Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
85 results · page 1 of 2
Oct 22, 2026Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the synCVE-2026-115509 · Other software · jitsucom · reported by VulnCheckLow 2.3
Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that call findFirst without await, so the syncId ownership check never fails. Authenticated users knowing another workspace's sync ID can read, overwrite or delete its stream cursors, causing data re-ingestion or skipped data.
- Product
- jitsu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provCVE-2026-85505 · Other software · FreeIPMI · reported by MITREHigh 7.5
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).
- Product
- FreeIPMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-commonCVE-2026-85504 · Other software · FreeIPMI · reported by MITRECritical 9.8
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.
- Product
- FreeIPMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplCVE-2026-73325 · Other software · Fujitsu Research · reported by VulnCheckHigh 8.4
Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory.
- Product
- OneCompression
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to rootCVE-2026-16607 · Other software · Fujitsu · reported by 763b0cbd-1a52-41de-b280-f255286be201High 8.5
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for local privilege escalation to root of an already authenticated user on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
- Product
- Linux openFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordglobal.fujitsusecurity.eu.fsastech.com
Jul 22, 2026A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code executCVE-2026-16606 · Other software · Fujitsu · reported by 763b0cbd-1a52-41de-b280-f255286be201Critical 9.3
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.
- Product
- Linux openFT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordglobal.fujitsusecurity.eu.fsastech.com
May 15, 2026Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier.CVE-2026-28761 · Other software · Fujitsu Japan Limited · reported by vultures@jpcert.or.jpHigh 8.5
Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a user views a malicious page while logged-in to the affected product, unexpected operations may be done.
- Product
- Musetheque V4 Information Disclosure for IPKNOWLEDGE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2026Cross-site scripting vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier.CVE-2026-24662 · Other software · Fujitsu Japan Limited · reported by vultures@jpcert.or.jpMedium 4.8
Cross-site scripting vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a file containing malicious contents is uploaded, an arbitrary script may be executed on a user's web browser when viewing the administration page showing the information of the file.
- Product
- Musetheque V4 Information Disclosure for IPKNOWLEDGE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Origin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier.CVE-2026-20893 · Other software · Fujitsu Client Computing Limited · reported by vultures@jpcert.or.jpHigh 8.5
Origin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier. If this vulnerability is exploited, an attacker who can log in to the Windows system where the affected product is installed may execute arbitrary code with SYSTEM privilege and/or modify the registry value.
- Product
- Fujitsu Security Solution AuthConductor Client Basic V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessibleCVE-2025-68919 · Other software · Fujitsu / Fsas Technologies · reported by MITREMedium 5.6
Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessible by a principal/authority other than ETERNUS SF Admin, allows an attacker to potentially affect system confidentiality, integrity, and availability.
- Product
- ETERNUS SF ACM/SC/Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.ts.fujitsu.com
Nov 12, 2025Fujitsu / Fsas Technologies iRMC S6 on M5 before 1.37S mishandles Redfish/WebUI access if the length of a username is exactly 16 characters.CVE-2025-65002 · Other software · Fujitsu / Fsas Technologies · reported by MITREHigh 7.5
Fujitsu / Fsas Technologies iRMC S6 on M5 before 1.37S mishandles Redfish/WebUI access if the length of a username is exactly 16 characters.
- Product
- iRMC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.ts.fujitsu.com
Nov 12, 2025Fujitsu fbiosdrv.sys before 2.5.0.0 allows an attacker to potentially affect system confidentiality, integrity, and availability.CVE-2025-65001 · Other software · Fujitsu · reported by MITREHigh 8.2
Fujitsu fbiosdrv.sys before 2.5.0.0 allows an attacker to potentially affect system confidentiality, integrity, and availability.
- Product
- fbiosdrv.sys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhexaplex.aisecurity.ts.fujitsu.com
Jun 12, 2025Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to CVE-2025-35978 · Other software · Fujitsu Client Computing Limited · reported by vultures@jpcert.or.jpMedium 6.9
Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125. If a local authenticated attacker send malicious data, an arbitrary registry value may be modified or arbitrary code may be executed.
