Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
529 results · page 9 of 11
Aug 18, 2022Improper access control in the Intel(R) DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalation of privilege viCVE-2022-26017 · Other software · Intel · reported by secure@intel.comHigh 8
Improper access control in the Intel(R) DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 18, 2022IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site request forgery which could allow an attacker to execute mCVE-2021-38868 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force Id: 208310.
- Product
- Engineering Requirements Quality Assistant On-Premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 18, 2022IBM Engineering Requirements Quality Assistant On-Premises (All versions) could allow an authenticated user to obtain sensitive information due to improper clieCVE-2021-29799 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Engineering Requirements Quality Assistant On-Premises (All versions) could allow an authenticated user to obtain sensitive information due to improper client side validation. IBM X-Force ID: 203738.
- Product
- Engineering Requirements Quality Assistant On-Premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 18, 2022IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting.CVE-2021-29790 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203440.
- Product
- Engineering Requirements Quality Assistant On-Premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 18, 2022IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting.CVE-2021-29788 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Engineering Requirements Quality Assistant On-Premises (All versions) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 203310.
- Product
- Engineering Requirements Quality Assistant On-Premises
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 10, 2022The lyubolp/Barry-Voice-Assistant repository through 2021-01-18 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31541 · Other software · Barry Voice Assistant Project · reported by MITRECritical 9.3
The lyubolp/Barry-Voice-Assistant repository through 2021-01-18 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Barry Voice Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2022Due to improper error handling an authenticated user can crash CLA assistant instance.CVE-2022-29617 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
Due to improper error handling an authenticated user can crash CLA assistant instance. This could impact the availability of the application.
- Product
- CLA Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2022Windows Upgrade Assistant Remote Code Execution VulnerabilityCVE-2022-24543 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Upgrade Assistant Remote Code Execution Vulnerability
- Product
- Windows Upgrade Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Mar 18, 2022IBM Engineering Requirements Quality Assistant prior to 3.1.3 could allow an authenticated user to cause a denial of service.CVE-2021-29899 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Engineering Requirements Quality Assistant prior to 3.1.3 could allow an authenticated user to cause a denial of service. IBM X-Force ID: 207413.
- Product
- Engineering Requirements Quality Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Mar 10, 2022An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal neCVE-2020-36517 · Other software · Home-assistant · reported by MITREHigh 7.5
An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration.
- Product
- Home-assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.home-assistant.iogithub.com
Mar 3, 2022A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the secuCVE-2022-23708 · Other software · Elastic · reported by security@elastic.coMedium 4.3
A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.
- Product
- elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.cosecurity.netapp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6922 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6921 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6920 · Other software · HP · reported by hp-security-alert@hp.comMedium 5.5
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6919 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6918 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Feb 16, 2022Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support AssistaCVE-2020-6917 · Other software · HP · reported by hp-security-alert@hp.comHigh 7.8
Potential security vulnerabilities including compromise of integrity, and allowed communication with untrusted clients has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsupport.hp.com
Jan 28, 2022Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.CVE-2022-23456 · Other software · HP · reported by hp-security-alert@hp.comMedium 5.5
Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.
- Product
- Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hp.comsupport.hp.com
Jan 10, 2022Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information.CVE-2022-22289 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.3
Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information.
- Product
- S Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jan 10, 2022HwPCAssistant has a path traversal vulnerability.CVE-2021-40003 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
HwPCAssistant has a path traversal vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Jan 3, 2022HwPCAssistant has a Improper Input Validation vulnerability.Successful exploitation of this vulnerability may create any file with the system app permission.CVE-2021-39970 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
HwPCAssistant has a Improper Input Validation vulnerability.Successful exploitation of this vulnerability may create any file with the system app permission.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Jan 3, 2022HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file.CVE-2021-37128 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevice.harmonyos.comdevice.harmonyos.com
Dec 16, 2021The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineerCVE-2021-45099 · Other software · SSH & Web Terminal Project · reported by MITREHigh 8.8
The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against complex social engineering situations
- Product
- SSH & Web Terminal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 14, 2021An issue was discovered in UiPath Assistant 21.4.4.CVE-2021-44042 · Other software · Uipath · reported by MITRECritical 9.8
An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the URI handler for uipath-assistant:// is not correctly encoded, resulting in attacker-controlled content being injected into the error message displayed (when the injected content does not match an existing process). A determined attacker could leverage this to execute JavaScript in the context of the Electron application.
- Product
- Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.uipath.comdocs.uipath.com
Dec 14, 2021UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-asCVE-2021-44041 · Other software · Uipath · reported by MITRECritical 9.8
UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI handler for uipath-assistant://. This allows an attacker to execute code on a victim's machine or capture NTLM credentials by supplying a networked or WebDAV file path.
- Product
- Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.uipath.comdocs.uipath.com
Nov 23, 2021Windows 10 Update Assistant Elevation of Privilege VulnerabilityCVE-2021-43211 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows 10 Update Assistant Elevation of Privilege Vulnerability
- Product
- Windows Update Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 23, 2021Windows 10 Update Assistant Elevation of Privilege VulnerabilityCVE-2021-42297 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5
Windows 10 Update Assistant Elevation of Privilege Vulnerability
- Product
- Windows Update Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 17, 2021Improper input validation for Intel(R) EMA before version 1.5.0 may allow an unauthenticated user to potentially enable denial of service via network access.CVE-2021-0013 · Other software · Intel · reported by secure@intel.comHigh 7.5
Improper input validation for Intel(R) EMA before version 1.5.0 may allow an unauthenticated user to potentially enable denial of service via network access.
