Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,170 results · page 10 of 24
May 15, 2023An issue found in Agasio-Camera device version not specified allows a remote attacker to execute arbitrary code via the check and authLevel parameters.CVE-2023-29862 · Other software · Agasio Camera Project · reported by MITRECritical 9.8
An issue found in Agasio-Camera device version not specified allows a remote attacker to execute arbitrary code via the check and authLevel parameters.
- Product
- Agasio Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwoolly-espadrille-ed5.notion.site
May 12, 2023Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker who convinced a user to engage in specific UI iCVE-2023-2458 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via UI interaction. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
May 10, 2023Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmwarCVE-2023-30356 · Network & remote access · Tenda · reported by MITREHigh 7.5
Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmware
- Product
- Cp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and theCVE-2023-30354 · Network & remote access · Tenda · reported by MITRECritical 9.8
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and the hardcoded boot password can be inserted for console access.
- Product
- Cp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document.CVE-2023-30353 · Network & remote access · Tenda · reported by MITRECritical 9.8
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document.
- Product
- Cp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for the RTSP feed.CVE-2023-30352 · Network & remote access · Tenda · reported by MITRECritical 9.8
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for the RTSP feed.
- Product
- Cp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryptiCVE-2023-30351 · Network & remote access · Tenda · reported by MITREHigh 7.5
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryption. This vulnerability allows attackers to connect to the TELNET service (or UART) by using the exposed credentials.
- Product
- Cp3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023In camera driver, there is a possible out of bounds write due to a missing bounds check.CVE-2022-48240 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 4.4
In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023In camera driver, there is a possible out of bounds write due to a missing bounds check.CVE-2022-48239 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 4.4
In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023 Milesight NCR/camera version 71.8.0.6-r5 exposes credentials through an unspecified request.CVE-2023-24506 · Other software · Milesight · reported by cna@cyber.gov.ilHigh 7.5
Milesight NCR/camera version 71.8.0.6-r5 exposes credentials through an unspecified request.
- Product
- NCR/Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023 Milesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request.CVE-2023-24505 · Other software · Milesight · reported by cna@cyber.gov.ilMedium 5.3
Milesight NCR/camera version 71.8.0.6-r5 discloses sensitive information through an unspecified request.
- Product
- NCR/Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2023In append_camera_metadata of camera_metadata.c, there is a possible out of bounds read due to a missing bounds check.CVE-2023-21049 · Computers, phones & browsers · Google · reported by security@android.comMedium 4.4
In append_camera_metadata of camera_metadata.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-236688120References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Mar 20, 2023Reflected Cross-Site Scripting (XSS) vulnerability in Manuel Masia | Pixedelic.Com Camera slideshow plugin <= 1.4.0.1 versions.CVE-2023-22682 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Reflected Cross-Site Scripting (XSS) vulnerability in Manuel Masia | Pixedelic.Com Camera slideshow plugin <= 1.4.0.1 versions.
- Affected
- up to 1.4.0.1
- What to do
- Affects up to 1.4.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2023The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video.CVE-2023-0349 · Other software · Akuvox · reported by ics-cert@hq.dhs.govHigh 7.5
The Akuvox E11 libvoice library provides unauthenticated access to the camera capture for image and video. This could allow an attacker to view and record image and video from the camera.
- Product
- E11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a crafted image file.CVE-2023-24734 · Other software · Sigb · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a crafted image file.
- Product
- PMB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2023An issue with app access to camera data was addressed with improved logic.CVE-2022-42838 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
An issue with app access to camera data was addressed with improved logic. This issue is fixed in macOS Ventura 13. A camera extension may be able to continue receiving video after the app which activated was closed.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26039 · Other software · ZoneMinder · reported by GitHubHigh 7.1
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostController.php). Any authenticated user can construct an api command to execute any shell command as the web user. This issue is patched in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26038 · Other software · ZoneMinder · reported by GitHubMedium 5.4
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal.php, where an arbitrary php file path can be passed in the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26037 · Other software · ZoneMinder · reported by GitHubHigh 8.9
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. The minTime and maxTime request parameters are not properly validated and could be used execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26036 · Other software · ZoneMinder · reported by GitHubHigh 8.1
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php. By controlling $view, any local file ending in .php can be executed. This is supposed to be mitigated by calling detaintPath, however dentaintPath does not properly sandbox the path. This can be exploited by constructing paths like "..././", which get replaced by "../". This issue is patched in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26035 · Other software · ZoneMinder · reported by GitHubHigh 7.2
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26034 · Other software · ZoneMinder · reported by GitHubCritical 9.6
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are affected by a SQL Injection vulnerability. The (blind) SQL Injection vulnerability is present within the `filter[Query][terms][0][attr]` query string parameter of the `/zm/index.php` endpoint. A user with the View or Edit permissions of Events may execute arbitrary SQL. The resulting impact can include unauthorized data access (and modification), authentication and/or authorization bypass, and remote code execution.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-26032 · Other software · ZoneMinder · reported by GitHubHigh 8.9
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token was trusted when performing an SQL query to load the user. If an attacker could determine the HASH key used by ZoneMinder, they could generate a malicious JWT token and use it to execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras.CVE-2023-25825 · Other software · ZoneMinder · reported by GitHubHigh 7.7
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 are vulnerable to Cross-site Scripting. Log entries can be injected into the database logs, containing a malicious referrer field. This is unescaped when viewing the logs in the web ui. This issue is patched in version 1.36.33.
