Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
814 results · page 7 of 17
Oct 31, 2023Improper file verification vulnerability in SaAT Netizen installer ver.1.2.0.424 and earlier, and SaAT Netizen ver.1.2.0.8 (Build427) and earlier allows a remotCVE-2016-1203 · Other software · NetMove Corporation · reported by vultures@jpcert.or.jpHigh 8.1
Improper file verification vulnerability in SaAT Netizen installer ver.1.2.0.424 and earlier, and SaAT Netizen ver.1.2.0.8 (Build427) and earlier allows a remote unauthenticated attacker to conduct a man-in-the-middle attack. A successful exploitation may result in a malicious file being downloaded and executed.
- Product
- SaAT Netizen installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpweb-support.saat.jp
Oct 26, 2023Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.CVE-2023-46376 · Other software · Zentao · reported by MITREHigh 7.5
Zentao Biz version 8.7 and before is vulnerable to Information Disclosure.
- Product
- BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnarrow-payment-2cd.notion.sitenarrow-payment-2cd.notion.site
Oct 26, 2023ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).CVE-2023-46375 · Other software · Zentao · reported by MITREHigh 8.8
ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF).
- Product
- BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnarrow-payment-2cd.notion.sitenarrow-payment-2cd.notion.site
Oct 26, 2023ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.CVE-2023-46491 · Other software · Zentao · reported by MITREMedium 6.1
ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.
- Product
- BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforemost-smash-52a.notion.siteforemost-smash-52a.notion.site
Oct 26, 2023ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).CVE-2023-46374 · Other software · Zentao · reported by MITREMedium 6.1
ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).
- Product
- BIZ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnarrow-payment-2cd.notion.sitenarrow-payment-2cd.notion.site
Oct 25, 2023A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliaseCVE-2023-44769 · Other software · Tribalsystems · reported by MITREMedium 5.4
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Spare aliases from Alias.
- Product
- Zenario
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Short URL plugin <= 1.6.8 versions.CVE-2023-45058 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Short URL plugin <= 1.6.8 versions.
- Affected
- up to 1.6.8
- What to do
- Affects up to 1.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 9, 2023An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code viCVE-2023-44827 · Other software · Easycorp · reported by MITREHigh 8.8
An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings function.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordspotted-topaz-6aa.notion.sitespotted-topaz-6aa.notion.site
Oct 9, 2023Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script.CVE-2023-44826 · Other software · Easycorp · reported by MITREMedium 5.4
Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout.CVE-2023-44771 · Other software · Tribalsystems · reported by MITREMedium 5.4
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout.
- Product
- Zenario
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - SpareCVE-2023-44770 · Other software · Tribalsystems · reported by MITREMedium 5.4
A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias.
- Product
- Zenario
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.CVE-2023-20597 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse”
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.CVE-2023-20594 · Other software · AMD · reported by psirt@amd.comMedium 4.4
Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse”
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2023A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a craCVE-2023-39578 · Other software · Tribalsystems · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu navigation text field.
- Product
- Zenario
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.companda002.hashnode.dev
Aug 15, 2023 Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform memory reads/wrCVE-2023-20564 · Other software · AMD · reported by psirt@amd.comMedium 6.7
Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may permit a privileged attacker to perform memory reads/writes potentially leading to a loss of confidentiality or arbitrary kernel execution.
- Product
- Ryzen™ Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2023 Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may allow a privileged attacker to provide a null value pCVE-2023-20560 · Other software · AMD · reported by psirt@amd.comMedium 4.4
Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may allow a privileged attacker to provide a null value potentially resulting in a Windows crash leading to denial of service.
- Product
- Ryzen™ Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2023 An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resulting in compromiseCVE-2023-20589 · Other software · AMD · reported by psirt@amd.comMedium 6.8
An attacker with specialized hardware and physical access to an impacted device may be able to perform a voltage fault injection attack resulting in compromise of the ASP secure boot potentially leading to arbitrary code execution.
