Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
670 results · page 6 of 14
Sep 1, 2023External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4704 · Other software · instantsoft · reported by security@huntr.devMedium 4.9
External Control of System or Configuration Setting in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4655 · Other software · instantsoft · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4654 · Other software · instantsoft · reported by security@huntr.devLow 3.5
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4653 · Other software · instantsoft · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4652 · Other software · instantsoft · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4651 · Other software · instantsoft · reported by security@huntr.devMedium 5.4
Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4650 · Other software · instantsoft · reported by security@huntr.devMedium 4.7
Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2023Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.CVE-2023-4649 · Other software · instantsoft · reported by security@huntr.devMedium 5.4
Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2023An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have CVE-2023-40709 · Other software · OPTO 22 · reported by ot-cert@dragos.comMedium 6.8
An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b
- Product
- SNAP PAC S1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 16, 2023Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4381 · Other software · instantsoft · reported by security@huntr.devMedium 4.3
Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2023An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php.CVE-2020-36037 · Other software · Wuzhicms · reported by MITREHigh 8.8
An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2023iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function.CVE-2023-39806 · Other software · Idreamsoft · reported by MITRECritical 9.8
iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Aug 10, 2023iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.CVE-2023-39805 · Other software · Idreamsoft · reported by MITRECritical 9.8
iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.
- Product
- Icms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Aug 5, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4189 · Other software · instantsoft · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023 SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4188 · Other software · instantsoft · reported by security@huntr.devCritical 9.1
SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2023Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-4187 · Other software · instantsoft · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
- Product
- instantsoft/icms2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2023An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloadingCVE-2023-38948 · Other software · Jizhicms · reported by MITREHigh 7.2
An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2023A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.phCVE-2020-18418 · Other software · Feifeicms · reported by MITREHigh 8.8
A Cross site request forgery (CSRF) vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.php?s=Admin-Admin-Insert.
- Product
- Feifeicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component.CVE-2020-21489 · Other software · Feehi · reported by MITRECritical 9.8
File Upload vulnerability in Feehicms v.2.0.8 allows a remote attacker to execute arbitrary code via the /admin/index.php?r=admin-user%2Fupdate-self component.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php file.CVE-2020-21325 · Other software · Wuzhicms · reported by MITREHigh 8.8
An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the set_chache method of the function\common.func.php file.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Cross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function.CVE-2020-21246 · Other software · Yiicms Project · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function.
- Product
- Yiicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.CVE-2020-21174 · Other software · Feehi · reported by MITRECritical 9.8
File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in admin/content.php.CVE-2020-20413 · Other software · Wuzhicms · reported by MITRECritical 9.8
SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in admin/content.php.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023A vulnerability was found in JIZHICMS 2.4.5.CVE-2023-2927 · Other software · Jizhicms · reported by VulDBMedium 6.3
A vulnerability was found in JIZHICMS 2.4.5. It has been classified as critical. Affected is the function index of the file TemplateController.php. The manipulation of the argument webapi leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230082 is the identifier assigned to this vulnerability.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2023Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.CVE-2023-31860 · Other software · Wuzhicms · reported by MITREMedium 5.4
Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2023jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS).CVE-2023-31862 · Other software · Jizhicms · reported by MITREMedium 5.4
jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS). The content of the article published in the front end is only filtered in the front end, without being filtered in the background, which allows attackers to publish an article containing malicious JavaScript scripts by modifying the request package.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023An issue in the stricmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.CVE-2023-31628 · Other software · Openlinksw · reported by MITREHigh 7.5
An issue in the stricmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- Product
- Virtuoso
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.CVE-2023-30123 · Other software · Wuzhicms · reported by MITREMedium 5.4
wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.
- Product
- Wuzhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023A vulnerability in the Vector Packet Processor (VPP) of Cisco Packet Data Network Gateway (PGW) could allow an unauthenticated, remote attacker to stop ICMP traCVE-2023-20051 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in the Vector Packet Processor (VPP) of Cisco Packet Data Network Gateway (PGW) could allow an unauthenticated, remote attacker to stop ICMP traffic from being processed over an IPsec connection. This vulnerability is due to the VPP improperly handling a malformed packet. An attacker could exploit this vulnerability by sending a malformed Encapsulating Security Payload (ESP) packet over an IPsec connection. A successful exploit could allow the attacker to stop ICMP traffic over an IPsec connection and cause a denial of service (DoS).
- Product
- Cisco ASR 5000 Series Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Mar 22, 2023XunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows attackers to execute arbitrary php code, via the add function in cronCVE-2022-30037 · Other software · Xunruicms · reported by MITREHigh 7.2
XunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows attackers to execute arbitrary php code, via the add function in cron.php.
- Product
- Xunruicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweltolk.github.ioweltolk.github.io
Mar 22, 2023A vulnerability was found in FeiFeiCMS 2.7.130201.CVE-2023-1565 · Other software · Feifeicms · reported by VulDBLow 3.5
A vulnerability was found in FeiFeiCMS 2.7.130201. It has been classified as problematic. This affects an unknown part of the file \Public\system\slide_add.html of the component Extension Tool. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223557 was assigned to this vulnerability.
- Product
- Feifeicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2023An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafteCVE-2023-27235 · Other software · Jizhicms · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitrary code via a crafted phtml file.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 15, 2023A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application.CVE-2023-27234 · Other software · Jizhicms · reported by MITREMedium 6.5
A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within the application.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2023Internet Control Message Protocol (ICMP) Remote Code Execution VulnerabilityCVE-2023-23415 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 24, 2023Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.CVE-2021-33387 · Other software · 1234n · reported by MITRECritical 9.6
Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.
- Product
- Minicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.CVE-2021-36484 · Other software · Jizhicms · reported by MITRECritical 9.8
SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.
- Product
- Jizhicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php.CVE-2022-46999 · Other software · Tuzicms · reported by MITRECritical 9.8
Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2023PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.CVE-2022-47766 · Other software · Popojicms · reported by MITREHigh 8.8
PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.
- Product
- Popojicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023A vulnerability classified as critical was found in TuziCMS 2.0.6.CVE-2023-0244 · Other software · Tuzicms Project · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in TuziCMS 2.0.6. This vulnerability affects the function delall of the file \App\Manage\Controller\KefuController.class.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-218152.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2023A vulnerability classified as critical has been found in TuziCMS 2.0.6.CVE-2023-0243 · Other software · Tuzicms Project · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in TuziCMS 2.0.6. This affects the function index of the file App\Manage\Controller\ArticleController.class.php of the component Article Module. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-218151.
- Product
- Tuzicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server.CVE-2022-45434 · Network & remote access · Dahuasecurity · reported by cybersecurity@dahuatech.comMedium 5.9
Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could exploit the victim server to launch ICMP request attack to the designated target host.
- Product
- Dhi-dss7016d-s2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddahuasecurity.comdahuasecurity.com
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.CVE-2022-40373 · Other software · Feehi · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify.CVE-2022-40002 · Other software · Feehi · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page.CVE-2022-40001 · Other software · Feehi · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page.CVE-2022-40000 · Other software · Feehi · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.CVE-2021-36573 · Other software · Feehi · reported by MITREMedium 5.4
File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page.CVE-2021-36572 · Other software · Feehi · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.CVE-2020-36607 · Other software · Feehi · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2022Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.CVE-2020-20589 · Other software · Feehi · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag.
- Product
- Feehicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the lockscreen due to an incorreCVE-2022-20497 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.6
In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notifications on the lockscreen due to an incorrect state transition. This could lead to local information disclosure with physical access required and an app that runs above the lockscreen, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12L Android-13Android ID: A-246301979
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.