Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
7,451 results · page 78 of 150
Mar 24, 2021A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/edit_personal_page.php URI.CVE-2021-29029 · Other software · Bitweaver · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/edit_personal_page.php URI.
- Product
- Bitweaver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2021A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/user_activity.php URI.CVE-2021-29028 · Other software · Bitweaver · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/user_activity.php URI.
- Product
- Bitweaver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2021A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/index.php URI.CVE-2021-29027 · Other software · Bitweaver · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/index.php URI.
- Product
- Bitweaver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2021A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/permissions.php URI.CVE-2021-29026 · Other software · Bitweaver · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/permissions.php URI.
- Product
- Bitweaver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2021A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/my_images.php URI.CVE-2021-29025 · Other software · Bitweaver · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/my_images.php URI.
- Product
- Bitweaver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2021The FTL Server (tibftlserver), FTL C API, FTL Golang API, FTL Java API, and FTL .Net API components of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCCVE-2021-28820 · Other software · TIBCO Software Inc. · reported by security@tibco.comHigh 8.8
The FTL Server (tibftlserver), FTL C API, FTL Golang API, FTL Java API, and FTL .Net API components of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.5.0 and below, TIBCO FTL - Developer Edition: versions 6.5.0 and below, and TIBCO FTL - Enterprise Edition: versions 6.5.0 and below.
- Product
- TIBCO FTL - Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2021A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "query" parameter.CVE-2021-27531 · Other software · Dynpg · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "query" parameter.
- Product
- Dynpg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2021A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allow remote attacker to inject javascript via URI in /index.php.CVE-2021-27530 · Other software · Dynpg · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allow remote attacker to inject javascript via URI in /index.php.
- Product
- Dynpg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2021A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "limit" parameter.CVE-2021-27529 · Other software · Dynpg · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "limit" parameter.
- Product
- Dynpg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2021A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "refID" parameter.CVE-2021-27528 · Other software · Dynpg · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "refID" parameter.
- Product
- Dynpg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2021A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "valueID" parameter.CVE-2021-27527 · Other software · Dynpg · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "valueID" parameter.
- Product
- Dynpg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2021A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "page" parameter.CVE-2021-27526 · Other software · Dynpg · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "page" parameter.
- Product
- Dynpg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2021XStream is a Java library to serialize objects to XML and back again.CVE-2021-21351 · Other software · x-stream · reported by GitHubMedium 5.4
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- Product
- xstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-stream.github.iogithub.com
Mar 22, 2021XStream is a Java library to serialize objects to XML and back again.CVE-2021-21350 · Other software · x-stream · reported by GitHubMedium 5.3
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- Product
- xstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-stream.github.iogithub.com
Mar 22, 2021XStream is a Java library to serialize objects to XML and back again.CVE-2021-21349 · Other software · x-stream · reported by GitHubMedium 6.1
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- Product
- xstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-stream.github.iogithub.com
Mar 22, 2021XStream is a Java library to serialize objects to XML and back again.CVE-2021-21348 · Other software · x-stream · reported by GitHubMedium 5.3
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU time and will never return. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- Product
- xstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-stream.github.iogithub.com
Mar 22, 2021XStream is a Java library to serialize objects to XML and back again.CVE-2021-21347 · Other software · x-stream · reported by GitHubMedium 6.1
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- Product
- xstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-stream.github.iogithub.com
Mar 22, 2021XStream is a Java library to serialize objects to XML and back again.CVE-2021-21346 · Other software · x-stream · reported by GitHubMedium 6.1
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- Product
- xstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-stream.github.iogithub.com
Mar 22, 2021XStream is a Java library to serialize objects to XML and back again.CVE-2021-21345 · Other software · x-stream · reported by GitHubMedium 5.8
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- Product
- xstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-stream.github.iogithub.com
Mar 22, 2021XStream is a Java library to serialize objects to XML and back again.CVE-2021-21344 · Other software · x-stream · reported by GitHubMedium 5.3
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- Product
- xstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-stream.github.iogithub.com
Mar 22, 2021XStream is a Java library to serialize objects to XML and back again.CVE-2021-21343 · Other software · x-stream · reported by GitHubMedium 5.3
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- Product
- xstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-stream.github.iogithub.com
Mar 22, 2021XStream is a Java library to serialize objects to XML and back again.CVE-2021-21342 · Other software · x-stream · reported by GitHubMedium 5.3
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information. An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- Product
- xstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-stream.github.iogithub.com
Mar 22, 2021XStream is a Java library to serialize objects to XML and back again.CVE-2021-21341 · Other software · x-stream · reported by GitHubHigh 7.5
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
- Product
- xstream
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordx-stream.github.iogithub.com
Mar 22, 2021A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" paramCVE-2021-27308 · Other software · 4homepages · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.
- Product
- 4images
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 19, 2021A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.CVE-2021-27520 · Other software · Fudforum · reported by MITREMedium 6.1
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.