- Product
- Ryzen™ 3000 Series Desktop Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 8, 2023 A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction.CVE-2023-20569 · Other software · AMD · reported by psirt@amd.comMedium 4.7
A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-controlled address, potentially leading to information disclosure.
- Product
- Ryzen™ 3000 Series Desktop Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comxenbits.xen.org
Aug 8, 2023Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-controlled poinCVE-2023-20555 · Other software · AMD · reported by psirt@amd.comHigh 7.8
Insufficient input validation in CpmDisplayFeatureSmm may allow an attacker to corrupt SMM memory by overwriting an arbitrary bit in an attacker-controlled pointer potentially leading to arbitrary code execution in SMM.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2023An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.CVE-2023-20593 · Other software · AMD · reported by psirt@amd.comMedium 5.5
An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgopenwall.com
Jul 24, 2023 A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system.CVE-2023-3324 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.3
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts. This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.
- Product
- ABB Ability™ zenon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jul 24, 2023 A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system.CVE-2023-3323 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 5.9
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts. This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.
- Product
- ABB Ability™ zenon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jul 24, 2023 A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system.CVE-2023-3322 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts. This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.
- Product
- ABB Ability™ zenon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jul 24, 2023 A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system.CVE-2023-3321 · Other software · ABB · reported by cybersecurity@ch.abb.comHigh 7
A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts. This issue affects ABB Ability™ zenon: from 11 build through 11 build 106404.
- Product
- ABB Ability™ zenon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jul 14, 2023zenstruck/collections is a set of helpers for iterating/paginating/filtering collections.CVE-2023-37473 · Other software · zenstruck · reported by GitHubHigh 8.5
zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit `f4b1c48820` and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either `EntityRepository::find()` or `query()`.
- Product
- collection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parameter.CVE-2020-21268 · Other software · Easycorp · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parameter.
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmwarCVE-2023-30356 · Network & remote access · Tenda · reported by MITREHigh 7.5
Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmware
- Product
- Cp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and theCVE-2023-30354 · Network & remote access · Tenda · reported by MITRECritical 9.8
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and the hardcoded boot password can be inserted for console access.
- Product
- Cp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document.CVE-2023-30353 · Network & remote access · Tenda · reported by MITRECritical 9.8
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document.
- Product
- Cp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for the RTSP feed.CVE-2023-30352 · Network & remote access · Tenda · reported by MITRECritical 9.8
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for the RTSP feed.
- Product
- Cp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryptiCVE-2023-30351 · Network & remote access · Tenda · reported by MITREHigh 7.5
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryption. This vulnerability allows attackers to connect to the TELNET service (or UART) by using the exposed credentials.
- Product
- Cp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculationCVE-2021-46794 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculation triggering a data abort, resulting in a potential denial of service.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing the ASP bootloader to CVE-2021-46792 · Other software · AMD · reported by psirt@amd.comMedium 5.9
Time-of-check Time-of-use (TOCTOU) in the BIOS2PSP command may allow an attacker with a malicious BIOS to create a race condition causing the ASP bootloader to perform out-of-bounds SRAM reads upon an S3 resume event potentially leading to a denial of service.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in a loss of integrity or code execution.CVE-2021-46773 · Other software · AMD · reported by psirt@amd.comHigh 8.8
Insufficient input validation in ABL may enable a privileged attacker to corrupt ASP memory, potentially resulting in a loss of integrity or code execution.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, potentially leading to a CVE-2021-46765 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Insufficient input validation in ASP may allow an attacker with a compromised SMM to induce out-of-bounds memory reads within the ASP, potentially leading to a denial of service.
- Product
- Ryzen™ 5000 Series Desktop processor with Radeon™ Graphics “Cezanne” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentialCVE-2021-46760 · Other software · AMD · reported by psirt@amd.comCritical 9.8
A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentially lead to an attacker leaking sensitive information or achieving code execution.