- Product
- Endpoint Management Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2021Windows 10 Update Assistant Elevation of Privilege VulnerabilityCVE-2021-36945 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Windows 10 Update Assistant Elevation of Privilege Vulnerability
- Product
- Windows Update Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jun 21, 2021Greenbone Security Assistant (GSA) before 8.0.2 and Greenbone OS (GOS) before 5.0.10 allow XSS during 404 URL handling in gsad.CVE-2019-25047 · Other software · Greenbone · reported by MITREMedium 6.1
Greenbone Security Assistant (GSA) before 8.0.2 and Greenbone OS (GOS) before 5.0.10 allow XSS during 404 URL handling in gsad.
- Product
- Greenbone Security Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021Greenbone Security Assistant (GSA) before 7.0.3 and Greenbone OS (GOS) before 5.0.0 allow Host Header Injection.CVE-2018-25016 · Other software · Greenbone · reported by MITRECritical 9.8
Greenbone Security Assistant (GSA) before 7.0.3 and Greenbone OS (GOS) before 5.0.0 allow Host Header Injection.
- Product
- Greenbone Security Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Improper link resolution before file access in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of priCVE-2021-0094 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper link resolution before file access in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via local access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Uncontrolled search path element in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via CVE-2021-0090 · Other software · Intel · reported by secure@intel.comHigh 7.3
Uncontrolled search path element in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via local access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2021Insufficient control flow management in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable escalation of privilege viaCVE-2021-0073 · Other software · Intel · reported by secure@intel.comHigh 7.8
Insufficient control flow management in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021SUSI.AI is an intelligent Open Source personal assistant.CVE-2020-4039 · Other software · fossasia · reported by GitHubHigh 8.6
SUSI.AI is an intelligent Open Source personal assistant. SUSI.AI Server before version d27ed0f has a directory traversal vulnerability due to insufficient input validation. Any admin config and file readable by the app can be retrieved by the attacker. Furthermore, some files can also be moved or deleted.
- Product
- susi_server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2021Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Diagnostic Assistant).CVE-2021-2303 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.9
Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Diagnostic Assistant). The supported version that is affected is Prior to 2.12.41. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise OSS Support Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all OSS Support Tools accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).
- Product
- OSS Support Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comzerodayinitiative.com
Mar 11, 2021Windows 10 Update Assistant Elevation of Privilege VulnerabilityCVE-2021-27070 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Windows 10 Update Assistant Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 2004
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Mar 4, 2021Calling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial of service attack by hijacking the proviCVE-2021-25341 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 4
Calling of non-existent provider in S Assistant prior to version 6.5.01.22 allows unauthorized actions including denial of service attack by hijacking the provider.
- Product
- S Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Jan 26, 2021Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations.CVE-2021-3152 · Other software · Home-assistant · reported by MITREMedium 5.3
Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant; however, Home Assistant does have a security update that is worthwhile in addressing this situation
- Product
- Home-assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhome-assistant.iohome-assistant.io
Jan 12, 2021In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not intended to be used by thCVE-2021-21471 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not intended to be used by the user. This could impact the integrity of the application.
- Product
- CLA-Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2021IBM Engineering Requirements Quality Assistant On-Premises could allow an authenticated user to obtain sensitive information due to improper input validation.CVE-2020-4667 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM Engineering Requirements Quality Assistant On-Premises could allow an authenticated user to obtain sensitive information due to improper input validation. IBM X-Force ID: 186282.
- Product
- Engineering Requirements Quality Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 8, 2021IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting.CVE-2020-4666 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186281.
- Product
- Engineering Requirements Quality Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 8, 2021IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting.CVE-2020-4664 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186235.
- Product
- Engineering Requirements Quality Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jan 8, 2021IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting.CVE-2020-4663 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186234.
- Product
- Engineering Requirements Quality Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Dec 15, 2020In onNotificationRemoved of Assistant.java, there is a possible leak of sensitive information to logs.CVE-2020-0476 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In onNotificationRemoved of Assistant.java, there is a possible leak of sensitive information to logs. This could lead to local information disclosure with System execution privileges required. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-162014574
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Nov 12, 2020Incorrect default permissions in the Intel(R) DSA before version 20.8.30.6 may allow an authenticated user to potentially enable denial of service via local accCVE-2020-24460 · Other software · Intel · reported by secure@intel.comMedium 5.5
Incorrect default permissions in the Intel(R) DSA before version 20.8.30.6 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2020Insufficiently protected credentials in the Intel(R) EMA before version 1.3.3 may allow an authorized user to potentially enable information disclosure via locaCVE-2020-12316 · Other software · Intel · reported by secure@intel.comMedium 5.5
Insufficiently protected credentials in the Intel(R) EMA before version 1.3.3 may allow an authorized user to potentially enable information disclosure via local access.
- Product
- Endpoint Management Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2020Path traversal in the Intel(R) EMA before version 1.3.3 may allow an unauthenticated user to potentially enable escalation of privilege via network access.CVE-2020-12315 · Other software · Intel · reported by secure@intel.comCritical 9.8
Path traversal in the Intel(R) EMA before version 1.3.3 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
- Product
- Endpoint Management Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2020OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS mesCVE-2020-13626 · Other software · Oneplus · reported by MITREMedium 4.6
OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS message when the SMS application is locked.
- Product
- App Locker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmedium.comsupport.oneplus.com
Oct 5, 2020Improper permissions in the Intel(R) Driver & Support Assistant before version 20.7.26.7 may allow an authenticated user to potentially enable escalation of priCVE-2020-12302 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper permissions in the Intel(R) Driver & Support Assistant before version 20.7.26.7 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Driver & Support Assistant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.