Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
12 results
Jul 14, 2022A denial of service vulnerability exists in some Xiaomi models of phones.CVE-2020-14127 · Other software · MI · reported by security@xiaomi.comHigh 7.5
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by heap overflow and can be exploited by attackers to make remote denial of service.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Jun 8, 2022A denial of service vulnerability exists in some Xiaomi models of phones.CVE-2020-14125 · Other software · MI · reported by security@xiaomi.comHigh 7.5
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound read/write and can be exploited by attackers to make denial of service.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Apr 22, 2022There is a pointer double free vulnerability in Some MIUI Services.CVE-2020-14123 · Other software · MI · reported by security@xiaomi.comHigh 7.5
There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause the pointer to be repeatedly released through malicious operations, resulting in the affected module crashing and affecting normal functionality, and if successfully exploited the vulnerability can cause elevation of privileges.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Apr 21, 2022Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of parameter verificationCVE-2020-14122 · Other software · MI · reported by security@xiaomi.comMedium 5.5
Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of parameter verification, resulting in user information leakage.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Apr 21, 2022Some Xiaomi models have a vulnerability in a certain application.CVE-2020-14120 · Other software · MI · reported by security@xiaomi.comHigh 8.8
Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum when using a three-party application to pass in parameters, and attackers can induce users to install a malicious app and use the vulnerability to achieve elevated privileges, making the normal services of the system affected.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Apr 20, 2021The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.CVE-2020-14105 · Other software · MI · reported by security@xiaomi.comMedium 5.5
The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivacy.mi.comprivacy.mi.com
Apr 8, 2021The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI < 2021.01.26.CVE-2020-14106 · Other software · MI · reported by security@xiaomi.comMedium 5.5
The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI < 2021.01.26.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivacy.mi.comprivacy.mi.com
Apr 8, 2021The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.CVE-2020-14103 · Other software · MI · reported by security@xiaomi.comMedium 5.5
The application in the mobile phone can read the SNO information of the device, Xiaomi 10 MIUI < 2020.01.15.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprivacy.mi.comprivacy.mi.com
Mar 6, 2020An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices.CVE-2020-9531 · Other software · MI · reported by MITREHigh 7.3
An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. In the Web resources of GetApps(com.xiaomi.mipicks), the parameters passed in are read and executed. After reading the resource files, relevant components open the link of the incoming URL. Although the URL is safe and can pass security detection, the data carried in the parameters are loaded and executed. An attacker can use NFC tools to get close enough to a user's unlocked phone to cause apps to be installed and information to be leaked. This is fixed on version: 2001122.
- Product
- Miui Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.xiaomi.comzerodayinitiative.com
Mar 6, 2020An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices.CVE-2020-9530 · Other software · MI · reported by MITREMedium 6.5
An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. The export component of GetApps(com.xiaomi.mipicks) mishandles the functionality of opening other components. Attackers need to induce users to open specific web pages in a specific network environment. By jumping to the WebView component of Messaging(com.android.MMS) and loading malicious web pages, information leakage can occur. This is fixed on version: 2001122; 11.0.1.54.
- Product
- Miui Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.xiaomi.comzerodayinitiative.com
Apr 18, 2019A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the WallpapeCVE-2019-11015 · Other software · Miui · reported by MITREMedium 6.8
A vulnerability was found in the MIUI OS version 10.1.3.0 that allows a physically proximate attacker to bypass Lockscreen based authentication via the Wallpaper Carousel application to obtain sensitive Clipboard data and the user's stored credentials (partially). This occurs because of paste access to a social media login page.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2019A URL spoofing vulnerability was found in all international versions of Xiaomi Mi browser 10.5.6-g (aka the MIUI native browser) and Mint Browser 1.5.3 due to tCVE-2019-10875 · Other software · MI · reported by MITREMedium 6.5
A URL spoofing vulnerability was found in all international versions of Xiaomi Mi browser 10.5.6-g (aka the MIUI native browser) and Mint Browser 1.5.3 due to the way they handle the "q" query parameter. The portion of an https URL before the ?q= substring is not shown to the user.
- Product
- MI Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsec.xiaomi.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.