Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
39 results
Oct 20, 2026HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, faCVE-2026-113680 · Other software · harfbuzz · reported by VulnCheckMedium 6.8
HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly shaper host imports buffer_set_contents, face_create, and font_set_coords. Attackers can supply a crafted font whose embedded wasm module passes out-of-range addresses with non-zero lengths, crashing any application that shapes text with the font.
- Product
- harfbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has aCVE-2026-113679 · Other software · harfbuzz · reported by VulnCheckHigh 7.3
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module places the output buffer near linear memory's end, writing glyph-name bytes into host memory to crash or corrupt applications.
- Product
- harfbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2026Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.CVE-2026-81797 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 22, 2026Image Buzz: Unauthorized API key modificationCVE-2025-14484 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys (Pixabay, Unsplash, Pixels) configured by site administrators via the 'pixabay_api', 'unsplash_api', or 'pixels_api' parameters.
- Product
- Image Buzz
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Image Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcodecanyon.networdfence.com
May 27, 2026WP AutoBuzz: Cross-Site Request ForgeryCVE-2026-8911 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP AutoBuzz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This vulnerability bypasses WordPress's DISALLOW_UNFILTERED_HTML protection because the unsanitized value is written directly via update_option at the plugin level, entirely outside of WordPress post content handling.
- Product
- WP AutoBuzz
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update WP AutoBuzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 22, 2026Buzz Comments: Stored Cross-Site ScriptingCVE-2026-6041 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Buzz Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom Buzz Avatar' (buzz_comments_avatar_image) setting in all versions up to, and including, 0.9.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the plugin settings page.
- Product
- Buzz Comments
- Affected
- up to 0.9.4
- What to do
- Affects up to 0.9.4. Update Buzz Comments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 5, 2026Buzz Stone | Magazine & Viral Blog: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27339 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Buzz Stone | Magazine & Viral Blog WordPress Theme buzzstone allows PHP Local File Inclusion.This issue affects Buzz Stone | Magazine & Viral Blog WordPress Theme: from n/a through <= 1.0.2.
- Product
- Buzz Stone | Magazine & Viral Blog
- Affected
- up to 1.0.2
- What to do
- Affects up to 1.0.2. Update Buzz Stone | Magazine & Viral Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 18, 2026HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability.CVE-2026-0943 · Other software · JV · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability. Versions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hb_src.tar.gz in the source tarball, which is affected by CVE-2026-22693.
- Product
- HarfBuzz::Shaper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.commetacpan.org
Jan 10, 2026HarfBuzz is a text shaping engine.CVE-2026-22693 · Other software · harfbuzz · reported by GitHubMedium 5.3
HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.
- Product
- harfbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025SQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute arbitrary code via a crafted script.CVE-2023-38913 · Other software · Anirbandutta9 · reported by MITREMedium 5.3
SQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute arbitrary code via a crafted script.
- Product
- News-buzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Aug 17, 2025A security vulnerability has been detected in BuzzFeed App 2024.9 on Android.CVE-2025-9093 · Other software · Buzzfeed · reported by VulDBLow 1.9
A security vulnerability has been detected in BuzzFeed App 2024.9 on Android. This affects an unknown part of the file AndroidManifest.xml of the component com.buzzfeed.android. The manipulation leads to improper export of android application components. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Product
- Buzzfeed
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025Blogger Buzz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-54680 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Blogger Buzz blogger-buzz allows Stored XSS.This issue affects Blogger Buzz: from n/a through <= 1.2.6.
- Product
- Blogger Buzz
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update Blogger Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025OnionBuzz: Cross-Site Request Forgery (CSRF)CVE-2025-53312 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Looks Awesome OnionBuzz onionbuzz-viral-quiz allows Stored XSS.This issue affects OnionBuzz: from n/a through <= 1.0.7.
