Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,599 results · page 5 of 52
Feb 6, 2025Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.CVE-2024-57959 · Other software · Huawei · reported by psirt@huawei.comMedium 6.1
Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.CVE-2024-57958 · Other software · Huawei · reported by psirt@huawei.comMedium 5.7
Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service confidentiCVE-2024-57957 · Other software · Huawei · reported by psirt@huawei.comMedium 6.6
Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-57956 · Other software · Huawei · reported by psirt@huawei.comLow 2.8
Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-57955 · Other software · Huawei · reported by psirt@huawei.comMedium 6.1
Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-57954 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2025Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-12602 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2025CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstation integrity and pCVE-2024-12476 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.4
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure, impacts workstation integrity and potential remote code execution on the compromised computer, when specific crafted XML file is imported in the Web Designer configuration tool.
- Product
- Web Designer for BMXNOR0200H
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Jan 7, 2025Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability mayCVE-2024-56456 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability mayCVE-2024-56455 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability mayCVE-2024-56454 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability mayCVE-2024-56453 · Other software · Huawei · reported by psirt@huawei.comMedium 6.8
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability mayCVE-2024-56452 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Vulnerability of input parameters not being verified during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Integer overflow vulnerability during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-56451 · Other software · Huawei · reported by psirt@huawei.comHigh 7.3
Integer overflow vulnerability during glTF model loading in the 3D engine module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Buffer overflow vulnerability in the component driver module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-56450 · Other software · Huawei · reported by psirt@huawei.comMedium 6.3
Buffer overflow vulnerability in the component driver module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56449 · Other software · Huawei · reported by psirt@huawei.comMedium 6.6
Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-56448 · Other software · Huawei · reported by psirt@huawei.comMedium 6.7
Vulnerability of improper access control in the home screen widget module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.CVE-2024-54121 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Startup control vulnerability in the ability module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of improper permission control in the window management module Impact: Successful exploitation of this vulnerability may affect service confidentiCVE-2024-56447 · Other software · Huawei · reported by psirt@huawei.comHigh 7.8
Vulnerability of improper permission control in the window management module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-56446 · Other software · Huawei · reported by psirt@huawei.comMedium 4
Vulnerability of variables not being initialized in the notification module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause features to perform abCVE-2024-56445 · Other software · Huawei · reported by psirt@huawei.comMedium 4.3
Instruction authentication bypass vulnerability in the Findnetwork module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56444 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56443 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause features to performCVE-2024-56442 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56441 · Other software · Huawei · reported by psirt@huawei.comMedium 4.1
Race condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.CVE-2024-56440 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Permission control vulnerability in the Connectivity module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56439 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Access control vulnerability in the identity authentication module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-56438 · Other software · Huawei · reported by psirt@huawei.comMedium 6
Vulnerability of improper memory address protection in the HUKS module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availabilitCVE-2024-56437 · Other software · Huawei · reported by psirt@huawei.comMedium 5.7
Vulnerability of input parameters not being verified in the widget framework module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Race condition vulnerability in the distributed notification module Impact: Successful exploitation of this vulnerability may cause features to perform abnormalCVE-2024-54120 · Other software · Huawei · reported by psirt@huawei.comMedium 4.1
Race condition vulnerability in the distributed notification module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause features to perform abCVE-2023-52955 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Vulnerability of improper authentication in the ANS system service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Vulnerability of improper permission control in the Gallery module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2023-52954 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
Vulnerability of improper permission control in the Gallery module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Path traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.CVE-2023-52953 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Path traversal vulnerability in the Medialibrary module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56436 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-56435 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause service exceptions of the device.CVE-2024-56434 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
UAF vulnerability in the device node access module Impact: Successful exploitation of this vulnerability may cause service exceptions of the device.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2024An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availCVE-2024-13058 · Other software · SoftIron · reported by 0a72a055-908d-47f5-a16a-1f09049c16c6Medium 4.8
An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem. This issue only impacts SoftIron HyperCloud and related software products (such as VM Squared) software versions 2.3.0 to before 2.5.0.
- Product
- HyperCloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.softiron.cloud
Dec 12, 2024ComfyUI-Impact-Pack is vulnerable to Path Traversal.CVE-2024-21575 · Other software · ltdrdata · reported by report@snyk.ioCritical 9.2
ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/upload/temp` endpoint added by the extension to the server. This results in writing arbitrary files to the file system which may, under some conditions, result in remote code execution (RCE).
- Product
- ComfyUI-Impact-Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Concurrent variable access vulnerability in the ability module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2024-54122 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Concurrent variable access vulnerability in the ability module Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-54119 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-54117 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Out-of-bounds read vulnerability in the M3U8 module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.CVE-2024-54116 · Other software · Huawei · reported by psirt@huawei.comMedium 4.3
Out-of-bounds read vulnerability in the M3U8 module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Out-of-bounds read vulnerability in the DASH module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54115 · Other software · Huawei · reported by psirt@huawei.comMedium 4.3
Out-of-bounds read vulnerability in the DASH module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Out-of-bounds access vulnerability in playback in the DASH module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54114 · Other software · Huawei · reported by psirt@huawei.comMedium 4.4
Out-of-bounds access vulnerability in playback in the DASH module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect power consumption.CVE-2024-54113 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect power consumption.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-54112 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54111 · Other software · Huawei · reported by psirt@huawei.comMedium 5.7
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.CVE-2024-54110 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Cross-process screen stack vulnerability in the UIExtension module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54109 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.CVE-2024-54108 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Read/Write vulnerability in the image decoding module Impact: Successful exploitation of this vulnerability will affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.