Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,443 results · page 12 of 29
Feb 6, 2023BTicino Door Entry HOMETOUCH for iOS 1.4.2 was discovered to be missing an SSL certificate.CVE-2022-46496 · Other software · Bticino · reported by MITREMedium 5.9
BTicino Door Entry HOMETOUCH for iOS 1.4.2 was discovered to be missing an SSL certificate.
- Product
- Door Entry For Hometouch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.integrity.ptlabs.integrity.pt
Feb 6, 2023Nextcloud mail is an email app for the nextcloud home server platform.CVE-2023-23943 · Other software · nextcloud · reported by GitHubMedium 5
Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2023Nextcloud mail is an email app for the nextcloud home server platform.CVE-2023-23944 · Other software · nextcloud · reported by GitHubLow 2
Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwords until the OAuth setup has been completed. It is recommended that the Nextcloud Mail app is upgraded to 2.2.2. There are no known workarounds for this issue.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the valCVE-2023-23082 · Other software · Kodi · reported by MITREMedium 4.6
A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument.
- Product
- Kodi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 2, 2023Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.CVE-2022-44585 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.
- Affected
- up to 1.2.5
- What to do
- Affects up to 1.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jan 20, 2023SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin board.CVE-2021-26644 · Other software · Hometory · reported by vuln@krcert.or.krHigh 8.8
SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin board. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is running.
- Product
- Mangboard WP BASIC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/OCVE-2023-22280 · Other software · Mahoroba Kobo, Inc. · reported by vultures@jpcert.or.jpHigh 7.2
MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command.
- Product
- MAHO-PBX NetDevancer series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2023MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/OCVE-2023-22279 · Other software · Mahoroba Kobo, Inc. · reported by vultures@jpcert.or.jpCritical 9.8
MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote unauthenticated attacker to execute an arbitrary OS command.
- Product
- MAHO-PBX NetDevancer series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023A vulnerability was found in NethServer phonenehome.CVE-2021-4313 · Other software · NethServer · reported by VulDBMedium 5.5
A vulnerability was found in NethServer phonenehome. It has been rated as critical. This issue affects the function get_info/get_country_coor of the file server/index.php. The manipulation leads to sql injection. The identifier of the patch is 759c30b0ddd7d493836bbdf695cf71624b377391. It is recommended to apply a patch to fix this issue. The identifier VDB-218393 was assigned to this vulnerability.
- Product
- phonenehome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2023An issue was discovered in Zebra Enterprise Home Screen 4.1.19.CVE-2022-36443 · Other software · Zebra · reported by MITREHigh 7.8
An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The device allows the administrator to lock some communication channels (wireless and SD card) but it is still possible to use a physical connection (Ethernet cable) without restriction.
- Product
- Enterprise Home Screen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Jan 10, 2023An issue was discovered in Zebra Enterprise Home Screen 4.1.19.CVE-2022-36442 · Other software · Zebra · reported by MITREMedium 5.5
An issue was discovered in Zebra Enterprise Home Screen 4.1.19. By using the embedded Google Chrome application, it is possible to install an unauthorized application via a downloaded APK.
- Product
- Enterprise Home Screen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Jan 10, 2023An issue was discovered in Zebra Enterprise Home Screen 4.1.19.CVE-2022-36441 · Other software · Zebra · reported by MITREHigh 7.1
An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applications that are restricted by the admin.
- Product
- Enterprise Home Screen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcds.thalesgroup.comexcellium-services.com
Dec 1, 2022A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate instaCVE-2022-29837 · Network & remote access · Western Digital · reported by psirt@wdc.comMedium 4.7
A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate installation of custom ZIP packages and overwrite system files. This could potentially lead to a code execution.
- Product
- My Cloud Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwesterndigital.comwesterndigital.com
Nov 9, 2022Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; MyCVE-2022-29836 · Network & remote access · Western Digital · reported by psirt@wdc.comLow 1.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability was discovered via an HTTP API on Western Digital My Cloud Home; My Cloud Home Duo; and SanDisk ibi devices that could allow an attacker to abuse certain parameters to point to random locations on the file system. This could also allow the attacker to initiate the installation of custom packages at these locations. This can only be exploited once the attacker has been authenticated to the device. This issue affects: Western Digital My Cloud Home and My Cloud Home Duo versions prior to 8.11.0-113 on Linux; SanDisk ibi versions prior to 8.11.0-113 on Linux.
