Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

534new WordPress flaws this week

391,528entries in the database

3,383 results · page 44 of 68

Feb 23, 2021In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of theCVE-2021-26595 · Other software · Rangerstudio · reported by MITREMedium 5.3
In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, and the name of the DBMS, simply by view the result of the api-aa, called automatically upon a connection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Product
Directus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 23, 2021In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any control by the back end.CVE-2021-26594 · Other software · Rangerstudio · reported by MITREHigh 8.8
In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any control by the back end. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Product
Directus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 23, 2021In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}.CVE-2021-26593 · Other software · Rangerstudio · reported by MITREHigh 7.5
In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. For each call, they get in response a lot of information about the user (such as email address, first name, and last name) but also the secret for 2FA if one exists. This secret can be regenerated. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Product
Directus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 23, 2021Multiple buffer overflow vulnerabilities exist when LeviStudioU (Version 2019-09-21 and prior) processes project files.CVE-2020-16243 · Other software · We-con · reported by ics-cert@hq.dhs.govHigh 7.8
Multiple buffer overflow vulnerabilities exist when LeviStudioU (Version 2019-09-21 and prior) processes project files. Opening a specially crafted project file could allow an attacker to exploit and execute code under the privileges of the application.
Product
Levistudiou
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov
Feb 22, 2021Use after free issue in audio modules while removing and freeing objects during list iteration due to incorrect usage of macro in Snapdragon Compute, SnapdragonCVE-2020-11147 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Use after free issue in audio modules while removing and freeing objects during list iteration due to incorrect usage of macro in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile
Product
Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Feb 18, 2021Opencast is a free, open-source platform to support the management of educational audio and video content.CVE-2021-21318 · Other software · opencast · reported by GitHubMedium 5.4
Opencast is a free, open-source platform to support the management of educational audio and video content. In Opencast before version 9.2 there is a vulnerability in which publishing an episode with strict access rules will overwrite the currently set series access. This allows for an easy denial of access for all users without superuser privileges, effectively hiding the series. Access to series and series metadata on the search service (shown in media module and player) depends on the events published which are part of the series. Publishing an event will automatically publish a series and update access to it. Removing an event or republishing the event should do the same. Affected versions of Opencast may not update the series access or remove a published series if an event is being removed. On removal of an episode, this may lead to an access control list for series metadata with broader access rules than the merged access rules of all remaining events, or the series metadata still being available although all episodes of that series have been removed. This problem is fixed in Opencast 9.2.
Product
opencast
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 17, 2021Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing AgorCVE-2020-25605 · Other software · Agora · reported by MITREMedium 5.9
Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing Agora video call through observation of cleartext network traffic.
Product
Video Software Development KIT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.agora.io mcafee.com
Feb 9, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-27857 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11488.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-27856 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11434.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-27855 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11433.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17436 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11432.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17435 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11358.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17434 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ARW files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11357.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17433 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11356.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17432 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11335.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17431 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11333.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17430 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11332.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17429 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of CMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11337.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17428 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comLow 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of CMP files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11336.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17427 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11334.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17426 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of CR2 files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11230.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17425 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11259.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17424 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EZI files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11247.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17423 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of ARW files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11196.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17422 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comLow 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EPS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11195.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17421 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11194.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17420 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comLow 3.3
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-11193.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17419 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of NEF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11192.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 9, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922.CVE-2020-17418 · Other software · Foxit · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EZIX files. A crafted id in a channel element can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11197.
Product
Studio Photo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record foxitsoftware.com zerodayinitiative.com
Feb 5, 2021In Epson iProjection v2.30, the driver file (EMP_NSAU.sys) allows local users to cause a denial of service (BSOD) via crafted input to the virtual audio device CVE-2020-9014 · Other software · Epson · reported by MITREMedium 5.5
