Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
48 results
Sep 4, 2026A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc.CVE-2026-85704 · Other software · ramon-victor · reported by VulDBLow 2.9
A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function getJailbreak of the file server/config.py of the component Jailbreak Mode. The manipulation results in race condition. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is assessed as difficult. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- freegpt-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 4, 2026A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc.CVE-2026-85703 · Other software · ramon-victor · reported by VulDBMedium 5.5
A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- freegpt-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 4, 2026A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc.CVE-2026-85702 · Other software · ramon-victor · reported by VulDBMedium 5.5
A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected is the function _conversation of the file server/backend.py of the component Backend Conversation API. Such manipulation of the argument model leads to missing authentication. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- freegpt-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 4, 2026A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc.CVE-2026-85701 · Other software · ramon-victor · reported by VulDBMedium 5.5
A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function ChatCompletion.create of the file g4f/__init__.py of the component Authentication Check. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- freegpt-webui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Aug 20, 2026VictoriaMetrics is a scalable solution for monitoring and managing time series data.CVE-2026-61625 · Other software · VictoriaMetrics · reported by GitHubMedium 6.8
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.
- Product
- VictoriaMetrics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially maskeCVE-2026-76405 · Other software · Splunk · reported by psirt@cisco.comMedium 4.3
In Splunk On-Call (VictorOps) app versions below 1.0.43 on Splunkbase, a user who does not hold the "admin" or "power" Splunk roles could read a partially masked Application Programming Interface (API) key from the App Key Value Store (KV Store). The exposure is possible because the Splunk On-Call (VictorOps) app does not fully mask the API key before storing it in a KV Store collection that the user can read. For more information see About the app key value store (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.2/administer-the-app-key-value-store/about-the-app-key-value-store) in the Splunk documentation.
- Product
- Splunk On-Call (VictorOps)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2026A vulnerability was found in VictoriaMetrics up to 1.146.0.CVE-2026-19898 · Other software · reported by VulDBLow 2.9
A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit has been made public and could be used. Upgrading to version 1.147.0 is recommended to address this issue. The patch is named 119ba0fb5be8024d50c5ba946599b2e69e8803ea. Upgrading the affected component is recommended.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233.CVE-2026-34496 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.1
Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1.
- Product
- victor Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application ServeCVE-2026-21655 · Other software · Johnson Control · reported by productsecurity@jci.comHigh 8.7
Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.
- Product
- victor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery.CVE-2026-21653 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.2
Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0.
- Product
- CCure 9000 and victor application server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2026CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cat_iCVE-2019-25697 · Other software · VictorAlagwu · reported by VulnCheckHigh 8.8
CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cat_id parameter. Attackers can send GET requests to category.php with malicious cat_id values to extract sensitive database information including usernames and credentials.
- Product
- CMSsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Apr 5, 2026CMSsite 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious HTML CVE-2019-25682 · Other software · VictorAlagwu · reported by VulnCheckMedium 5.3
CMSsite 1.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting crafted pages that submit POST requests to the users.php endpoint with parameters like source=add_user, source=edit_user, or del=1 to create, modify, or delete admin accounts.
- Product
- CMSsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Apr 5, 2026CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'postCVE-2019-25674 · Other software · VictorAlagwu · reported by VulnCheckHigh 8.8
CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send GET requests to post.php with malicious 'post' values to extract sensitive database information or perform time-based blind SQL injection attacks.
- Product
- CMSsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 3, 2026Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote attackers to manipulate database queries.CVE-2020-37076 · Other software · VictorAlagwu · reported by VulnCheckHigh 8.8
Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote attackers to manipulate database queries. Attackers can exploit this vulnerability by sending crafted UNION SELECT payloads to extract database information through boolean-based, error-based, and time-based injection techniques.
- Product
- CMSsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 3, 2026Victor CMS 1.0 contains an authenticated file upload vulnerability that allows administrators to upload PHP files with arbitrary content through the user_image CVE-2020-37073 · Other software · VictorAlagwu · reported by VulnCheckHigh 8.6
Victor CMS 1.0 contains an authenticated file upload vulnerability that allows administrators to upload PHP files with arbitrary content through the user_image parameter. Attackers can upload a malicious PHP shell to the /img/ directory and execute system commands by accessing the uploaded file with a 'cmd' parameter.
