Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
642 results · page 7 of 13
Dec 13, 2021A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0.CVE-2021-24045 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
- Product
- Hermes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Dec 13, 2021IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking.CVE-2021-39050 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could overflow a buffer and gain lower level privileges. IBM X-Force ID: 214440.
- Product
- i2 Analyst's Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 13, 2021IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking.CVE-2021-39049 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.8
IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could overflow a buffer and gain lower level privileges. IBM X-Force ID: 214439.
- Product
- i2 Analyst's Notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 7, 2021A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an out-ofCVE-2021-24041 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an out-of-bounds write if a user sent a malicious image.
- Product
- WhatsApp Business for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhatsapp.comwhatsapp.com
Dec 6, 2021calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/converCVE-2021-44686 · Other software · Calibre-ebook · reported by MITREHigh 7.5
calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py.
- Product
- Calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgithub.com
Dec 3, 2021IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to.CVE-2021-29867 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to. IBM X-Force ID: 206212.
- Product
- Cognos Analytics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comsecurity.netapp.com
Nov 12, 2021A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data ouCVE-2021-3786 · Other software · Lenovo · reported by psirt@lenovo.comMedium 4.4
A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range.
- Product
- Notebook and ThinkPad BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 4, 2021JupyterHub is an open source multi-user server for Jupyter notebooks.CVE-2021-41247 · Other software · jupyterhub · reported by GitHubLow 3.5
JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out.
- Product
- jupyterhub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2021nbdime provides tools for diffing and merging of Jupyter Notebooks.CVE-2021-41134 · Other software · jupyter · reported by GitHubHigh 8.7
nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists within the Jupyter-owned nbdime project. It appears that when reading the file name and path from disk, the extension does not sanitize the string it constructs before returning it to be displayed. The diffNotebookCheckpoint function within nbdime causes this issue. When attempting to display the name of the local notebook (diffNotebookCheckpoint), nbdime appears to simply append .ipynb to the name of the input file. The NbdimeWidget is then created, and the base string is passed through to the request API function. From there, the frontend simply renders the HTML tag and anything along with it. Users are advised to patch to the most recent version of the affected product.
- Product
- nbdime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.CVE-2011-4126 · Other software · Calibre-ebook · reported by Red HatHigh 8.1
Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.
- Product
- Calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgit.zx2c4.com
Oct 26, 2021A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute any program as root.CVE-2011-4125 · Other software · Calibre-ebook · reported by Red HatCritical 9.8
A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute any program as root.
- Product
- Calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgit.zx2c4.com
Oct 26, 2021Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privileges.CVE-2011-4124 · Other software · Calibre-ebook · reported by Red HatCritical 9.8
Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privileges.
- Product
- Calibre
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netgit.zx2c4.com
Oct 26, 2021HHVM supports the use of an "admin" server which accepts administrative requests over HTTP.CVE-2019-3556 · Other software · Facebook · reported by cve-assign@fb.comHigh 8.1
HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handlers, dump-pcre-cache, can be used to output cached regular expressions from the current execution context into a file. The handler takes a parameter which specifies where on the filesystem to write this data. The parameter is not validated, allowing a malicious user to overwrite arbitrary files where the user running HHVM has write access. This issue affects HHVM versions prior to 4.56.2, all versions between 4.57.0 and 4.78.0, as well as 4.79.0, 4.80.0, 4.81.0, 4.82.0, and 4.83.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2021eLabFTW is an open source electronic lab notebook manager for research teams.CVE-2021-41171 · Other software · elabftw · reported by GitHubMedium 5.9
eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing brute force login protection, as recommended by Owasp with Device Cookies. This mechanism will not impact users and will effectively thwart any brute-force attempts at guessing passwords. The only correct way to address this is to upgrade to version 4.1.0. Adding rate limitation upstream of the eLabFTW service is of course a valid option, with or without upgrading.
- Product
- elabftw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets.CVE-2021-39207 · Other software · facebookresearch · reported by GitHubHigh 8.4
parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.
- Product
- ParlAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2021Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting CVE-2021-24040 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
- Product
- ParlAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Aug 19, 2021Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged process, leading to lCVE-2021-24038 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.8
Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged process, leading to local privilege escalation. This issue affects Oculus Desktop versions after 1.39 and prior to 31.1.0.67.507.
- Product
- Oculus Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comfacebook.com
Aug 9, 2021The Jupyter notebook is a web-based notebook environment for interactive computing.CVE-2021-32798 · Other software · jupyter · reported by GitHubCritical 10
The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.
- Product
- notebook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2021JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook.CVE-2021-32797 · Other software · jupyterlab · reported by GitHubHigh 7.4
JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.
- Product
- jupyterlab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2021IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow an authenticated user to perform unauthorized actions due to hazardous inCVE-2021-29770 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow an authenticated user to perform unauthorized actions due to hazardous input validation. IBM X-Force ID: 202771.
- Product
- i2 Analyze
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 26, 2021IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the secure attribute on authorization tokens or session cookies.CVE-2021-29769 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 202769.
