Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,187 results · page 8 of 24

Sep 9, 2022Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrary directory using diCVE-2022-39844 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Improper validation of integrity check vulnerability in Smart Switch PC prior to version 4.3.22083 allows local attackers to delete arbitrary directory using directory junction.
Product
Smart Switch PC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Aug 31, 2022HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potentiCVE-2022-36130 · Other software · Hashicorp · reported by MITRECritical 9.9
HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated with the correct scopes, allowing potential privilege escalation for authorized users of another scope. Fixed in Boundary 0.10.2.
Product
Boundary
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record discuss.hashicorp.com discuss.hashicorp.com
Aug 19, 2022Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or autCVE-2022-2793 · Other software · Emerson Electric · reported by ics-cert@hq.dhs.govMedium 5.9
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or authorization of data packets after establishing a connection for the SRTP protocol.
Product
Proficy Machine Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 17, 2022The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity.CVE-2022-30262 · Other software · Emerson · reported by MITREHigh 7.8
The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP protocol to transmit firmware updates. Firmware updates are supplied as CAB archive files containing a binary firmware image. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.
Product
Controlwave PAC Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov forescout.com
Jul 26, 2022The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity.CVE-2022-30272 · Other software · Motorola · reported by MITREHigh 7.2
The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performing firmware updates. In case of the Easy Configurator, firmware updates are performed through access to the Web UI where file system, kernel, package, bundle, or application images can be installed. Firmware updates for the Front End Processor (FEP) module are performed via access to the SSH interface (22/TCP), where a .hex file image is transferred and a bootloader script invoked. File system, kernel, package, and bundle updates are supplied as RPM (RPM Package Manager) files while FEP updates are supplied as S-rec files. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.
Product
Ace1000 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov forescout.com
Jul 26, 2022Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity.CVE-2022-30269 · Other software · Motorola · reported by MITREHigh 8.8
Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In the case of the Easy Configurator, application images (as PLX/DAT/APP/CRC files) are uploaded via the Web UI. In case of the C toolkit, they are transferred and installed using SFTP/SSH. In each case, application images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks.
Product
Ace1000 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov forescout.com
Jul 26, 2022The Motorola MDLC protocol through 2022-05-02 mishandles message integrity.CVE-2022-30273 · Other software · Motorolasolutions · reported by MITRECritical 9.8
The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm (TEA) block-cipher in ECB mode. This mode of operation does not offer message integrity and offers reduced confidentiality above the block level, as demonstrated by an ECB Penguin attack against any block ciphers.
Product
Mdlc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record en.wikipedia.org cisa.gov
Jul 26, 2022JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity.CVE-2022-29958 · Other software · Jtekt · reported by MITRECritical 9.8
JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including downloading projects and control logic to the PLC. Control logic is downloaded to the PLC on a block-by-block basis with a given memory address and a blob of machine code. The logic that is downloaded to the PLC is not cryptographically authenticated, allowing an attacker to execute arbitrary machine code on the PLC's CPU module in the context of the runtime. In the case of the PC10G-CPU, and likely for other CPU modules of the TOYOPUC family, a processor without MPU or MMU is used and this no memory protection or privilege-separation capabilities are available, giving an attacker full control over the CPU.
Product
Pc10g-cpu Tcc-6353 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov forescout.com
Jul 12, 2022Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allows local attackers CVE-2022-33711 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allows local attackers to delete arbitrary directory using directory junction.
Product
Samsung USB Driver Windows Installer for Mobile Phones
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jul 12, 2022Improper permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability will affect integrity.CVE-2021-40013 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Improper permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability will affect integrity.
Product
EMUI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Jul 7, 2022EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry.CVE-2022-34007 · Other software · EQS · reported by MITREMedium 6.1
EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry.