- Product
- CMSsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 3, 2026Victor CMS 1.0 contains a stored cross-site scripting vulnerability in the 'comment_author' POST parameter that allows attackers to inject malicious scripts.CVE-2020-37072 · Other software · VictorAlagwu · reported by VulnCheckMedium 5.1
Victor CMS 1.0 contains a stored cross-site scripting vulnerability in the 'comment_author' POST parameter that allows attackers to inject malicious scripts. Attackers can submit crafted JavaScript payloads through the comment submission form to execute arbitrary code in victim browsers.
- Product
- CMSsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 27, 2026Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature.CVE-2020-36942 · Other software · VictorAlagwu · reported by VulnCheckHigh 8.7
Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature. Attackers can upload a PHP shell to the /img directory and execute system commands by accessing the uploaded file via web browser.
- Product
- CMSsite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 11, 2026A vulnerability has been found in jiujiujia/victor123/wxw850227 jjjfood and jjjshop_food up to 20260103.CVE-2026-0843 · Other software · jiujiujia · reported by VulDBLow 2.1
A vulnerability has been found in jiujiujia/victor123/wxw850227 jjjfood and jjjshop_food up to 20260103. This vulnerability affects unknown code of the file /index.php/api/product.category/index. Such manipulation of the argument latitude leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product is distributed under multiple different names. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- jjjfood
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record101.200.76.102vuldb.com
Nov 25, 2025VictoriaMetrics is a scalable solution for monitoring and managing time series data.CVE-2025-65942 · Other software · VictoriaMetrics · reported by GitHubLow 2.7
VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0 to before 1.122.8, and from 1.123.0 to before 1.129.1, affected versions are vulnerable to DoS attacks because the snappy decoder ignored VictoriaMetrics request size limits allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability. The fix enforces block-size checks based on MaxRequest limits. This issue has been patched in versions 1.110.23, 1.122.8, and 1.129.1.
- Product
- VictoriaMetrics
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2024A vulnerability classified as problematic has been found in Victor Zsviot Camera 8.26.31.CVE-2024-5095 · Other software · Victor · reported by VulDBHigh 7.1
A vulnerability classified as problematic has been found in Victor Zsviot Camera 8.26.31. This affects an unknown part of the component MQTT Packet Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265077 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Zsviot Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023SQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary commands via the post parameter to /post.php in a crafted GET request.CVE-2020-23966 · Other software · Victor CMS Project · reported by MITRECritical 9.8
SQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary commands via the post parameter to /post.php in a crafted GET request.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023A vulnerability was found in VictorFerraresi pokemon-database-php.CVE-2015-10064 · Other software · VictorFerraresi · reported by VulDBMedium 5.5
A vulnerability was found in VictorFerraresi pokemon-database-php. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named dd0e1e6cdf648d6a3deff441f515bcb1d7573d68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218455.