- Product
- Fudforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 19, 2021A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.CVE-2021-27519 · Other software · Fudforum · reported by MITREMedium 6.1
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.
- Product
- Fudforum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 18, 2021shescape is a simple shell escape package for JavaScript.CVE-2021-21384 · Other software · ericcornelissen · reported by GitHubMedium 6.3
shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.
- Product
- shescape
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2021WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting uCVE-2021-27436 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 6.1
WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser actions.
- Product
- Webaccess/scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Mar 18, 2021A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from_time" parameter.CVE-2021-28420 · Other software · Seopanel · reported by MITREMedium 4.8
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from_time" parameter.
- Product
- SEO Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 18, 2021A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter.CVE-2021-28418 · Other software · Seopanel · reported by MITREMedium 4.8
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter.
- Product
- SEO Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 18, 2021A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "search_name" parameter.CVE-2021-28417 · Other software · Seopanel · reported by MITREMedium 4.8
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "search_name" parameter.
- Product
- SEO Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 12, 2021In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.CVE-2021-28162 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgMedium 6.1
In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
- Product
- Eclipse Theia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2021In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.CVE-2021-28161 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgMedium 6.1
In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
- Product
- Eclipse Theia
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2021xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.CVE-2021-21366 · Other software · xmldom · reported by GitHubMedium 4.3
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Product
- xmldom
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2021Visual Studio Code Java Extension Pack Remote Code Execution VulnerabilityCVE-2021-27084 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability
- Product
- Visual Studio Code - Java Extension Pack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 10, 2021In setNightModeActivated of UiModeManagerService.java, there is a missing permission check.CVE-2021-0389 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In setNightModeActivated of UiModeManagerService.java, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-168039904
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In onReceive of ImsPhoneCallTracker.java, there is a possible misattribution of data usage due to an incorrect broadcast handler.CVE-2021-0388 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onReceive of ImsPhoneCallTracker.java, there is a possible misattribution of data usage due to an incorrect broadcast handler. This could lead to local escalation of privilege resulting in attributing video call data to the wrong app, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-162741489
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In createConnectToAvailableNetworkNotification of ConnectToNetworkNotificationBuilder.java, there is a possible connection to untrusted WiFi networks due to notCVE-2021-0385 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In createConnectToAvailableNetworkNotification of ConnectToNetworkNotificationBuilder.java, there is a possible connection to untrusted WiFi networks due to notification interaction above the lockscreen. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-172584372
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In done of CaptivePortalLoginActivity.java, there is a confused deputy.CVE-2021-0383 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In done of CaptivePortalLoginActivity.java, there is a confused deputy. This could lead to local escalation of privilege in carrier settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-160871056
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In checkSlicePermission of SliceManagerService.java, there is a possible resource exposure due to an incorrect permission check.CVE-2021-0382 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In checkSlicePermission of SliceManagerService.java, there is a possible resource exposure due to an incorrect permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-140727941
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In updateNotifications of DeviceStorageMonitorService.java, there is a possible permission bypass due to an unsafe PendingIntent.CVE-2021-0381 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In updateNotifications of DeviceStorageMonitorService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153466381
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In onReceive of DcTracker.java, there is a possible way to trigger a provisioning URL and modify other telephony settings due to a missing permission check.CVE-2021-0380 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onReceive of DcTracker.java, there is a possible way to trigger a provisioning URL and modify other telephony settings due to a missing permission check. This could lead to local escalation of privilege during the onboarding flow with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-172459128
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In bindServiceLocked of ActiveServices.java, there is a possible foreground service launch due to a confused deputy.CVE-2021-0398 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In bindServiceLocked of ActiveServices.java, there is a possible foreground service launch due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173516292
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlCVE-2021-0391 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-172841550
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to a missing permission check.CVE-2021-0390 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to a missing permission check. This could lead to local escalation of privilege by a background user on the same device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174749461
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In checkUriPermission and related functions of MediaProvider.java, there is a possible way to access external files due to a permissions bypass.CVE-2021-0376 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In checkUriPermission and related functions of MediaProvider.java, there is a possible way to access external files due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-115619667
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In onPackageModified of VoiceInteractionManagerService.java, there is a possible change of default applications due to an insecure default value.CVE-2021-0375 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In onPackageModified of VoiceInteractionManagerService.java, there is a possible change of default applications due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-167261484
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In getMediaOutputSliceAction of RemoteMediaSlice.java, there is a possible permission bypass due to an unsafe PendingIntent.CVE-2021-0372 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In getMediaOutputSliceAction of RemoteMediaSlice.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174047735
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In CrossProfileAppsServiceImpl.java, there is the possibility of an application's INTERACT_ACROSS_PROFILES grant state not displaying properly in the setting UICVE-2021-0369 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In CrossProfileAppsServiceImpl.java, there is the possibility of an application's INTERACT_ACROSS_PROFILES grant state not displaying properly in the setting UI due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-166561076
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 10, 2021In deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit Screen Pinning due to a permissions bypass.CVE-2020-0025 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit Screen Pinning due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-135604684
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.