Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,629 results · page 7 of 33
Aug 29, 2018Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability.CVE-2018-12827 · Other software · Adobe · reported by AdobeHigh 7.5
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Product
- Flash Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Aug 29, 2018Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability.CVE-2018-12826 · Other software · Adobe · reported by AdobeHigh 7.5
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Product
- Flash Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Aug 29, 2018Adobe Flash Player 30.0.0.134 and earlier have a security bypass vulnerability.CVE-2018-12825 · Other software · Adobe · reported by AdobeCritical 9.8
Adobe Flash Player 30.0.0.134 and earlier have a security bypass vulnerability. Successful exploitation could lead to security mitigation bypass.
- Product
- Flash Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Aug 29, 2018Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability.CVE-2018-12824 · Other software · Adobe · reported by AdobeMedium 5.9
Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Product
- Flash Player Desktop Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 20, 2018Adobe Flash Player 30.0.0.113 and earlier versions have an Out-of-bounds read vulnerability.CVE-2018-5008 · Other software · Adobe · reported by AdobeHigh 7.5
Adobe Flash Player 30.0.0.113 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Product
- Flash Player Desktop Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 20, 2018Adobe Flash Player 30.0.0.113 and earlier versions have a Type Confusion vulnerability.CVE-2018-5007 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player 30.0.0.113 and earlier versions have a Type Confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- Product
- Flash Player Desktop Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 13, 2018Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, cCVE-2016-9500 · Other software · Accellion · reported by cret@cert.orgMedium 6.1
Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image) that are vulnerable to cross-site scripting.
- Product
- FTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2018Adobe Flash Player Stack-based Buffer Overflow VulnerabilityCVE-2018-5002 · Other software · Adobe · reported by AdobeExploitedHigh 7.8
Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.
- Product
- Flash Player
- On CISA’s list since
- May 23, 2022 (federal fix deadline Jun 13, 2022)
- What to do
- Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogsecurityfocus.comsecuritytracker.com
Jul 9, 2018Adobe Flash Player versions 29.0.0.171 and earlier have an Out-of-bounds read vulnerability.CVE-2018-5001 · Other software · Adobe · reported by AdobeMedium 6.5
Adobe Flash Player versions 29.0.0.171 and earlier have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Product
- Flash Player Desktop Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 9, 2018Adobe Flash Player versions 29.0.0.171 and earlier have an Integer Overflow vulnerability.CVE-2018-5000 · Other software · Adobe · reported by AdobeMedium 6.5
Adobe Flash Player versions 29.0.0.171 and earlier have an Integer Overflow vulnerability. Successful exploitation could lead to information disclosure.
- Product
- Flash Player Desktop Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 9, 2018Adobe Flash Player versions 29.0.0.171 and earlier have a Type Confusion vulnerability.CVE-2018-4945 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 29.0.0.171 and earlier have a Type Confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- Product
- Flash Player Desktop Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 9, 2018The mintToken function of a smart contract implementation for TheFlashToken, an Ethereum token, has an integer overflow that allows the owner of the contract toCVE-2018-13772 · Other software · Theflashtoken Project · reported by MITREHigh 7.5
The mintToken function of a smart contract implementation for TheFlashToken, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.
- Product
- Theflashtoken
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 6, 2018While flashing meta image, a buffer over-read may potentially occur when the image size is smaller than the image header size or is smaller than the image headeCVE-2017-14893 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 5.5
While flashing meta image, a buffer over-read may potentially occur when the image size is smaller than the image header size or is smaller than the image header size + total image header entry in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.
- Product
- Android for MSM, Firefox OS for MSM, QRD Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.codeaurora.org
Jul 6, 2018While flashing a meta image, a buffer over-read can potentially occur when the number of images are out of the maximum range of 32 in Android releases from CAF CVE-2017-14872 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 5.5
While flashing a meta image, a buffer over-read can potentially occur when the number of images are out of the maximum range of 32 in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.