- Product
- zoneminder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2023A Vulnerability was discovered in Axis 207W network camera.CVE-2023-22984 · Other software · Axis · reported by MITREMedium 6.1
A Vulnerability was discovered in Axis 207W network camera. There is a reflected XSS vulnerability in the web administration portal, which allows an attacker to execute arbitrary JavaScript via URL.
- Product
- 207w Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordd0ub1e-d.github.iod0ub1e-d.github.io
Feb 14, 2023Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain privileges via a TrojanCVE-2023-22368 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- ELECOM Camera Assistant and QuickFileDealer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Reflected cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker to inCVE-2023-22376 · Other software · PLANEX COMMUNICATIONS INC. · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker to inject arbitrary script to inject an arbitrary script. NOTE: This vulnerability only affects products that are no longer supported by the developer.
- Product
- Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Cross-site request forgery (CSRF) vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker toCVE-2023-22375 · Other software · PLANEX COMMUNICATIONS INC. · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker to hijack the authentication and conduct arbitrary operations by having a logged-in user to view a malicious page. NOTE: This vulnerability only affects products that are no longer supported by the developer.
- Product
- Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2023Stored cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a network-adjacent authenticated attacker CVE-2023-22370 · Other software · PLANEX COMMUNICATIONS INC. · reported by vultures@jpcert.or.jpMedium 5.2
Stored cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a network-adjacent authenticated attacker to inject an arbitrary script. NOTE: This vulnerability only affects products that are no longer supported by the developer.
- Product
- Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive information.CVE-2022-34138 · Other software · Biltema · reported by MITREHigh 7.5
Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive information.
- Product
- Baby Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.biltema.comkth.diva-portal.org
Feb 2, 2023The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1.0CVE-2023-23120 · Other software · Trendnet · reported by MITREMedium 5.9
The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1.07.01 and earlier vulnerable to firmware modification attacks. An attacker can conduct a man-in-the-middle (MITM) attack to modify the new firmware image and bypass the checksum verification.
- Product
- Tv-ip651wi Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are vulnerable to CSRFs that can be exploited to allow an attacker to perform changes with aCVE-2022-4621 · Other software · Panasonic · reported by ics-cert@hq.dhs.govHigh 7.5
Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are vulnerable to CSRFs that can be exploited to allow an attacker to perform changes with administrator level privileges.
- Product
- Sanyo CCTV Network Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.connect.panasonic.comcisa.gov
Dec 22, 2022A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access).CVE-2022-38473 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 16, 2022In the Pixel camera driver, there is a possible use after free due to a logic error in the code.CVE-2022-20581 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In the Pixel camera driver, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-245916120References: N/A
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 13, 2022Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon MobileCVE-2022-25712 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Wearables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 13, 2022Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOTCVE-2022-25711 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 6, 2022In camera driver, there is a possible memory corruption due to improper locking.CVE-2022-42775 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022In camera driver, there is a possible out of bounds write due to a missing bounds check.CVE-2022-39132 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022In camera driver, there is a possible memory corruption due to improper locking.CVE-2022-39131 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2022Use after free in Camera Capture in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pagCVE-2022-4175 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Camera Capture in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Nov 13, 2022Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing.CVE-2021-38828 · Other software · Xiongmaitech · reported by MITREMedium 5.3
Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing.
- Product
- Xm-jpr2-lx Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2022Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to account takeover.CVE-2021-38827 · Other software · Xiongmaitech · reported by MITREHigh 7.5
Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to account takeover.
- Product
- Xm-jpr2-lx Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022In s::can moni::tools in versions below 4.2 an unauthenticated attacker could get any file from the device by path traversal in the camera-file module.CVE-2020-12509 · Other software · s::can · reported by info@cert.vde.comHigh 7.5
In s::can moni::tools in versions below 4.2 an unauthenticated attacker could get any file from the device by path traversal in the camera-file module.
- Product
- moni::tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022In camera driver, there is a possible memory corruption due to improper locking.CVE-2022-38690 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022In camera driver, there is a possible out of bounds write due to a missing bounds check.CVE-2022-38671 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
- Product
- SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera privilege.CVE-2022-39861 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.9
Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera privilege.
- Product
- FactoryCamera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Oct 7, 2022Path traversal vulnerability in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to write arbitrary file as FactoryCamera privilegeCVE-2022-39858 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.3
Path traversal vulnerability in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to write arbitrary file as FactoryCamera privilege.
- Product
- FactoryCamera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Oct 7, 2022Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers to access broadcasting Intent as system CVE-2022-39857 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.3
Improper access control vulnerability in CameraTestActivity in FactoryCameraFB prior to version 3.5.51 allows attackers to access broadcasting Intent as system uid privilege.
- Product
- FactoryCameraFB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 26, 2022Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406.CVE-2022-40784 · Other software · Mipcm · reported by MITREHigh 8.8
Unlimited strcpy on user input when setting a locale file leads to stack buffer overflow in mIPC camera firmware 5.3.1.2003161406.
- Product
- Mipc Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2022Unsanitized input when setting a locale file leads to shell injection in mIPC camera firmware 5.3.1.2003161406.CVE-2022-40785 · Other software · Mipcm · reported by MITREHigh 8.8
Unsanitized input when setting a locale file leads to shell injection in mIPC camera firmware 5.3.1.2003161406. This allows an attacker to gain remote code execution on cameras running the firmware when a victim logs into a specially crafted mobile app.
- Product
- Mipc Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.