- Product
- My Cloud Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwesterndigital.comwesterndigital.com
Nov 7, 2022Local privilege escalation due to improper soft link handling.CVE-2022-44747 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Nov 7, 2022Sensitive information disclosure due to insecure folder permissions.CVE-2022-44746 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Nov 7, 2022Sensitive information leak through log files.CVE-2022-44745 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Nov 7, 2022Local privilege escalation due to DLL hijacking vulnerability.CVE-2022-44744 · Other software · Acronis · reported by security@acronis.comHigh 7.3
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Nov 7, 2022Local privilege escalation due to insecure folder permissions.CVE-2022-44733 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Nov 7, 2022Local privilege escalation due to insecure folder permissions.CVE-2022-44732 · Other software · Acronis · reported by security@acronis.comHigh 7.8
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
- Product
- Acronis Cyber Protect Home Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.comsecurity-advisory.acronis.com
Oct 25, 2022A format string injection vulnerability exists in the ghome_process_control_packet functionality of Abode Systems, Inc.CVE-2022-33938 · Other software · abode systems, inc. · reported by talos-cna@cisco.comCritical 9.8
A format string injection vulnerability exists in the ghome_process_control_packet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A specially-crafted XCMD can lead to memory corruption, information disclosure and denial of service. An attacker can send a malicious XML payload to trigger this vulnerability.
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 25, 2022An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc.CVE-2022-27805 · Other software · abode systems, inc. · reported by talos-cna@cisco.comCritical 9.8
An authentication bypass vulnerability exists in the GHOME control functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted network request can lead to arbitrary XCMD execution. An attacker can send a malicious XML payload to trigger this vulnerability.
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Oct 21, 2022Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.CVE-2022-27494 · Other software · Aethon · reported by ics-cert@hq.dhs.govHigh 8.2
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
- Product
- TUG Home Base Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2022Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.CVE-2022-26423 · Other software · Aethon · reported by ics-cert@hq.dhs.govHigh 8.2
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
- Product
- TUG Home Base Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2022Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.CVE-2022-1070 · Other software · Aethon · reported by ics-cert@hq.dhs.govHigh 8.2
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
- Product
- TUG Home Base Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2022Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.CVE-2022-1066 · Other software · Aethon · reported by ics-cert@hq.dhs.govHigh 8.2
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
- Product
- TUG Home Base Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2022Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.CVE-2022-1059 · Other software · Aethon · reported by ics-cert@hq.dhs.govHigh 8.2
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
- Product
- TUG Home Base Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2022jsonlint 1.0 is vulnerable to heap-buffer-overflow via /home/hjsz/jsonlint/src/lexer.CVE-2022-42227 · Other software · Jsonlint Project · reported by MITREHigh 7.5
jsonlint 1.0 is vulnerable to heap-buffer-overflow via /home/hjsz/jsonlint/src/lexer.
- Product
- Jsonlint C++
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022The home screen module has a vulnerability in service logic processing.Successful exploitation of this vulnerability may affect data integrity.CVE-2022-41588 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
The home screen module has a vulnerability in service logic processing.Successful exploitation of this vulnerability may affect data integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Oct 14, 2022Uncaptured exceptions in the home screen module.CVE-2022-41587 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Uncaptured exceptions in the home screen module. Successful exploitation of this vulnerability may affect stability.
- Product
- Emui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Oct 14, 2022A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled with the IKEA Home SmaCVE-2022-39065 · Other software · Ikea · reported by disclosure@synopsys.comMedium 6.5
A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled with the IKEA Home Smart app and TRÅDFRI remote control. The malformed Zigbee frame is an unauthenticated broadcast message, which means all vulnerable devices within radio range are affected. CVSS 3.1 Base Score: 6.5 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Product
- TRÅDFRI gateway system
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynopsys.comsynopsys.com
Oct 11, 2022In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality.CVE-2022-32175 · Other software · AdguardHome · reported by vulnerabilitylab@mend.ioMedium 5.4
In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attacker can persuade an authorized user to follow a malicious link, resulting in deleting/modifying the custom filtering rules.
- Product
- AdguardHome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40.CVE-2022-29503 · Other software · Anker · reported by talos-cna@cisco.comCritical 9.8
A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40. Thread allocation can lead to memory corruption. An attacker can create threads to trigger this vulnerability.
- Product
- Eufy Homebase 2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 27, 2022A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessinCVE-2022-23006 · Network & remote access · Western Digital · reported by psirt@wdc.comLow 1.8
A stack-based buffer overflow vulnerability was found on Western Digital My Cloud Home, My Cloud Home Duo, and SanDisk ibi that could allow an attacker accessing the system locally to read information from /etc/version file. This vulnerability can only be exploited by chaining it with another issue. If an attacker is able to carry out a remote code execution attack, they can gain access to the vulnerable file, due to the presence of insecure functions in code. User interaction is required for exploitation. Exploiting the vulnerability could result in exposure of information, ability to modify files, memory access errors, or system crashes.