Product
Integrity Line
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eusanctions.integrityline.com packetstormsecurity.com
Jun 14, 2022Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in SnapdrCVE-2021-35082 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.1
Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in Snapdragon Industrial IOT
Product
Snapdragon Industrial IOT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jun 14, 2022Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, SnaCVE-2021-30347 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.1
Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jun 14, 2022Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, SnapdragoCVE-2021-30343 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.1
Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Jun 14, 2022Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, SnapdragoCVE-2021-30342 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.1
Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
May 23, 2022Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check.CVE-2022-28944 · Other software · Emcosoftware · reported by MITREHigh 8.8
Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network Inventory for Windows 5.8.22 and Network Software Scanner for Windows 2.0.8 and UnLock IT for Windows 6.1.1. The impact is: execute arbitrary code (remote). The component is: Updater. The attack vector is: To exploit this vulnerability, a user must trigger an update of an affected installation of EMCO Software. ¶¶ Multiple products from EMCO Software are affected by a remote code execution vulnerability during the update process.
Product
MSI Package Builder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 13, 2022The frame scheduling module has a Use After Free (UAF) vulnerability.Successful exploitation of this vulnerability will affect data integrity, availability, andCVE-2022-29794 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The frame scheduling module has a Use After Free (UAF) vulnerability.Successful exploitation of this vulnerability will affect data integrity, availability, and confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
May 13, 2022The kernel module has a UAF vulnerability.Successful exploitation of this vulnerability will affect data integrity and availability.CVE-2022-22260 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
The kernel module has a UAF vulnerability.Successful exploitation of this vulnerability will affect data integrity and availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
May 12, 2022An attacker, who gained elevated privileges via some other vulnerability, may be able to read data from Boot ROM resulting in a loss of system integrity.CVE-2021-26366 · Other software · AMD · reported by psirt@amd.comHigh 7.1
An attacker, who gained elevated privileges via some other vulnerability, may be able to read data from Boot ROM resulting in a loss of system integrity.
Product
Ryzen™ Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record amd.com amd.com
May 10, 2022A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity of data.CVE-2021-26390 · Other software · AMD · reported by psirt@amd.comMedium 6.2
A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity of data.
Product
Ryzen™ Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record amd.com amd.com
May 10, 2022Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability.CVE-2021-26332 · Other software · AMD · reported by psirt@amd.comHigh 7.1
Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability.
Product
3rd Gen AMD EPYC™
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record amd.com amd.com
May 10, 2022A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs.CVE-2021-26324 · Other software · AMD · reported by psirt@amd.comHigh 7.8
A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs.
Product
3rd Gen AMD EPYC™
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record amd.com amd.com
May 10, 2022Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying CVE-2021-42581 · Other software · Ramdajs · reported by MITRECritical 9.1
Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "__proto__") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes
Product
Ramda
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com jsfiddle.net
Apr 11, 2022The customization framework has a vulnerability of improper permission control.Successful exploitation of this vulnerability may affect data integrity.CVE-2022-22257 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The customization framework has a vulnerability of improper permission control.Successful exploitation of this vulnerability may affect data integrity.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Apr 11, 2022The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affect system stability.CVE-2022-22253 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affect system stability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 28, 2022A vulnerability was found in Netegrity SiteMinder up to 4.5.1 and classified as critical.CVE-2005-10001 · Other software · Netegrity · reported by VulDBMedium 5.4
A vulnerability was found in Netegrity SiteMinder up to 4.5.1 and classified as critical. Affected by this issue is the file /siteminderagent/pwcgi/smpwservicescgi.exe of the component Login. The manipulation of the argument target leads to an open redirect. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Product
SiteMinder
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vuldb.com vuldb.com
Mar 10, 2022There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and integrity.CVE-2021-40053 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and integrity.
Product
Emui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6922 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
Product
Support Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6921 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
Product
Support Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6920 · Other software · HP · reported by hp-security-alert@hp.comMedium 5.5
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
Product
Support Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6919 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
Product
Support Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6918 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
Product
Support Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6917 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
Product
Support Assistant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com support.hp.com
Jan 25, 2022The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrity protection.CVE-2021-46559 · Other software · Moxa · reported by MITREHigh 7.5
The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrity protection.