- Product
- UpdateNavi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordazby.fmworld.netjvn.jp
Jul 17, 2024Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS).CVE-2024-40617 · Other software · Fujitsu Limited · reported by vultures@jpcert.or.jpMedium 6.5
Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). If a remote authenticated attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result, Administrator Class privileges of the product may be hijacked.
- Product
- FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfenics.fujitsu.comjvn.jp
Jun 18, 2024Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR.CVE-2024-34024 · Other software · Fsas Technologies Inc. · reported by vultures@jpcert.or.jpMedium 6.3
Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not.
- Product
- FUJITSU Business Application ID Link Manager II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2024Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR.CVE-2024-33622 · Other software · Fsas Technologies Inc. · reported by vultures@jpcert.or.jpMedium 6.5
Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database may be altered by a remote authenticated attacker.
- Product
- FUJITSU Business Application ID Link Manager II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2024Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR.CVE-2024-33620 · Other software · Fsas Technologies Inc. · reported by vultures@jpcert.or.jpHigh 8.6
Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the file contents including sensitive information on the server may be retrieved by an unauthenticated remote attacker.
- Product
- FUJITSU Business Application ID Link Manager II
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024In the Linux kernel, the following vulnerability has been resolved: net: fujitsu: fix potential null-ptr-deref In fmvj18x_get_hwinfo(), if ioremap fails thereCVE-2021-47149 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: net: fujitsu: fix potential null-ptr-deref In fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer deref. To fix this, check the return value of ioremap and return -1 to the caller in case of failure.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Dec 6, 2023A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53CVE-2023-40238 · Other software · Fujitsu · reported by MITREMedium 5.5
A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression.
- Product
- Esprimo D556/2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinarly.iosecurity.netapp.com
Sep 19, 2023Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attCVE-2023-4096 · Other software · Fujitsu · reported by cve-coordination@incibe.esHigh 8.6
Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate user.
- Product
- Arconte Áurea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023User enumeration vulnerability in Arconte Áurea 1.5.0.0 version.CVE-2023-4095 · Other software · Fujitsu · reported by cve-coordination@incibe.esMedium 5.3
User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a list of registered users in the application, obtaining the necessary information to perform more complex attacks on the platform.
- Product
- Arconte Áurea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate accouCVE-2023-4094 · Other software · Fujitsu · reported by cve-coordination@incibe.esMedium 6.5
ARCONTE Aurea's authentication system, in its 1.5.0.0 version, could allow an attacker to make incorrect access requests in order to block each legitimate account and cause a denial of service. In addition, a resource has been identified that could allow circumventing the attempt limit set in the login form.
- Product
- Arconte Áurea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023Reflected and persistent XSS vulnerability in Arconte Áurea, in its 1.5.0.0 version.CVE-2023-4093 · Other software · Fujitsu · reported by cve-coordination@incibe.esMedium 5.5
Reflected and persistent XSS vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to inject malicious JavaScript code, compromise the victim's browser and take control of it, redirect the user to malicious domains or access information being viewed by the legitimate user.
- Product
- Arconte Áurea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023SQL injection vulnerability in Arconte Áurea, in its 1.5.0.0 version.CVE-2023-4092 · Other software · Fujitsu · reported by cve-coordination@incibe.esHigh 8.8
SQL injection vulnerability in Arconte Áurea, in its 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to read sensitive data from the database, modify data (insert/update/delete), perform database administration operations and, in some cases, execute commands on the operating system.
- Product
- Arconte Áurea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 7, 2023An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061.CVE-2023-39903 · Other software · Fujitsu · reported by MITREMedium 5.9
An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061. The ismsnap component (in this specific case at /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log) allows insecure collection and storage of authorization credentials in cleartext. That occurs when users perform any ISM Firmware Repository Address setup test (Test the Connection), or regularly authorize against an already configured remote firmware repository site, as set up in ISM Firmware Repository Address. A privileged attacker is therefore able to potentially gather the associated ismsnap maintenance data, in the same manner as a trusted party allowed to export ismsnap data from ISM. The preconditions for an ISM installation to be generally vulnerable are that the Download Firmware (Firmware Repository Server) function is enabled and configured, and that the character \ (backslash) is used in a user credential (i.e., user/ID or password) of the remote proxy host / firmware repository server. NOTE: this may overlap CVE-2023-39379.
