device memory in driver probe failure will reCVE-2018-11823 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, freeing device memory in driver probe failure will result in double free issue in power module.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper input validation can lead to an improper accCVE-2018-11266 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper input validation can lead to an improper access to already freed up dci client entries while closing dci client.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org source.codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible Use-after-free issue in Media CodCVE-2018-11261 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, there is a possible Use-after-free issue in Media Codec process. Any application using codec service will be affected.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org source.codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a fast Initial link setup (FILS) conCVE-2018-11260 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a fast Initial link setup (FILS) connection request, integer overflow may lead to a buffer overflow when the key length is zero.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com source.codeaurora.org
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the boot image header, an out of bouCVE-2017-11078 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the boot image header, an out of bounds read can occur in boot.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Nov 26, 2018A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal).CVE-2018-16862 · Other software · [UNKNOWN] · reported by Red HatMedium 5.3
A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.
Product
kernel:
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.redhat.com
Nov 26, 2018The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netliCVE-2018-14646 · Other software · [UNKNOWN] · reported by Red HatMedium 5.5
The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file. A local attacker could exploit this when a net namespace with a netnsid is assigned to cause a kernel panic and a denial of service.
Product
kernel:
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Nov 21, 2018In Novell NetWare before 6.5 SP8, a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon in PKERNEL.NLM allowed remote unauthentCVE-2009-5153 · Other software · Microfocus · reported by MITRECritical 9.8
In Novell NetWare before 6.5 SP8, a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon in PKERNEL.NLM allowed remote unauthenticated attackers to execute code, because a length field was incorrectly trusted.
Product
Netware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.suse.com download.novell.com
Nov 20, 2018The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereferenceCVE-2018-19407 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com lists.debian.org
Nov 20, 2018kvm_pv_send_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) viCVE-2018-19406 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
kvm_pv_send_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where the apic map is uninitialized.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com lkml.org
Nov 20, 2018DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel image because filesystem loading is mishandled.CVE-2018-18440 · Other software · Denx · reported by MITREHigh 7.8
DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel image because filesystem loading is mishandled.
Product
U-boot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com cert-portal.siemens.com
Nov 17, 2018pkg/sentry/kernel/shm/shm.go in Google gVisor before 2018-11-01 allows attackers to overwrite memory locations in processes running as root (but not escape the CVE-2018-19333 · Computers, phones & browsers · Google · reported by MITRECritical 9.8
pkg/sentry/kernel/shm/shm.go in Google gVisor before 2018-11-01 allows attackers to overwrite memory locations in processes running as root (but not escape the sandbox) via vectors involving IPC_RMID shmctl calls, because reference counting is mishandled.
Product
Gvisor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com justi.cz
Nov 16, 2018In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user naCVE-2018-18955 · Computers, phones & browsers · Linux · reported by MITREHigh 7
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org securityfocus.com
Nov 13, 2018An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka "Win32k Information Disclosure VulnerabilitCVE-2018-8565 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka "Win32k Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Product
Windows 7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com portal.msrc.microsoft.com
Nov 13, 2018A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerability." This affects CVE-2018-8549 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.
Product
Windows 10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Nov 13, 2018An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel Information Disclosure VulnCVE-2018-8408 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Product
Windows 7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Nov 13, 2018An information disclosure vulnerability exists when "Kernel Remote Procedure Call Provider" driver improperly initializes objects in memory, aka "MSRPC InformatCVE-2018-8407 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
An information disclosure vulnerability exists when "Kernel Remote Procedure Call Provider" driver improperly initializes objects in memory, aka "MSRPC Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
Product
Windows 7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Oct 30, 2018Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks.CVE-2018-18281 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com openwall.com
Oct 29, 2018An issue was discovered in the Linux kernel through 4.19.CVE-2018-18710 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org securityfocus.com
Oct 26, 2018In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount byCVE-2018-18690 · Computers, phones & browsers · Linux · reported by MITREMedium 5.5
In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE operations with conversion of an attr from short to long form.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org securityfocus.com
Oct 26, 2018The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access vCVE-2018-6559 · Other software · Canonical Ltd. · reported by security@ubuntu.comLow 3.3
The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access via an overlayfs mount inside of a user namespace.
Product
Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com launchpad.net
Oct 25, 2018The Linux kernel, as used in Ubuntu 18.10 and when booted with UEFI Secure Boot enabled, allows privileged local users to bypass intended Secure Boot restrictioCVE-2018-18653 · Other software · Canonical · reported by MITREHigh 7.8
The Linux kernel, as used in Ubuntu 18.10 and when booted with UEFI Secure Boot enabled, allows privileged local users to bypass intended Secure Boot restrictions and execute untrusted code by loading arbitrary kernel modules. This occurs because a modified kernel/module.c, in conjunction with certain configuration options, leads to mishandling of the result of signature verification.
Product
Ubuntu Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.net usn.ubuntu.com
Oct 22, 2018In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket.CVE-2018-18559 · Computers, phones & browsers · Linux · reported by MITREHigh 8.1
In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com access.redhat.com
Oct 17, 2018drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudCVE-2018-18386 · Computers, phones & browsers · Linux · reported by MITRELow 3.3
drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org access.redhat.com
Oct 17, 2018In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds meCVE-2018-18445 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org access.redhat.com
Oct 16, 2018Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel).CVE-2018-3274 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.7
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with network access via SMB to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 5.7 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).
Product
Solaris Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Oct 16, 2018Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel Zones Virtualized NIC Driver).CVE-2018-3272 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.2
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel Zones Virtualized NIC Driver). The supported version that is affected is 11.3. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 6.2 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Product
Solaris Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Oct 16, 2018Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel Zones).CVE-2018-3271 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel Zones). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. While the vulnerability is in Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Solaris. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H).
Product
Solaris Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Oct 16, 2018Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel).CVE-2018-3270 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 1.8
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 1.8 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L).
Product
Solaris Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Oct 16, 2018Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel).CVE-2018-3264 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.4
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Solaris. CVSS 3.0 Base Score 4.4 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Product
Solaris Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Oct 16, 2018Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel).CVE-2018-2922 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 2.5
Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Solaris accessible data. CVSS 3.0 Base Score 2.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
Product
Solaris Operating System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com securityfocus.com
Oct 16, 2018kernel/omap/drivers/mfd/twl6030-gpadc.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via CVE-2018-11025 · Other software · Amazon · reported by MITREHigh 7.5
kernel/omap/drivers/mfd/twl6030-gpadc.c in the kernel component in Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/twl6030-gpadc with the command 24832 and cause a kernel crash.
Product
Fire OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 16, 2018kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argumentCVE-2018-11024 · Other software · Amazon · reported by MITREHigh 7.5
kernel/omap/drivers/misc/gcx/gcioctl/gcif.c in the kernel component in Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 allows attackers to inject a crafted argument via the argument of an ioctl on device /dev/gcioctl with the command 1077435789 and cause a kernel crash.
Product
Fire OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.