- Product
- pokemon-database-php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of admin_edit_comment.php, p_id parameter of admin_edit_post.php, u_id parameter of admin_edit_CVE-2020-35597 · Other software · Victor CMS Project · reported by MITREHigh 8.8
Victor CMS 1.0 is vulnerable to SQL injection via c_id parameter of admin_edit_comment.php, p_id parameter of admin_edit_post.php, u_id parameter of admin_edit_user.php, and edit parameter of admin_update_categories.php.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comgithub.com
Apr 28, 2022SQL Injection vulnerability in Victor CMS v1.0, via the user_name parameter to /includes/login.php.CVE-2022-28060 · Other software · Victor CMS Project · reported by MITREHigh 7.5
SQL Injection vulnerability in Victor CMS v1.0, via the user_name parameter to /includes/login.php.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin.CVE-2022-27478 · Other software · Victor CMS Project · reported by MITREHigh 8.8
Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2022Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.CVE-2022-26201 · Other software · Victor CMS Project · reported by MITRECritical 9.8
Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2022Victor CMS v1.0 was discovered to contain a SQL injection vulnerability that allows attackers to inject arbitrary commands via 'user_firstname' parameter.CVE-2022-23873 · Other software · Victor CMS Project · reported by MITREHigh 8.8
Victor CMS v1.0 was discovered to contain a SQL injection vulnerability that allows attackers to inject arbitrary commands via 'user_firstname' parameter.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user.CVE-2021-46459 · Other software · Victor CMS Project · reported by MITREHigh 7.5
Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user. These vulnerabilities can be exploited through a crafted POST request via the user_name, user_firstname,user_lastname, or user_email parameters.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2022Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post.CVE-2021-46458 · Other software · Victor CMS Project · reported by MITREHigh 7.5
Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post. This vulnerability can be exploited through a crafted POST request via the post_title parameter.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2021Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to \CMSsite-master\admin\includes\admin_aCVE-2021-25203 · Other software · Victor CMS Project · reported by MITRECritical 9.8
Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to \CMSsite-master\admin\includes\admin_add_post.php.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2020The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.CVE-2020-29280 · Other software · Victor CMS Project · reported by MITRECritical 9.8
The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on theCVE-2020-9049 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.1
A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack.
- Product
- victor Web Client version 5.6 and prior
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 27, 2020A SQL injection vulnerability exists in Victor CMS V1.0 in the cat_id parameter of the category.php file.CVE-2020-23945 · Other software · Victor CMS Project · reported by MITREHigh 7.5
A SQL injection vulnerability exists in Victor CMS V1.0 in the cat_id parameter of the category.php file. This parameter can be used by sqlmap to obtain data information in the database.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2020A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker oCVE-2020-9048 · Other software · Johnson Controls · reported by productsecurity@jci.comHigh 7.1
A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.
- Product
- victor Web Client version 5.4.1 and prior
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govjohnsoncontrols.com
Jul 7, 2020Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.CVE-2020-15599 · Other software · Victor CMS Project · reported by MITREMedium 6.1
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 22, 2020Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name, user_firstname, or user_lastname parameter.CVE-2020-13427 · Other software · Victorcms Project · reported by MITREMedium 6.1
Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name, user_firstname, or user_lastname parameter.
- Product
- Victorcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
May 21, 2020During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used tCVE-2020-9045 · Other software · Johnson Controls · reported by productsecurity@jci.comCritical 9.9
During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation.
- Product
- Software House C•CURE 9000 v2.70
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjohnsoncontrols.comus-cert.gov
Sep 10, 2018An issue was discovered in Victor CMS through 2018-05-10.CVE-2018-16775 · Other software · Victor CMS Project · reported by MITREMedium 4.8
An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the site name in the "Categories" menu.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2018P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation.CVE-2018-7938 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comLow 3.3
P10 Huawei smartphones with the versions before Victoria-AL00AC00B217 have an information leak vulnerability due to the lack of permission validation. An attacker tricks a user into installing a malicious application on the smart phone, and the application can read some hardware serial number, which may cause sensitive information leak.
- Product
- P10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2018An issue was discovered in Victor CMS through 2018-05-10.CVE-2018-15603 · Other software · Victor CMS Project · reported by MITREMedium 6.1
An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the Author field of the "Leave a Comment" screen.
- Product
- Victor CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2018Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability.CVE-2018-7957 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comLow 3.3
Huawei smartphones with software Victoria-AL00 8.0.0.336a(C00) have an information leakage vulnerability. Because an interface does not verify authorization correctly, attackers can exploit an application with the authorization of phone state to obtain user location additionally.
- Product
- Victoria-AL00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The Bastet of some Huawei mobile phones with software earlier than Vicky-AL00AC00B167 versions, earlier than Victoria-AL00AC00B167 versions, earlier than WarsawCVE-2017-8175 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.5
The Bastet of some Huawei mobile phones with software earlier than Vicky-AL00AC00B167 versions, earlier than Victoria-AL00AC00B167 versions, earlier than Warsaw-AL00C00B191 versions has an insufficient input validation vulnerability due to the lack of parameter validation. An attacker may trick a user into installing a malicious APP. The APP can modify specific parameter to cause system reboot.