- Product
- OnionBuzz
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update OnionBuzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 12, 2025BlogBuzzTime for WP: Stored Cross-Site ScriptingCVE-2025-2078 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The BlogBuzzTime for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
- Product
- BlogBuzzTime for WP
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update BlogBuzzTime for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 18, 2025Buzz Club – Night Club, DJ and Music Festival Event: Unauthorized modification of data that can lead to a denial of serviceCVE-2025-0515 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmasters_hide_admin_notice' function in all versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'hide' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.
- Product
- Buzz Club – Night Club, DJ and Music Festival Event
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update Buzz Club – Night Club, DJ and Music Festival Event to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Dec 27, 2024HarfBuzz is a text shaping engine.CVE-2024-56732 · Other software · harfbuzz · reported by GitHubCritical 9.3
HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function.
- Product
- harfbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024Blogger Buzz: Missing AuthorizationCVE-2023-30476 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Sparkle Themes Blogger Buzz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blogger Buzz: from n/a through 1.2.2.
- Product
- Blogger Buzz
- Affected
- up to 1.2.2
- What to do
- Affects up to 1.2.2. Update Blogger Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 24, 2024A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0.CVE-2024-10372 · Other software · chidiwilliams · reported by VulDBLow 2
A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0. This vulnerability affects the function download_model of the file buzz/model_loader.py. The manipulation leads to insecure temporary file. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- buzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2023Buzzsprout Podcasting: Stored Cross-Site ScriptingCVE-2023-5335 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Buzzsprout Podcasting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buzzsprout' shortcode in versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Buzzsprout Podcasting
- Affected
- up to 1.8.4
- What to do
- Affects up to 1.8.4. Update Buzzsprout Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 4, 2023hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base gCVE-2023-25193 · Other software · Harfbuzz Project · reported by MITREHigh 7.5
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.
- Product
- Harfbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromium.googlesource.comgithub.com
Jan 15, 2023A vulnerability was found in bmattoso desafio_buzz_woody.CVE-2015-10048 · Other software · bmattoso · reported by VulDBMedium 5.5
A vulnerability was found in bmattoso desafio_buzz_woody. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is cb8220cbae06082c969b1776fcb2fdafb3a1006b. It is recommended to apply a patch to fix this issue. The identifier VDB-218357 was assigned to this vulnerability.
- Product
- desafio_buzz_woody
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2022In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass.CVE-2022-20448 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-237540408
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jun 23, 2022An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.CVE-2022-33068 · Other software · Harfbuzz Project · reported by MITREMedium 5.5
An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
- Product
- Harfbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2022OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" parameterCVE-2022-27107 · Other software · Orangehrm · reported by MITREMedium 5.4
OrangeHRM 4.10 is vulnerable to Stored XSS in the "Share Video" section under "OrangeBuzz" via the GET/POST "createVideo[linkAddress]" parameter
- Product
- Orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2021HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from hb_sparseset_t<hb_bit_set_invertible_t>::set and hb_set_copy).CVE-2021-45931 · Other software · Harfbuzz Project · reported by MITREMedium 6.5
HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from hb_sparseset_t<hb_bit_set_invertible_t>::set and hb_set_copy).
- Product
- Harfbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Jan 5, 2021SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/liCVE-2020-29437 · Other software · Orangehrm · reported by MITREHigh 8.1
SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint.
- Product
- Orangehrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2019An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress.CVE-2019-14231 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the ob_get_results ajax nopriv handler due to there being no sanitization prior to use in a SQL query in getResultByPointsTrivia. This allows an unauthenticated/unprivileged user to perform a SQL injection attack capable of remote code execution and information disclosure.
- Product
- An issue was discovered in the Viral Quiz Maker - OnionBuzz
- Fixed in
- 1.2.2
- What to do
- Update An issue was discovered in the Viral Quiz Maker - OnionBuzz to 1.2.2 or newer.
Full record and what to do →NVD recordopenwall.comopenwall.com
Jul 21, 2019An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress.CVE-2019-14230 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set_count ajax nopriv handler due to there being no sanitization prior to use in a SQL query in saveQuestionVote. This allows an unauthenticated/unprivileged user to perform a SQL injection attack capable of remote code execution and information disclosure.