- Product
- Software Infrastructure Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.ts.fujitsu.comsecurity.ts.fujitsu.com
Aug 4, 2023Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form.CVE-2023-39379 · Other software · Fujitsu Limited · reported by vultures@jpcert.or.jpHigh 7.5
Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form. As a result, the password for the proxy server that is configured in ISM may be retrieved. Affected products and versions are as follows: Fujitsu Software Infrastructure Manager Advanced Edition V2.8.0.060, Fujitsu Software Infrastructure Manager Advanced Edition for PRIMEFLEX V2.8.0.060, and Fujitsu Software Infrastructure Manager Essential Edition V2.8.0.060.
- Product
- Fujitsu Software Infrastructure Manager Advanced Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsupport.ts.fujitsu.com
Jul 26, 2023Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change,CVE-2023-38555 · Other software · Fujitsu Limited · reported by vultures@jpcert.or.jpHigh 8.8
Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacker to obtain, change, and/or reset configuration settings of the affected products. Affected products and versions are as follows: Si-R 30B all versions, Si-R 130B all versions, Si-R 90brin all versions, Si-R570B all versions, Si-R370B all versions, Si-R220D all versions, Si-R G100 V02.54 and earlier, Si-R G200 V02.54 and earlier, Si-R G100B V04.12 and earlier, Si-R G110B V04.12 and earlier, Si-R G200B V04.12 and earlier, Si-R G210 V20.52 and earlier, Si-R G211 V20.52 and earlier, Si-R G120 V20.52 and earlier, Si-R G121 V20.52 and earlier, and SR-M 50AP1 all versions.
- Product
- Si-R 30B
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2023Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the CVE-2023-38433 · Other software · Fujitsu Limited · reported by vultures@jpcert.or.jpHigh 7.5
Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. Affected products and versions are as follows: IP-HE950E firmware versions V01L001 to V01L053, IP-HE950D firmware versions V01L001 to V01L053, IP-HE900E firmware versions V01L001 to V01L010, IP-HE900D firmware versions V01L001 to V01L004, IP-900E / IP-920E firmware versions V01L001 to V02L061, IP-900D / IP-900ⅡD / IP-920D firmware versions V01L001 to V02L061, IP-90 firmware versions V01L001 to V01L013, and IP-9610 firmware versions V01L001 to V02L007.
- Product
- IP-HE950E
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2023Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinicCVE-2023-22377 · Other software · FUJITSU LIMITED · reported by vultures@jpcert.or.jpHigh 7.4
Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to v1.4.0) and tsClinical Metadata Desktop Tools Version 1.0.3 to Version 1.1.0. If this vulnerability is exploited, an attacker may obtain an arbitrary file which meets a certain condition by reading a specially crafted XML file.
- Product
- tsClinical Define.xml Generator and tsClinical Metadata Desktop Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04.CVE-2022-31795 · Other software · Fujitsu · reported by MITRECritical 9.8
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the grel_finfo function in grel.php. An attacker is able to influence the username (user), password (pw), and file-name (file) parameters and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.
- Product
- Eternus Cs8000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgresearch.nccgroup.com
Jun 20, 2022An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04.CVE-2022-31794 · Other software · Fujitsu · reported by MITRECritical 9.8
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the requestTempFile function in hw_view.php. An attacker is able to influence the unitName POST parameter and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.
- Product
- Eternus Cs8000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orgresearch.nccgroup.com
May 18, 2022The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), IPCOM EX2 NW(1100, 32CVE-2022-29516 · Other software · FUJITSU LIMITED · reported by vultures@jpcert.or.jpCritical 9.8
The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), IPCOM EX2 NW(1100, 3200, 3500), IPCOM EX2 DC, IPCOM EX2 DC, IPCOM EX IN(2300, 2500, 2700), IPCOM EX LB(1100, 1300, 2300, 2500, 2700), IPCOM EX SC(1100, 1300, 2300, 2500, 2700), and IPCOM EX NW(1100, 1300, 2300, 2500, 2700)) allows a remote attacker to execute an arbitrary OS command via unspecified vectors.