- Product
- 3rd Gen AMD Ryzen™ Threadripper™ Processors “Castle Peak” HEDT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical access and control of a Uapp that runs under thCVE-2021-46759 · Other software · AMD · reported by psirt@amd.comMedium 6.1
Improper syscall input validation in AMD TEE (Trusted Execution Environment) may allow an attacker with physical access and control of a Uapp that runs under the bootloader to reveal the contents of the ASP (AMD Secure Processor) bootloader accessible memory to a serial port, resulting in a potential loss of integrity.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious Uapp or ABL to send CVE-2021-46756 · Other software · AMD · reported by psirt@amd.comCritical 9.1
Insufficient validation of inputs in SVC_MAP_USER_STACK in the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious Uapp or ABL to send malformed or invalid syscall to the bootloader resulting in a potential denial of service and loss of integrity.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious bootloader to exhausCVE-2021-46755 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Failure to unmap certain SysHub mappings in error paths of the ASP (AMD Secure Processor) bootloader may allow an attacker with a malicious bootloader to exhaust the SysHub resources resulting in a potential denial of service.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into exCVE-2021-46754 · Other software · AMD · reported by psirt@amd.comCritical 9.1
Insufficient input validation in the ASP (AMD Secure Processor) bootloader may allow an attacker with a compromised Uapp or ABL to coerce the bootloader into exposing sensitive information to the SMU (System Management Unit) resulting in a potential loss of confidentiality and integrity.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the CVE-2021-46753 · Other software · AMD · reported by psirt@amd.comCritical 9.1
Failure to validate the length fields of the ASP (AMD Secure Processor) sensor fusion hub headers may allow an attacker with a malicious Uapp or ABL to map the ASP sensor fusion hub region and overwrite data structures leading to a potential loss of confidentiality and integrity.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculationCVE-2021-46749 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Insufficient bounds checking in ASP (AMD Secure Processor) may allow for an out of bounds read in SMI (System Management Interface) mailbox checksum calculation triggering a data abort, resulting in a potential denial of service.
- Product
- Ryzen™ 2000 Series Desktop Processors “Pinnacle Ridge”
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES user application canCVE-2021-26406 · Other software · AMD · reported by psirt@amd.comHigh 7.5
Insufficient validation in parsing Owner's Certificate Authority (OCA) certificates in SEV (AMD Secure Encrypted Virtualization) and SEV-ES user application can lead to a host crash potentially resulting in denial of service.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially lCVE-2021-26371 · Other software · AMD · reported by psirt@amd.comMedium 5.5
A compromised or malicious ABL or UApp could send a SHA256 system call to the bootloader, which may result in exposure of ASP memory to userspace, potentially leading to information disclosure.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limiteCVE-2021-26365 · Other software · AMD · reported by psirt@amd.comHigh 8.2
Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limited leakage of information about out-of-bounds memory contents.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and informCVE-2021-26356 · Other software · AMD · reported by psirt@amd.comHigh 7.4
A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and information disclosure.
- Product
- Ryzen™ 3000 Series Desktop Processors “Matisse” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initializeCVE-2021-26354 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Insufficient bounds checking in ASP may allow an attacker to issue a system call from a compromised ABL which may cause arbitrary memory values to be initialized to zero, potentially leading to a loss of integrity.
- Product
- Ryzen™ 2000 series Desktop Processors “Raven Ridge” AM4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function.CVE-2020-29312 · Other software · Zend · reported by MITRECritical 9.8
An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. Note: This has been disputed by third parties as incomplete and incorrect. The framework does not have a version that surpasses 2.x.x and was deprecated in early 2020.
- Product
- Zend Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcowtransfer.comgithub.com
Apr 4, 2023Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameterCVE-2020-22533 · Other software · Easycorp · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter
- Product
- Zentao
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2023 Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation ofCVE-2023-20559 · Other software · AMD · reported by psirt@amd.comHigh 8.8
Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation of privileges.
- Product
- Ryzen™ 2000 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.