- Product
- Android for MSM, Firefox OS for MSM, QRD Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.codeaurora.org
Jun 11, 2018In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandboCVE-2018-5165 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protections off. This vulnerability affects Firefox < 60.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 29, 2018IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which could cause a denial of CVE-2018-1495 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which could cause a denial of service. IBM X-Force ID: 141148.
- Product
- FlashSystem V900
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2018Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability.CVE-2018-4944 · Other software · Adobe · reported by AdobeCritical 9.8
Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- Product
- Flash Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 19, 2018Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability.CVE-2018-4937 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- Product
- Flash Player Desktop Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 19, 2018Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability.CVE-2018-4936 · Other software · Adobe · reported by AdobeMedium 6.5
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploitation could lead to information disclosure.
- Product
- Flash Player Desktop Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 19, 2018Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability.CVE-2018-4935 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- Product
- Flash Player Desktop Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 19, 2018Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability.CVE-2018-4934 · Other software · Adobe · reported by AdobeMedium 6.5
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Product
- Flash Player Desktop Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 19, 2018Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability.CVE-2018-4933 · Other software · Adobe · reported by AdobeMedium 6.5
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- Product
- Flash Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 19, 2018Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Use-After-Free vulnerability.CVE-2018-4932 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Use-After-Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- Product
- Flash Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 19, 2018Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable type confusion vulnerability.CVE-2018-4920 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- Product
- Flash Player Desktop Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 19, 2018Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free vulnerability.CVE-2018-4919 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- Product
- Flash Player Desktop Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 17, 2018IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7CVE-2018-1466 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 140397.
- Product
- SAN Volume Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2018IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.CVE-2018-1465 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could allow an authenticated user to obtain the private key which could make intercepting GUI communications possible. IBM X-Force ID: 140396.
- Product
- Storwize V3500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2018IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.CVE-2018-1464 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could allow an authenticated user to obtain sensitive information that they should not have authorization to read. IBM X-Force ID: 140395.
- Product
- Storwize V5000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2018IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.CVE-2018-1463 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could allow an authenticated user to access system files they should not have access to some of which could contain account credentials. IBM X-Force ID: 140368.
- Product
- Storwize V5000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2018IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.CVE-2018-1462 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.6
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could allow an authenticated user to access system files they should not have access to including deleting files or causing a denial of service. IBM X-Force ID: 140363.
- Product
- Storwize V3700
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2018IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.CVE-2018-1461 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 140362.
- Product
- Spectrum Virtualize Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2018IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.CVE-2018-1438 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web handler /DLSnap could allow an unauthenticated attacker to read arbitrary files on the system. IBM X-Force ID: 139566.
- Product
- Storwize V7000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2018IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.CVE-2018-1434 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 139474.
- Product
- FlashSystem V9000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2018IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.CVE-2018-1433 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web handler /DownloadFile does not require authentication to read arbitrary files from the system. IBM X-Force ID: 139473.
- Product
- Storwize V7000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2018The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters iCVE-2014-5014 · WordPress plugins & themes · reported by MITRECritical 9.8
The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.
- Product
- WordPress Flash Uploader
- Fixed in
- 3.1.3
- What to do
- Update WordPress Flash Uploader to 3.1.3 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Apr 3, 2018Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to aCVE-2017-5703 · Other software · Intel Corporation · reported by secure@intel.comMedium 6
Configuration of SPI Flash in platforms based on multiple Intel platforms allow a local attacker to alter the behavior of the SPI flash potentially leading to a Denial of Service.