- Product
- IPCOM EX2 series, IPCOM EX series, IPCOM VE2 series, and IPCOM VA2/VE1 series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versioCVE-2022-28806 · Other software · Fujitsu · reported by MITREHigh 7.8
An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versions before v1.09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.19 (U7510/U7410), v2.13 (U7310), and v1.09 (E459/E449). The FjGabiFlashCoreAbstractionSmm driver registers a Software System Management Interrupt (SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's nested contents) are not pointing to SMRAM contents. A potential attacker can therefore write fixed data to SMRAM, which could lead to data corruption inside this memory (e.g., change the SMI handler's code or modify SMRAM map structures to break input pointer validation for other SMI handlers). Thus, the attacker could elevate privileges from ring 0 to ring -2 and execute arbitrary code in SMM.
- Product
- Lifebook A3510 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfmworld.netkb.cert.org
Apr 11, 2022In Fujitsu PlugFree Network <= 7.3.0.3, an Unquoted service path in PFNService.exe software allows a local attacker to potentially escalate privileges to systemCVE-2022-27089 · Other software · Fujitsu · reported by MITREHigh 7.8
In Fujitsu PlugFree Network <= 7.3.0.3, an Unquoted service path in PFNService.exe software allows a local attacker to potentially escalate privileges to system level.
- Product
- Plugfree Network
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhansesecure.dehansesecure.de
May 24, 2021Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prior to WinSSInst2JP.exCVE-2021-20722 · Other software · FUJITSU LIMITED and PFU LIMITED · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prior to WinSSInst2JP.exe and WinSSInst2iX1500JP.exe allows an attacker to gain privileges and execute arbitrary code with the privilege of the user invoking the installer via a Trojan horse DLL in an unspecified directory.
- Product
- The installers of ScanSnap Manager and the Software Download Installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpscansnap.fujitsu.com
Mar 17, 2021Fujitsu ServerView Suite iRMC before 9.62F allows XSS.CVE-2020-17457 · Other software · Fujitsu · reported by MITREMedium 5.4
Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An authenticated attacker can store an XSS payload in the PSCU_FILE_INIT field of a Save Configuration XML document. The payload is triggered in the HTTP error response pages.
- Product
- Serverview Remote Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.ts.fujitsu.comgruppotim.it
Nov 30, 2020An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25.CVE-2020-29127 · Other software · Fujitsu · reported by MITRECritical 9.8
An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25. After logging into the portal as a root user (using any web browser), the portal can be accessed with root privileges when the URI cgi-bin/csp?cspid={XXXXXXXXXX}&csppage=cgi_PgOverview&csplang=en is visited from a different web browser.
- Product
- Eternus Storage Dx200 S4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcxsecurity.com
Feb 7, 2020The Fujitsu TLS library allows a man-in-the-middle attack.CVE-2019-13163 · Other software · Fujitsu · reported by MITREMedium 5.9
The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V11 and other versions, Interstage Job Workload Server V8, Interstage List Works V10 and other versions, Interstage Studio V12 and other versions, Interstage Web Server Express V11, Linkexpress V5, Safeauthor V3, ServerView Resource Orchestrator V3, Systemwalker Cloud Business Service Management V1, Systemwalker Desktop Keeper V15, Systemwalker Desktop Patrol V15, Systemwalker IT Change Manager V14, Systemwalker Operation Manager V16 and other versions, Systemwalker Runbook Automation V15 and other versions, Systemwalker Security Control V1, and Systemwalker Software Configuration Manager V15.
- Product
- Gp7000f Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfujitsu.comfujitsu.com
Oct 24, 2019An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices.CVE-2019-18201 · Other software · Fujitsu · reported by MITREHigh 7.5
An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, an attacker is able to eavesdrop on sensitive data such as passwords.