In Epson iProjection v2.30, the driver file (EMP_NSAU.sys) allows local users to cause a denial of service (BSOD) via crafted input to the virtual audio device driver with IOCTL 0x9C402402, 0x9C402406, or 0x9C40240A. \Device\EMPNSAUIO and \DosDevices\EMPNSAU are similarly affected.
Product
Iprojection
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record epson.com epson.com
Feb 2, 2021Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services.CVE-2021-21294 · Other software · http4s · reported by GitHubHigh 7.5
Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Http4s before versions 0.21.17, 0.22.0-M2, and 1.0.0-M14 have a vulnerability which can lead to a denial-of-service. Blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its selector pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an unbounded queue. Each connection allocates a socket handle, which drains a scarce OS resource. This can also confound higher level circuit breakers which work based on detecting failed connections. http4s provides a general "MaxActiveRequests" middleware mechanism for limiting open connections, but it is enforced inside the Blaze accept loop, after the connection is accepted and the socket opened. Thus, the limit only prevents the number of connections which can be simultaneously processed, not the number of connections which can be held open. In 0.21.17, 0.22.0-M2, and 1.0.0-M14, a new "maxConnections" property, with a default value of 1024, has been added to the `BlazeServerBuilder`. Setting the va
Product
http4s
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Feb 1, 2021AVideo Platform is an open-source Audio and Video platform.CVE-2021-21286 · Other software · WWBN · reported by GitHubHigh 7.7
AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the pass hash and the recoverPass hash.
Product
AVideo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record avideo.tube github.com
Jan 26, 2021Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.CVE-2021-3291 · Other software · Zen-cart · reported by MITREHigh 7.2
Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
Product
ZEN Cart
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jan 26, 2021jxbrowser in TI Code Composer Studio IDE 8.x through 10.x before 10.1.1 does not verify X.509 certificates for HTTPS.CVE-2021-3285 · Other software · TI · reported by MITREMedium 5.3
jxbrowser in TI Code Composer Studio IDE 8.x through 10.x before 10.1.1 does not verify X.509 certificates for HTTPS.
Product
Code Composer Studio Intgrated Development Environment
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sir.ext.ti.com sir.ext.ti.com
Jan 26, 2021PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!JPEGTransW+0x000000000000c7f4 via a cCVE-2021-26026 · Other software · Acdsee · reported by MITREHigh 7.8
PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!JPEGTransW+0x000000000000c7f4 via a crafted BMP image.
Product
Photo Studio 2021
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 26, 2021PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!zlibVersion+0x0000000000004e5e via a CVE-2021-26025 · Other software · Acdsee · reported by MITREHigh 7.8
PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!zlibVersion+0x0000000000004e5e via a crafted BMP image.
Product
Photo Studio 2021
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 21, 2021Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnCVE-2020-3691 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jan 21, 2021A possible double free or invalid memory access in audio driver while reading Speaker Protection parameters in Snapdragon Compute, Snapdragon Connectivity, SnapCVE-2020-11217 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
A possible double free or invalid memory access in audio driver while reading Speaker Protection parameters in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Product
Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jan 21, 2021Buffer Over-read in audio driver while using malloc management function due to not returning NULL for zero sized memory requirement in Snapdragon Auto, SnapdragCVE-2020-11136 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Buffer Over-read in audio driver while using malloc management function due to not returning NULL for zero sized memory requirement in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jan 19, 2021The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugCVE-2020-28707 · WordPress plugins & themes · reported by MITREMedium 6.1
The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_eventer function listens for any postMessage event. After a message event is sent to the application, this function sets the "e" variable as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval the data.method received from the postMessage. However, on a different website. JavaScript code can call window.open for the vulnerable WordPress instance and do a postMessage(msg,'*') for that object.
Product
Stockdio Historical Chart
Fixed in
2.8.1
What to do
Update Stockdio Historical Chart to 2.8.1 or newer.
Full record and what to do →NVD record jondow.eu wordpress.org
Jan 12, 2021ASP.NET Core and Visual Studio Denial of Service VulnerabilityCVE-2021-1723 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
ASP.NET Core and Visual Studio Denial of Service Vulnerability
Product
ASP.NET Core 3.1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com portal.msrc.microsoft.com
Jan 8, 2021Heap buffer overflow in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2021-21116 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Heap buffer overflow in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com crbug.com
Jan 8, 2021Use after free in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.CVE-2021-21114 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Product
Chrome
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com crbug.com
Jan 5, 2021FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables.CVE-2020-26046 · Other software · Thedaylightstudio · reported by MITREMedium 5.4
FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors.
Product
Fuel CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record getfuelcms.com github.com
Jan 5, 2021FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/.CVE-2020-26045 · Other software · Thedaylightstudio · reported by MITRECritical 9.8
FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Product
Fuel CMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record getfuelcms.com github.com
Dec 15, 2020In getRadioAccessFamily of PhoneInterfaceManager.java, there is a possible read of privileged data due to a missing permission check.CVE-2020-27032 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In getRadioAccessFamily of PhoneInterfaceManager.java, there is a possible read of privileged data due to a missing permission check. This could lead to local information disclosure of radio data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150857259
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 9, 2020Visual Studio Code Java Extension Pack Remote Code Execution VulnerabilityCVE-2020-17159 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability
Product
Visual Studio Code Language Support for Java Extension
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com portal.msrc.microsoft.com
Dec 9, 2020Visual Studio Remote Code Execution VulnerabilityCVE-2020-17156 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Remote Code Execution Vulnerability
Product
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com portal.msrc.microsoft.com
Dec 9, 2020Visual Studio Code Remote Code Execution VulnerabilityCVE-2020-17150 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code Remote Code Execution Vulnerability
Product
Visual Studio Code TS-Lint Extension
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com portal.msrc.microsoft.com
Dec 9, 2020Visual Studio Code Remote Development Extension Remote Code Execution VulnerabilityCVE-2020-17148 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
Product
Visual Studio Code Remote - SSH Extension
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com portal.msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.