- Product
- An issue was discovered in the Viral Quiz Maker - OnionBuzz
- Fixed in
- 1.2.7
- What to do
- Update An issue was discovered in the Viral Quiz Maker - OnionBuzz to 1.2.7 or newer.
Full record and what to do →NVD recordopenwall.comopenwall.com
Nov 15, 2018HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishCVE-2015-9274 · Other software · Harfbuzz Project · reported by MITREMedium 6.5
HarfBuzz before 1.0.4 allows remote attackers to cause a denial of service (invalid read of two bytes and application crash) because of GPOS and GSUB table mishandling, related to hb-ot-layout-gpos-table.hh, hb-ot-layout-gsub-table.hh, and hb-ot-layout-gsubgpos-private.hh.
- Product
- Harfbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2016hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other iCVE-2015-8947 · Other software · Harfbuzz Project · reported by MITREHigh 7.6
hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2016-2052.
- Product
- Harfbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgrhn.redhat.com
Jan 25, 2016Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or posCVE-2016-2052 · Other software · Harfbuzz Project · reported by chrome-cve-admin@google.comHigh 7.6
Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or possibly have other impact via crafted data, as demonstrated by a buffer over-read resulting from an inverted length check in hb-ot-font.cc, a different issue than CVE-2015-8947.
- Product
- Harfbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglechromereleases.blogspot.comlists.opensuse.org
May 20, 2015platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remoteCVE-2015-1262 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgooglechromereleases.blogspot.comlists.opensuse.org
Oct 21, 2014The EMT-Paramedic Lite (aka com.wEMTparamedicLite) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middCVE-2014-7646 · Other software · Buzztouch · reported by cret@cert.orgMedium 5.4
The EMT-Paramedic Lite (aka com.wEMTparamedicLite) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Emt-paramedic Lite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Jun 15, 2012Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attaCVE-2011-3193 · Other software · Gnome · reported by Red HatHigh 9.3
Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
- Product
- Pango
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcgit.freedesktop.orgcgit.freedesktop.org
Jan 24, 2012The Nimbuzz (com.nimbuzz) application 2.0.8 and 2.0.10 for Android does not properly protect data, which allows remote attackers to read or modify a contact lisCVE-2011-4702 · Other software · Nimbuzz · reported by MITREMedium 5.8
The Nimbuzz (com.nimbuzz) application 2.0.8 and 2.0.10 for Android does not properly protect data, which allows remote attackers to read or modify a contact list via a crafted application.
- Product
- Nimbuzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww4.comp.polyu.edu.hkwww4.comp.polyu.edu.hk
Mar 7, 2011The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeeCVE-2011-0064 · Other software · Gnome · reported by MITREMedium 6.8
The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.
- Product
- Pango
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcgit.freedesktop.orglists.fedoraproject.org
Feb 3, 2009SQL injection vulnerability in search.php in BuzzyWall 1.3.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL coCVE-2008-6029 · Other software · Buzzywall · reported by MITREMedium 6.8
SQL injection vulnerability in search.php in BuzzyWall 1.3.1 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the search parameter.
- Product
- Buzzywall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexploit-db.com
Oct 27, 2008Directory traversal vulnerability in download.php in BuzzyWall 1.3.1 allows remote attackers to read arbitrary local files via a ..CVE-2008-4759 · Other software · Buzzscripts · reported by MITREMedium 5
Directory traversal vulnerability in download.php in BuzzyWall 1.3.1 allows remote attackers to read arbitrary local files via a .. (dot dot) in the id parameter.
- Product
- Buzzywall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Oct 1, 2008SQL injection vulnerability in index.php in CMS Buzz allows remote attackers to execute arbitrary SQL commands via the id parameter in a playgame action.CVE-2008-4374 · Other software · Cmsbuzz · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in CMS Buzz allows remote attackers to execute arbitrary SQL commands via the id parameter in a playgame action.
- Product
- CMS Buzz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.