- Product
- i2 Analyze
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 26, 2021IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message CVE-2021-29767 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202681.
- Product
- i2 Analyst's Notebook Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 26, 2021IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technicCVE-2021-29766 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 202680.
- Product
- i2 Analyze
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 26, 2021IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive informatCVE-2021-20431 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. IBM X-Force ID: 196342.
- Product
- i2 Analyst's Notebook Premium
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 26, 2021IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technicCVE-2021-20430 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196341.
- Product
- i2 Analyze
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 22, 2021Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of rCVE-2021-24036 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with the possibility of remote code execution. This issue affects versions of folly prior to v2021.07.22.00. This issue affects HHVM versions prior to 4.80.5, all versions between 4.81.0 and 4.102.1, all versions between 4.103.0 and 4.113.0, and versions 4.114.0, 4.115.0, 4.116.0, 4.117.0, 4.118.0 and 4.118.1.
- Product
- folly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2021A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions duCVE-2021-3614 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.4
A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage.
- Product
- Notebook BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jul 16, 2021Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access tCVE-2021-3453 · Other software · Lenovo · reported by psirt@lenovo.comMedium 6.8
Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage.
- Product
- BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Jun 21, 2021eLabFTW is an open source electronic lab notebook for research labs.CVE-2021-32698 · Other software · elabftw · reported by GitHubMedium 6.8
eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has been patched in eLabFTW 4.0.0.
- Product
- elabftw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2021A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execCVE-2021-24037 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
- Product
- Hermes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Jun 11, 2021A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed pCVE-2021-24035 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.1
A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files.
- Product
- WhatsApp Business for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhatsapp.comwhatsapp.com
Jun 1, 2021Funnel Builder by CartFlows – Create High Converting Sales Funnels For: Did not sanitise its facebook_pixel_id and google_analytics_id settingsCVE-2021-24330 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Funnel Builder by CartFlows – Create High Converting Sales Funnels For WordPress plugin before 1.6.13 did not sanitise its facebook_pixel_id and google_analytics_id settings, allowing high privilege users to set XSS payload in them, which will either be executed on pages generated by the plugin, or the whole website depending on the settings used.
- Product
- Funnel Builder by CartFlows – Create High Converting Sales Funnels For
- Fixed in
- 1.6.13
- What to do
- Update Funnel Builder by CartFlows – Create High Converting Sales Funnels For to 1.6.13 or newer.
Jun 1, 2021A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unrespCVE-2020-1920 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.
- Product
- react-native
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2021An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects.CVE-2021-24028 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code execution or other undesirable effects. This issue affects Facebook Thrift prior to v2021.02.22.00.
- Product
- Facebook Thrift
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Apr 12, 2021wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for: Were vulnerable to CSRF due to a lack of nonce protectionCVE-2021-24218 · WordPress plugins & themes · reported by WPScanHigh 8.8
The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved.
- Product
- wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for
- Fixed in
- 3.0.4
- What to do
- Update wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for to 3.0.4 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 12, 2021run_action function of the Facebook for: Deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerabilityCVE-2021-24217 · WordPress plugins & themes · reported by WPScanHigh 8.1
The run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be supplied creating an Object Injection vulnerability. There was also a useable magic method in the plugin that could be used to achieve remote code execution.
- Product
- run_action function of the Facebook for
- Fixed in
- 3.0.0
- What to do
- Update run_action function of the Facebook for to 3.0.0 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Apr 6, 2021A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to CVE-2021-24027 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s external storage to read cached TLS material.
- Product
- WhatsApp Business for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhatsapp.comwhatsapp.com
Apr 6, 2021A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v2CVE-2021-24026 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v2.21.3, WhatsApp for iOS prior to v2.21.32, and WhatsApp Business for iOS prior to v2.21.32 could have allowed an out-of-bounds write.
- Product
- WhatsApp Business for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhatsapp.comwhatsapp.com
Mar 15, 2021A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion.CVE-2021-24029 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.
- Product
- mvfst
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Mar 10, 2021When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it.CVE-2020-1900 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization.CVE-2020-1899 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021The fb_unserialize function did not impose a depth limit for nested deserialization.CVE-2020-1898 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable.CVE-2021-24030 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
The fbgames protocol handler registered as part of Facebook Gameroom does not properly quote arguments passed to the executable. That allows a malicious URL to cause code execution. This issue affects versions prior to v1.26.0.
- Product
- Facebook Gameroom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comfacebook.com
Mar 10, 2021Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading toCVE-2021-24025 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
Due to incorrect string size calculations inside the preg_quote function, a large input string passed to the function can trigger an integer overflow leading to a heap overflow. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer.CVE-2020-1921 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first.CVE-2020-1919 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory CVE-2020-1918 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard appendCVE-2020-1917 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2021An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write.CVE-2020-1916 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write. This issue affects HHVM prior to 4.56.2, all versions between 4.57.0 and 4.78.0, 4.79.0, 4.80.0, 4.81.0, 4.82.0, 4.83.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2021react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed.CVE-2021-24033 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.6
react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects), where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.
- Product
- react-dev-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.