- Product
- Vicky-AL00A,Victoria-AL00A,Warsaw-AL00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017Maya-L02,VKY-L09,VTR-L29,Vicky-AL00A,Victoria-AL00A,Warsaw-AL00 smart phones with software of earlier than Maya-L02C636B126 versions,earlier than VKY-L29C10B151CVE-2017-8173 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 4.6
Maya-L02,VKY-L09,VTR-L29,Vicky-AL00A,Victoria-AL00A,Warsaw-AL00 smart phones with software of earlier than Maya-L02C636B126 versions,earlier than VKY-L29C10B151 versions,earlier than VTR-L29C10B151 versions,earlier than Vicky-AL00AC00B162 versions,earlier than Victoria-AL00AC00B167 versions,earlier than Warsaw-AL00C00B200 versions have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can login the configuration flow by some secret code and can perform some operations to update the Google account. As a result, the FRP function is bypassed.
- Product
- Maya-L02,VKY-L09,VTR-L29,Vicky-AL00A,Victoria-AL00A,Warsaw-AL00
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The Madapt Driver of some Huawei smart phones with software Earlier than Vicky-AL00AC00B172 versions,Vicky-AL00CC768B122,Vicky-TL00AC01B167,Earlier than VictoriCVE-2017-8160 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
The Madapt Driver of some Huawei smart phones with software Earlier than Vicky-AL00AC00B172 versions,Vicky-AL00CC768B122,Vicky-TL00AC01B167,Earlier than Victoria-AL00AC00B172 versions,Victoria-TL00AC00B123,Victoria-TL00AC01B167 has a use after free (UAF) vulnerability. An attacker can trick a user to install a malicious application which has a high privilege to exploit this vulnerability, Successful exploitation may cause arbitrary code execution.
- Product
- Vicky-AL00A,Vicky-AL00C,Vicky-TL00A,Victoria-AL00A,Victoria-TL00A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The boot loaders of P10 and P10 Plus Huawei mobile phones with software the versions before Victoria-L09AC605B162, the versions before Victoria-L29AC605B162, thCVE-2017-8150 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comHigh 7.8
The boot loaders of P10 and P10 Plus Huawei mobile phones with software the versions before Victoria-L09AC605B162, the versions before Victoria-L29AC605B162, the versions before Vicky-L29AC605B162 have an arbitrary memory write vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause arbitrary memory writing in the next system reboot, causing continuous system reboot or arbitrary code execution.
- Product
- P10, P10 Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2017The boot loaders of P10 and P10 Plus Huawei mobile phones with software the versions before Victoria-L09AC605B162, the versions before Victoria-L29AC605B162, thCVE-2017-8149 · Other software · Huawei Technologies Co., Ltd. · reported by psirt@huawei.comMedium 5.5
The boot loaders of P10 and P10 Plus Huawei mobile phones with software the versions before Victoria-L09AC605B162, the versions before Victoria-L29AC605B162, the versions before Vicky-L29AC605B162 have an out-of-bounds memory access vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. the APP can modify specific data to cause buffer overflow in the next system reboot, causing out-of-bounds memory read which can continuous system reboot.
- Product
- P10, P10 Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2010The ip_evictor function in ip_fragment.c in libnids before 1.24, as used in dsniff and possibly other products, allows remote attackers to cause a denial of serCVE-2010-0751 · Other software · Libnids Project · reported by Red HatMedium 5
The ip_evictor function in ip_fragment.c in libnids before 1.24, as used in dsniff and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via crafted fragmented packets.
- Product
- Libnids
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfreefr.dl.sourceforge.netlists.fedoraproject.org
Jul 30, 2007Unspecified vulnerability in WebUI in ADempiere Bazaar before 3.3 beta Victoria edition allows remote attackers to access system-level windows via unspecified vCVE-2007-4050 · Other software · Adempiere · reported by MITREHigh 10
Unspecified vulnerability in WebUI in ADempiere Bazaar before 3.3 beta Victoria edition allows remote attackers to access system-level windows via unspecified vectors.
- Product
- Bazaar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadempiere.comosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.