- Product
- Lx390 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsyss.de
Oct 24, 2019An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices.CVE-2019-18200 · Other software · Fujitsu · reported by MITRECritical 9.8
An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, they are prone to keystroke injection attacks.
- Product
- Lx390 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsyss.de
Oct 24, 2019An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices.CVE-2019-18199 · Other software · Fujitsu · reported by MITREMedium 6.6
An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, and because of password-based authentication, they are vulnerable to replay attacks.
- Product
- Lx390 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsyss.de
May 17, 2019In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over thCVE-2018-16156 · Other software · Fujitsu · reported by MITREHigh 7.8
In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over the FjtwMkic_Fjicube_32 named pipe. One of these message processing functions attempts to dynamically load the UninOldIS.dll library and executes an exported function named ChangeUninstallString. The default install does not contain this library and therefore if any DLL with that name exists in any directory listed in the PATH variable, it can be used to escalate to SYSTEM level privilege.
- Product
- Paperstream IP (twain)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurifera.com
Mar 15, 2019The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection.CVE-2019-9835 · Other software · Fujitsu · reported by MITRECritical 9.6
The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set LX901 GK900 devices allows Keystroke Injection. This occurs because it accepts unencrypted 2.4 GHz packets, even though all legitimate communication uses AES encryption.
- Product
- Lx901 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsyss.de
Sep 15, 2017Untrusted search path vulnerability in FENCE-Explorer for Windows V8.4.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecifCVE-2017-10855 · Other software · FUJITSU LIMITED · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in FENCE-Explorer for Windows V8.4.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- FENCE-Explorer for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2016NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allowsCVE-2016-1183 · Other software · Nttdata · reported by vultures@jpcert.or.jpLow 3.7
NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers to bypass a file-extension protection mechanism, and consequently read arbitrary files, via a crafted pathname.
- Product
- Terasoluna Server Framework For Java Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2014Unspecified vulnerability in ARROWS Me F-11D allows physically proximate attackers to read or modify flash memory via unknown vectors.CVE-2014-7254 · Other software · Fujitsu · reported by vultures@jpcert.or.jpMedium 4.6
Unspecified vulnerability in ARROWS Me F-11D allows physically proximate attackers to read or modify flash memory via unknown vectors.
- Product
- Arrows ME F-11d
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2014FUJITSU F-12C, ARROWS Tab LTE F-01D, ARROWS Kiss F-03D, and REGZA Phone T-01D for Android allows local users to execute arbitrary commands via unspecified vectoCVE-2014-7253 · Other software · Fujitsu · reported by vultures@jpcert.or.jpHigh 7.2
FUJITSU F-12C, ARROWS Tab LTE F-01D, ARROWS Kiss F-03D, and REGZA Phone T-01D for Android allows local users to execute arbitrary commands via unspecified vectors.
- Product
- Arrows Kiss F-03d
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2014Cross-site scripting (XSS) vulnerability in Fujitsu ServerView Operations Manager 5.00.09 through 6.30.05 allows remote attackers to inject arbitrary web scriptCVE-2014-3898 · Other software · Fujitsu · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Fujitsu ServerView Operations Manager 5.00.09 through 6.30.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Serverview Operations Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjp.fujitsu.comjp.fujitsu.com
Dec 14, 2013Buffer overflow in the Interstage HTTP Server log functionality, as used in Fujitsu Interstage Application Server 9.0.0, 9.1.0, 9.2.0, 9.3.1, and 10.0.0; and InCVE-2013-7105 · Other software · Fujitsu · reported by MITREHigh 10
Buffer overflow in the Interstage HTTP Server log functionality, as used in Fujitsu Interstage Application Server 9.0.0, 9.1.0, 9.2.0, 9.3.1, and 10.0.0; and Interstage Studio 9.0.0, 9.1.0, 9.2.0, and 10.0.0, has unspecified impact and attack vectors related to "ihsrlog/rotatelogs."
- Product
- Interstage Application Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfujitsu.comsecurityfocus.com
Jul 8, 2013The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes andCVE-2013-4786 · Other software · Oracle · reported by MITREHigh 7.5
The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.
- Product
- Fujitsu M10 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.