- Product
- My Cloud Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvd.nist.govwesterndigital.com
Sep 20, 2022SWFTools commit 772e55a2 was discovered to contain a heap-buffer-overflow via getTransparentColor at /home/bupt/Desktop/swftools/src/gif2swf.CVE-2022-35089 · Other software · Swftools · reported by MITREMedium 5.5
SWFTools commit 772e55a2 was discovered to contain a heap-buffer-overflow via getTransparentColor at /home/bupt/Desktop/swftools/src/gif2swf.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022SWFTools commit 772e55a2 was discovered to contain a heap buffer-overflow via getGifDelayTime at /home/bupt/Desktop/swftools/src/src/gif2swf.c.CVE-2022-35088 · Other software · Swftools · reported by MITREMedium 5.5
SWFTools commit 772e55a2 was discovered to contain a heap buffer-overflow via getGifDelayTime at /home/bupt/Desktop/swftools/src/src/gif2swf.c.
- Product
- Swftools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service.CVE-2022-23768 · Other software · Neo Information Systems Co., Ltd · reported by vuln@krcert.or.krHigh 8.8
This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks such as source code hijacking, remote control of the device.
- Product
- Home AP NIS-HAP11AC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkrcert.or.krkrcert.or.kr
Sep 16, 2022Nextcloud android is the official Android client for the Nextcloud home server platform.CVE-2022-39210 · Other software · nextcloud · reported by GitHubLow 3.2
Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly protected. As a result access to internal files of the from within the Nextcloud Android app is possible. This may lead to a leak of sensitive information in some cases. It is recommended that the Nextcloud Android app is upgraded to 3.21.0. There are no known workarounds for this issue.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022ywoa v6.1 is vulnerable to SQL Injection via backend/oa/visual/exportExcel.do interface.CVE-2022-38808 · Other software · Yimihome · reported by MITREHigh 8.8
ywoa v6.1 is vulnerable to SQL Injection via backend/oa/visual/exportExcel.do interface.
- Product
- Ywoa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scriCVE-2022-38814 · Other software · Fiberhome · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfg_loid text field.
- Product
- An5506-02-b Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Sep 12, 2022Dendrite is a Matrix homeserver written in Go.CVE-2022-39200 · Other software · matrix-org · reported by GitHubHigh 7.3
Dendrite is a Matrix homeserver written in Go. In affected versions events retrieved from a remote homeserver using the `/get_missing_events` path did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through other endpoints (e.g. `/event`, `/state`) as they have been correctly verified. Homeservers that have federation disabled are not vulnerable. The problem has been fixed in Dendrite 0.9.8. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- dendrite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/debit_credit_p.CVE-2022-36754 · Other software · Oretnom23 · reported by MITREHigh 7.2
Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/debit_credit_p.
- Product
- Expense Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2022Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation.CVE-2022-31152 · Other software · matrix-org · reported by GitHubMedium 6.4
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specification specifies a list of [event authorization rules](https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules) which must be checked when determining if an event should be accepted into a room. In versions of Synapse up to and including version 1.61.0, some of these rules are not correctly applied. An attacker could craft events which would be accepted by Synapse but not a spec-conformant server, potentially causing divergence in the room state between servers. Administrators of homeservers with federation enabled are advised to upgrade to version 1.62.0 or higher. Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to an empty list (`[]`) as a workaround.
- Product
- synapse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2022In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.CVE-2022-36200 · Other software · Fiberhome · reported by MITREHigh 7.5
In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.
- Product
- Hg150-ub Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022Ywoa before v6.1 was discovered to contain a SQL injection vulnerability via /oa/setup/checkPool?database.CVE-2022-36606 · Other software · Yimihome · reported by MITRECritical 9.8
Ywoa before v6.1 was discovered to contain a SQL injection vulnerability via /oa/setup/checkPool?database.
- Product
- Ywoa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter.CVE-2022-36605 · Other software · Yimihome · reported by MITRECritical 9.8
Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter.
- Product
- Ywoa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugiCVE-2022-30998 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plugin <= 1.1 at WordPress.
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Jul 22, 2022information leakage vulnerability exists in the Xiaomi SmartHome APP.CVE-2020-14114 · Other software · MI · reported by security@xiaomi.comHigh 7.5
information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information.
- Product
- Smarthome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Jul 20, 2022H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the URL /ihomers/app.CVE-2022-34610 · Other software · H3c · reported by MITRECritical 9.8
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the URL /ihomers/app.
- Product
- Magic R200 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2022On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account usernamCVE-2022-28377 · Other software · Verizon · reported by MITREHigh 7.5
On Verizon 5G Home LVSKIHP InDoorUnit (IDU) 3.4.66.162 and OutDoorUnit (ODU) 3.33.101.0 devices, the CRTC and ODU RPC endpoints rely on a static account username/password for access control. This password can be generated via a binary included in the firmware, after ascertaining the MAC address of the IDU's base Ethernet interface, and adding the string DEVICE_MANUFACTURER='Wistron_NeWeb_Corp.' to /etc/device_info to replicate the host environment. This occurs in /etc/init.d/wnc_factoryssidkeypwd (IDU).
- Product
- Lvskihp Indoorunit Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.