Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

4,129 results · page 66 of 83

Jan 12, 2018An information disclosure vulnerability in the Android media framework (libavc).CVE-2017-13203 · Computers, phones & browsers · Google Inc. · reported by security@android.comCritical 9.1
An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-63122634.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Jan 12, 2018An information disclosure vulnerability in the Android media framework (libeffects).CVE-2017-13202 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-67647856.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Jan 12, 2018An information disclosure vulnerability in the Android media framework (mediadrm).CVE-2017-13201 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
An information disclosure vulnerability in the Android media framework (mediadrm). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-63982768.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Jan 12, 2018An information disclosure vulnerability in the Android media framework (av) related to id3 unsynchronization.CVE-2017-13200 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
An information disclosure vulnerability in the Android media framework (av) related to id3 unsynchronization. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-63100526.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Jan 12, 2018A vulnerability in the Android media framework (ex) related to composition of frames lacking a color map.CVE-2017-13198 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
A vulnerability in the Android media framework (ex) related to composition of frames lacking a color map. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68399117.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Jan 12, 2018A vulnerability in the Android media framework (libvpx) related to odd frame width.CVE-2017-13194 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
A vulnerability in the Android media framework (libvpx) related to odd frame width. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64710201.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com lists.debian.org
Jan 12, 2018A vulnerability in the Android media framework (libhevc) related to handling ps_codec_obj memory allocation failures.CVE-2017-13190 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
A vulnerability in the Android media framework (libhevc) related to handling ps_codec_obj memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68299873.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Jan 12, 2018A vulnerability in the Android media framework (libavc) related to handling dec_hdl memory allocation failures.CVE-2017-13189 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
A vulnerability in the Android media framework (libavc) related to handling dec_hdl memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68300072.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Jan 12, 2018An information disclosure vulnerability in the Android media framework (aac).CVE-2017-13188 · Computers, phones & browsers · Google Inc. · reported by security@android.comCritical 9.1
An information disclosure vulnerability in the Android media framework (aac). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65280786.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Jan 12, 2018An information disclosure vulnerability in the Android media framework (libhevc).CVE-2017-13187 · Computers, phones & browsers · Google Inc. · reported by security@android.comCritical 9.1
An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65034175.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Jan 12, 2018A vulnerability in the Android media framework (libavc) related to incorrect use of mmco parameters.CVE-2017-13186 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
A vulnerability in the Android media framework (libavc) related to incorrect use of mmco parameters. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65735716.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Jan 12, 2018An information disclosure vulnerability in the Android media framework (libhevc).CVE-2017-13185 · Computers, phones & browsers · Google Inc. · reported by security@android.comCritical 9.1
An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-65123471.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record android.googlesource.com source.android.com
Jan 12, 2018An information disclosure vulnerability in the Android framework (clipboardservice).CVE-2017-0846 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
An information disclosure vulnerability in the Android framework (clipboardservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64934810.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Jan 9, 2018Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security fCVE-2018-0786 · Computers, phones & browsers · Microsoft Corporation · reported by secure@microsoft.comHigh 7.5
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."
Product
.NET Framework, .NET Core, and PowerShell Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jan 9, 2018Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0.CVE-2018-0764 · Computers, phones & browsers · Microsoft Corporation · reported by secure@microsoft.comHigh 7.5
Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 5.7 and .NET Core 1.0. 1.1 and 2.0 allow a denial of service vulnerability due to the way XML documents are processed, aka ".NET and .NET Core Denial Of Service Vulnerability". This CVE is unique from CVE-2018-0765.
Product
.NET Framework and .NET Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Dec 29, 2017XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to reaCVE-2014-3630 · Other software · Lightbend · reported by Red HatCritical 9.8
XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attackers to read arbitrary files, cause a denial of service, or have unspecified other impact via crafted XML data.
Product
Play Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record groups.google.com groups.google.com
Dec 29, 2017The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection CVE-2014-4914 · Other software · Zend · reported by Red HatCritical 9.8
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
Product
Zend Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record framework.zend.com jvn.jp
Dec 15, 2017PCAUSA Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF program to perform operations on memory outside of its typical bCVE-2017-3196 · Other software · Printing Communications Assoc., Inc. (PCAUSA) · reported by cret@cert.orgHigh 7.8
PCAUSA Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF program to perform operations on memory outside of its typical bounds on the driver's receipt of network packets. Local attackers can exploit this issue to execute arbitrary code with SYSTEM privileges.
