Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,141 results · page 8 of 23
Jul 12, 2022Improper permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability will affect integrity.CVE-2021-40013 · Other software · Huawei · reported by psirt@huawei.comMedium 6.5
Improper permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability will affect integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jul 7, 2022EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry.CVE-2022-34007 · Other software · EQS · reported by MITREMedium 6.1
EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry.
- Product
- Integrity Line
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeusanctions.integrityline.compacketstormsecurity.com
Jun 14, 2022Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in SnapdrCVE-2021-35082 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.1
Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in Snapdragon Industrial IOT
- Product
- Snapdragon Industrial IOT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 14, 2022Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, SnaCVE-2021-30347 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.1
Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 14, 2022Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, SnapdragoCVE-2021-30343 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.1
Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Jun 14, 2022Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, SnapdragoCVE-2021-30342 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.1
Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
May 23, 2022Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check.CVE-2022-28944 · Other software · Emcosoftware · reported by MITREHigh 8.8
Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network Inventory for Windows 5.8.22 and Network Software Scanner for Windows 2.0.8 and UnLock IT for Windows 6.1.1. The impact is: execute arbitrary code (remote). The component is: Updater. The attack vector is: To exploit this vulnerability, a user must trigger an update of an affected installation of EMCO Software. ¶¶ Multiple products from EMCO Software are affected by a remote code execution vulnerability during the update process.
- Product
- MSI Package Builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2022The frame scheduling module has a Use After Free (UAF) vulnerability.Successful exploitation of this vulnerability will affect data integrity, availability, andCVE-2022-29794 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
The frame scheduling module has a Use After Free (UAF) vulnerability.Successful exploitation of this vulnerability will affect data integrity, availability, and confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 13, 2022The kernel module has a UAF vulnerability.Successful exploitation of this vulnerability will affect data integrity and availability.CVE-2022-22260 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
The kernel module has a UAF vulnerability.Successful exploitation of this vulnerability will affect data integrity and availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
May 12, 2022An attacker, who gained elevated privileges via some other vulnerability, may be able to read data from Boot ROM resulting in a loss of system integrity.CVE-2021-26366 · Other software · AMD · reported by psirt@amd.comHigh 7.1
An attacker, who gained elevated privileges via some other vulnerability, may be able to read data from Boot ROM resulting in a loss of system integrity.
- Product
- Ryzen™ Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2022A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity of data.CVE-2021-26390 · Other software · AMD · reported by psirt@amd.comMedium 6.2
A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity of data.
- Product
- Ryzen™ Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2022Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability.CVE-2021-26332 · Other software · AMD · reported by psirt@amd.comHigh 7.1
Failure to verify SEV-ES TMR is not in MMIO space, SEV-ES FW could result in a potential loss of integrity or availability.
- Product
- 3rd Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2022A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs.CVE-2021-26324 · Other software · AMD · reported by psirt@amd.comHigh 7.8
A bug with the SEV-ES TMR may lead to a potential loss of memory integrity for SNP-active VMs.
- Product
- 3rd Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2022Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying CVE-2021-42581 · Other software · Ramdajs · reported by MITRECritical 9.1
Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "__proto__") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes
- Product
- Ramda
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjsfiddle.net
Apr 11, 2022The customization framework has a vulnerability of improper permission control.Successful exploitation of this vulnerability may affect data integrity.CVE-2022-22257 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The customization framework has a vulnerability of improper permission control.Successful exploitation of this vulnerability may affect data integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Apr 11, 2022The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affect system stability.CVE-2022-22253 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affect system stability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Mar 10, 2022There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and integrity.CVE-2021-40053 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and integrity.
- Product
- Emui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6922 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6921 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6920 · Other software · HP · reported by hp-security-alert@hp.comMedium 5.5
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6919 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6918 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6917 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Jan 25, 2022The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrity protection.CVE-2021-46559 · Other software · Moxa · reported by MITREHigh 7.5
The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrity protection.
- Product
- Tn-5900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2022The eID module has an out-of-bounds memory write vulnerability,Successful exploitation of this vulnerability may affect data integrity.CVE-2021-40028 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The eID module has an out-of-bounds memory write vulnerability,Successful exploitation of this vulnerability may affect data integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Jan 3, 2022HHEE system has a Code Injection vulnerability.Successful exploitation of this vulnerability may affect HHEE system integrity.CVE-2021-39979 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
HHEE system has a Code Injection vulnerability.Successful exploitation of this vulnerability may affect HHEE system integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Dec 15, 2021Ivanti Workspace Control before 10.4.50.0 allows attackers to degrade integrity.CVE-2019-19138 · Network & remote access · Ivanti · reported by MITREHigh 7.5
Ivanti Workspace Control before 10.4.50.0 allows attackers to degrade integrity.