- Product
- Intel 6th generation Intel Core Processors, Intel 7th generation Processors, Intel Xeon Scalable Processors, Intel Xeon Processor E3 v5 Family, Intel Xeon Proce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsecurity-center.intel.com
Mar 16, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in msm_flash_subdev_do_ioctl of drivers/media/plCVE-2017-15814 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comMedium 4.4
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in msm_flash_subdev_do_ioctl of drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c, there is a possible out of bounds read if flash_data.cfg_type is CFG_FLASH_INIT due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Feb 9, 2018OpenEMR version 5.0.0 contains a Cross Site Scripting (XSS) vulnerability in open-flash-chart.swf and _posteddata.php that can result in .CVE-2018-1000020 · Other software · Open-emr · reported by MITREMedium 6.1
OpenEMR version 5.0.0 contains a Cross Site Scripting (XSS) vulnerability in open-flash-chart.swf and _posteddata.php that can result in . This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen-emr.orgsec-consult.com
Feb 6, 2018Adobe Flash Player Use-After-Free VulnerabilityCVE-2018-4878 · Other software · Adobe · reported by AdobeExploitedRansomwareHigh 7.8
Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.
- Product
- Flash Player
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogblog.talosintelligence.comsecurityfocus.com
Feb 6, 2018A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161.CVE-2018-4877 · Other software · Adobe · reported by AdobeCritical 9.8
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player's quality of service functionality. A successful attack can lead to arbitrary code execution.
- Product
- Flash Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Jan 22, 2018Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a readCVE-2018-6014 · Other software · Subsonic · reported by MITREMedium 6.5
Subsonic v6.1.3 has an insecure allow-access-from domain="*" Flash cross-domain policy that allows an attacker to retrieve sensitive user information via a read request. To exploit this issue, an attacker must convince the user to visit a web site loaded with a SWF file created specifically to steal user data.
- Product
- Subsonic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comyoutube.com
Jan 18, 2018WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).CVE-2018-5776 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).
- Fixed in
- 4.9.2
- What to do
- Update the plugin to 4.9.2 or newer.
Full record and what to do →NVD recordcodex.wordpress.orggithub.com
Jan 13, 2018The callforward module in User Control Panel (UCP) in Nicolas Gudino (aka Asternic) Flash Operator Panel (FOP) 2.31.03 allows remote authenticated users to execCVE-2018-5694 · Other software · Fop2 · reported by MITREHigh 8.8
The callforward module in User Control Panel (UCP) in Nicolas Gudino (aka Asternic) Flash Operator Panel (FOP) 2.31.03 allows remote authenticated users to execute arbitrary commands via the command parameter.
- Product
- Flash Operator Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvulnerability-lab.comvulnerability-lab.com
Jan 10, 2018In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing ubi image an uninitialized memoryCVE-2017-11066 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing ubi image an uninitialized memory could be accessed.
- Product
- Android for MSM, Firefox OS for MSM, QRD Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 9, 2018An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137.CVE-2018-4871 · Other software · Redhat · reported by AdobeHigh 7.5
An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is past the end of the target buffer. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
- Product
- Enterprise Linux Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jan 2, 2018Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary wCVE-2017-1000425 · Other software · Liferay · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the /html/portal/flash.jsp page in Liferay Portal CE 7.0 GA4 and older allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the "movie" parameter.
- Product
- Liferay Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddev.liferay.comgithub.com
Dec 15, 2017Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPCVE-2017-3190 · Other software · Flash Seats · reported by cret@cert.orgHigh 7.5
Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks.
- Product
- Flash Seats Mobile App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.cert.org
Dec 13, 2017A regression affecting Adobe Flash Player version 27.0.0.187 (and earlier versions) causes the unintended reset of the global settings preference file when a usCVE-2017-11305 · Other software · Adobe · reported by AdobeMedium 6.5
A regression affecting Adobe Flash Player version 27.0.0.187 (and earlier versions) causes the unintended reset of the global settings preference file when a user clears browser data.
- Product
- Flash Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Dec 9, 2017An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions.CVE-2017-3114 · Other software · Redhat · reported by AdobeCritical 9.8
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is part of providing language- and region- or country- specific functionality. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
- Product
- Enterprise Linux Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Dec 9, 2017An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions.CVE-2017-3112 · Other software · Redhat · reported by AdobeCritical 9.8
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is part of AdobePSDK metadata. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
- Product
- Enterprise Linux Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.