Product
ASUS PCE-AC56 WLAN Card Utilities
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.rewolf.pl securityfocus.com
Dec 14, 2017examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which mighCVE-2017-17532 · Other software · Kiwi Project · reported by MITREHigh 8.8
examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Product
Kiwi
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security-tracker.debian.org security-tracker.debian.org
Dec 6, 2017An elevation of privilege vulnerability in the Android media framework (libstagefright).CVE-2017-13154 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.8
An elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63666573.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 6, 2017An elevation of privilege vulnerability in the Android media framework (libaudioservice).CVE-2017-13153 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.8
An elevation of privilege vulnerability in the Android media framework (libaudioservice). Product: Android. Versions: 8.0. Android ID A-65280854.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Dec 6, 2017An information disclosure vulnerability in the Android media framework (libmedia drm).CVE-2017-13152 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
An information disclosure vulnerability in the Android media framework (libmedia drm). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-62872384.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 6, 2017A remote code execution vulnerability in the Android media framework (libmpeg2).CVE-2017-13151 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 8.8
A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63874456.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Dec 6, 2017An information disclosure vulnerability in the Android media framework (n/a).CVE-2017-13150 · Computers, phones & browsers · Google Inc. · reported by security@android.comCritical 9.1
An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-38328132.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 6, 2017An information disclosure vulnerability in the Android media framework (n/a).CVE-2017-13149 · Computers, phones & browsers · Google Inc. · reported by security@android.comCritical 9.1
An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65719872.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 6, 2017A denial of service vulnerability in the Android media framework (libmpeg2).CVE-2017-13148 · Computers, phones & browsers · Google Inc. · reported by security@android.comMedium 6.5
A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65717533.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Dec 6, 2017A denial of service vulnerability in the Android media framework (libskia).CVE-2017-0880 · Computers, phones & browsers · Google Inc. · reported by security@android.comMedium 6.5
A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID A-65646012.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Dec 6, 2017An information disclosure vulnerability in the Android media framework (n/a).CVE-2017-0879 · Computers, phones & browsers · Google Inc. · reported by security@android.comCritical 9.1
An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65025028.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Dec 6, 2017A remote code execution vulnerability in the Android media framework (libhevc).CVE-2017-0878 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 8.8
A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 8.0. Android ID A-65186291.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Dec 6, 2017A remote code execution vulnerability in the Android media framework (libavc).CVE-2017-0877 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 8.8
A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-66372937.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Dec 6, 2017A remote code execution vulnerability in the Android media framework (libavc).CVE-2017-0876 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 8.8
A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-64964675.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Dec 6, 2017A denial of service vulnerability in the Android media framework (libavc).CVE-2017-0874 · Computers, phones & browsers · Google Inc. · reported by security@android.comMedium 6.5
A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63315932.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Dec 6, 2017A denial of service vulnerability in the Android media framework (libmpeg2).CVE-2017-0873 · Computers, phones & browsers · Google Inc. · reported by security@android.comMedium 6.5
A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63316255.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Dec 6, 2017A remote code execution vulnerability in the Android media framework (libskia).CVE-2017-0872 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 8.8
A remote code execution vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65290323.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Dec 6, 2017An elevation of privilege vulnerability in the Android framework (framework base).CVE-2017-0871 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.8
An elevation of privilege vulnerability in the Android framework (framework base). Product: Android. Versions: 8.0. Android ID A-65281159.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Dec 6, 2017An elevation of privilege vulnerability in the Android framework (libminikin).CVE-2017-0870 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.8
An elevation of privilege vulnerability in the Android framework (libminikin). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-62134807.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Dec 6, 2017An elevation of privilege vulnerability in the Android media framework (libaudiopolicymanager).CVE-2017-0837 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.8
An elevation of privilege vulnerability in the Android media framework (libaudiopolicymanager). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64340921.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.android.com
Nov 30, 2017Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only CVE-2017-14949 · Other software · Restlet · reported by MITREHigh 7.5
Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.
Product
Restlet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lgtm.com
Nov 30, 2017Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request.CVE-2017-14868 · Other software · Restlet · reported by MITREHigh 7.5
Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension.
Product
Restlet
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 30, 2017A SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unauthorized StructCVE-2017-12364 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unauthorized Structured Query Language (SQL) queries. The vulnerability is due to a failure to validate user-supplied input that is used in SQL queries. An attacker could exploit this vulnerability by sending a crafted SQL statement to an affected system. Successful exploitation could allow the attacker to read entries in some database tables. Cisco Bug IDs: CSCvg30333.
Product
Prime Service Catalog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Nov 27, 2017In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted inCVE-2017-8045 · Other software · Pivotal Software · reported by security_alert@emc.comCritical 9.8
In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.
Product
Spring Advanced Message Queuing Protocol
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com pivotal.io
Nov 19, 2017In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env CVE-2017-16894 · Other software · Laravel · reported by MITREHigh 7.5
In Laravel framework through 5.5.21, remote attackers can obtain sensitive information (such as externally usable passwords) via a direct request for the /.env URI. NOTE: this CVE is only about Laravel framework's writeNewEnvironmentFileWith function in src/Illuminate/Foundation/Console/KeyGenerateCommand.php, which uses file_put_contents without restricting the .env permissions. The .env filename is not used exclusively by Laravel framework.
Product
Laravel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com whiteboyz.xyz
Nov 17, 2017The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may reCVE-2017-1000163 · Other software · Phoenixframework · reported by MITREMedium 6.1
The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks.
Product
Phoenix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record elixirforum.com elixirforum.com
Nov 16, 2017Another vulnerability in the Android media framework (n/a).CVE-2017-0859 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36075131.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Nov 16, 2017Another vulnerability in the Android media framework (n/a).CVE-2017-0858 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64836894.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Nov 16, 2017Another vulnerability in the Android media framework (n/a).CVE-2017-0857 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-65122447.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Nov 16, 2017An information disclosure vulnerability in the Android media framework (n/a).CVE-2017-0854 · Computers, phones & browsers · Google Inc. · reported by security@android.comCritical 9.1
An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63873837.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Nov 16, 2017An information disclosure vulnerability in the Android media framework (n/a).CVE-2017-0853 · Computers, phones & browsers · Google Inc. · reported by security@android.comCritical 9.1
An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63121644.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Nov 16, 2017A denial of service vulnerability in the Android media framework (libhevc).CVE-2017-0852 · Computers, phones & browsers · Google Inc. · reported by security@android.comHigh 7.5
A denial of service vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0. Android ID: A-62815506.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com
Nov 16, 2017An information disclosure vulnerability in the Android media framework (libhevc).CVE-2017-0851 · Computers, phones & browsers · Google Inc. · reported by security@android.comMedium 5.3
An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-35430570.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.android.com source.android.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.