Product
Tn-5900 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record moxa.com moxa.com
Jan 10, 2022The eID module has an out-of-bounds memory write vulnerability,Successful exploitation of this vulnerability may affect data integrity.CVE-2021-40028 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The eID module has an out-of-bounds memory write vulnerability,Successful exploitation of this vulnerability may affect data integrity.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record device.harmonyos.com device.harmonyos.com
Jan 3, 2022HHEE system has a Code Injection vulnerability.Successful exploitation of this vulnerability may affect HHEE system integrity.CVE-2021-39979 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
HHEE system has a Code Injection vulnerability.Successful exploitation of this vulnerability may affect HHEE system integrity.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record device.harmonyos.com device.harmonyos.com
Dec 15, 2021Ivanti Workspace Control before 10.4.50.0 allows attackers to degrade integrity.CVE-2019-19138 · Network & remote access · Ivanti · reported by MITREHigh 7.5
Ivanti Workspace Control before 10.4.50.0 allows attackers to degrade integrity.
Product
Workspace Control
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forums.ivanti.com forums.ivanti.com
Dec 8, 2021By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or CVE-2021-23861 · Other software · Bosch · reported by psirt@bosch.comMedium 6.5
By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.
Product
BVMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.bosch.com psirt.bosch.com
Dec 6, 2021Insecure creation of temporary directories in tmate-ssh-server 2.3.0 allows a local attacker to compromise the integrity of session handling.CVE-2021-44513 · Other software · Tmate · reported by MITREHigh 7
Insecure creation of temporary directories in tmate-ssh-server 2.3.0 allows a local attacker to compromise the integrity of session handling.
Product
Tmate-ssh-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com openwall.com
Dec 6, 2021World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handlingCVE-2021-44512 · Other software · Tmate · reported by MITREHigh 7
World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handling, or obtain the read-write session ID from a read-only session symlink in this directory.
Product
Tmate-ssh-server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com openwall.com
Nov 23, 2021A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.CVE-2021-35052 · Other software · Kaspersky · reported by vulnerability@kaspersky.comHigh 7.8
A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.
Product
Password Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.kaspersky.com zerodayinitiative.com
Nov 16, 2021Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.CVE-2021-26323 · Other software · AMD · reported by psirt@amd.comHigh 7.8
Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.
Product
3rd Gen AMD EPYC™
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record amd.com amd.com
Nov 16, 2021Insufficient input validation in ASP firmware for discrete TPM commands could allow a potential loss of integrity and denial of service.CVE-2020-12946 · Other software · AMD · reported by psirt@amd.comHigh 7.1
Insufficient input validation in ASP firmware for discrete TPM commands could allow a potential loss of integrity and denial of service.
Product
Ryzen™ Series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record amd.com amd.com
Nov 16, 2021Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.CVE-2021-26326 · Other software · AMD · reported by psirt@amd.comHigh 7.8
Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.
Product
3rd Gen AMD EPYC™
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record amd.com amd.com
Nov 12, 2021Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto, Snapdragon Compute, SnapdragCVE-2021-30284 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com qualcomm.com
Oct 28, 2021There is a Parameter verification issue in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity.CVE-2021-36988 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Parameter verification issue in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity.
Product
EMUI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Oct 28, 2021There is a Logic Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integrity and availability.CVE-2021-22436 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
There is a Logic Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integrity and availability.
Product
EMUI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Oct 28, 2021There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity.CVE-2021-22401 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity.
Product
EMUI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Oct 26, 2021The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file.CVE-2021-26610 · Other software · NHN COMMERCE · reported by vuln@krcert.or.krHigh 7.2
The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.
Product
godomall5 Std, godomall5 Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record boho.or.kr boho.or.kr
Oct 4, 2021The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive.CVE-2021-38396 · Other software · Boston Scientific · reported by ics-cert@hq.dhs.govMedium 6.5
The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An attacker could leverage this weakness to install unauthorized software using a specially crafted USB.
Product
ZOOM LATITUDE
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.cisa.gov us-cert.cisa.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.