- Product
- Workspace Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
Dec 8, 2021By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or CVE-2021-23861 · Other software · Bosch · reported by psirt@bosch.comMedium 6.5
By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.
- Product
- BVMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Dec 6, 2021Insecure creation of temporary directories in tmate-ssh-server 2.3.0 allows a local attacker to compromise the integrity of session handling.CVE-2021-44513 · Other software · Tmate · reported by MITREHigh 7
Insecure creation of temporary directories in tmate-ssh-server 2.3.0 allows a local attacker to compromise the integrity of session handling.
- Product
- Tmate-ssh-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Dec 6, 2021World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handlingCVE-2021-44512 · Other software · Tmate · reported by MITREHigh 7
World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handling, or obtain the read-write session ID from a read-only session symlink in this directory.
- Product
- Tmate-ssh-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comopenwall.com
Nov 23, 2021A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.CVE-2021-35052 · Other software · Kaspersky · reported by vulnerability@kaspersky.comHigh 7.8
A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.
- Product
- Password Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.kaspersky.comzerodayinitiative.com
Nov 16, 2021Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.CVE-2021-26323 · Other software · AMD · reported by psirt@amd.comHigh 7.8
Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.
- Product
- 3rd Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Insufficient input validation in ASP firmware for discrete TPM commands could allow a potential loss of integrity and denial of service.CVE-2020-12946 · Other software · AMD · reported by psirt@amd.comHigh 7.1
Insufficient input validation in ASP firmware for discrete TPM commands could allow a potential loss of integrity and denial of service.
- Product
- Ryzen™ Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.CVE-2021-26326 · Other software · AMD · reported by psirt@amd.comHigh 7.8
Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.
- Product
- 3rd Gen AMD EPYC™
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto, Snapdragon Compute, SnapdragCVE-2021-30284 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Oct 28, 2021There is a Parameter verification issue in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity.CVE-2021-36988 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Parameter verification issue in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Oct 28, 2021There is a Logic Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integrity and availability.CVE-2021-22436 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
There is a Logic Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integrity and availability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Oct 28, 2021There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity.CVE-2021-22401 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Oct 26, 2021The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file.CVE-2021-26610 · Other software · NHN COMMERCE · reported by vuln@krcert.or.krHigh 7.2
The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.
- Product
- godomall5 Std, godomall5 Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive.CVE-2021-38396 · Other software · Boston Scientific · reported by ics-cert@hq.dhs.govMedium 6.5
The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on the flash drive. An attacker could leverage this weakness to install unauthorized software using a specially crafted USB.
- Product
- ZOOM LATITUDE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Sep 27, 2021grav is vulnerable to Reliance on Cookies without Validation and Integrity CheckingCVE-2021-3818 · Other software · getgrav · reported by security@huntr.devMedium 5.3
grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking
- Product
- getgrav/grav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2021The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point.CVE-2021-22276 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.1
The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point.
- Product
- System Access Point
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Sep 21, 2021in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity.CVE-2021-41087 · Other software · in-toto · reported by GitHubMedium 5.6
in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected versions authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo). Exploiting this vulnerability is dependent on the specific policy applied. The problem has been fixed in version 0.3.0.
- Product
- in-toto-golang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file CVE-2020-7874 · Other software · TOBESOFT · reported by vuln@krcert.or.krHigh 8.8
Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension.
- Product
- NEXACRO14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2021Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary file download and exeCVE-2020-7873 · Other software · Younglimwon Co., Ltd · reported by vuln@krcert.or.krHigh 8.8
Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary file download and execution.
- Product
- K-System WellComm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).CVE-2021-38588 · Websites & servers · Cpanel · reported by MITREHigh 8.1
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587).
- Product
- Cpanel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cpanel.netdocs.cpanel.net
Aug 9, 2021A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjackCVE-2021-37788 · Other software · Gurock · reported by MITREMedium 5.4
A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vulnerability is due to insufficient input validation of iFrame data in HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted HTTP packets with malicious iFrame data. A successful exploit could allow the attacker to perform a clickjacking attack where the user is tricked into clicking a malicious link.
- Product
- Testrail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Aug 5, 2021In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Message Integrity CheckCVE-2021-37605 · Other software · Microchip · reported by MITREHigh 7.5
In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Message Integrity Check (MIC) bytes.
- Product
- Miwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordww1.microchip.comww1.microchip.com
Aug 2, 2021There is an Improper Validation of Integrity Check Value Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system tCVE-2021-22442 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an Improper Validation of Integrity Check Value Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Aug 2, 2021There is a Configuration Defect Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integrity and availability.CVE-2021-22435 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
There is a Configuration Defect Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integrity and availability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.