Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,271 results · page 12 of 26
Nov 10, 2021A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.CVE-2020-23900 · Other software · Wildbit-soft · reported by MITREMedium 5.5
A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. Related to Data from Faulting Address controls Code Flow starting at Editor!TMethodImplementationIntercept+0x57a3b.
- Product
- Wildbit Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwildbit-soft.fi
Nov 10, 2021A User Mode Write AV in Editor+0x5f91 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.CVE-2020-23899 · Other software · Wildbit-soft · reported by MITREMedium 5.5
A User Mode Write AV in Editor+0x5f91 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.
- Product
- Wildbit Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwildbit-soft.fi
Nov 10, 2021A User Mode Write AV in Editor+0x5ea2 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.CVE-2020-23898 · Other software · Wildbit-soft · reported by MITREMedium 5.5
A User Mode Write AV in Editor+0x5ea2 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.
- Product
- Wildbit Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwildbit-soft.fi
Nov 10, 2021A User Mode Write AV in Editor!TMethodImplementationIntercept+0x54dcec of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted CVE-2020-23897 · Other software · Wildbit-soft · reported by MITREMedium 5.5
A User Mode Write AV in Editor!TMethodImplementationIntercept+0x54dcec of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.
- Product
- Wildbit Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwildbit-soft.fi
Nov 10, 2021A User Mode Write AV in Editor+0x576b of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.CVE-2020-23896 · Other software · Wildbit-soft · reported by MITREMedium 5.5
A User Mode Write AV in Editor+0x576b of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
- Product
- Wildbit Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwildbit-soft.fi
Nov 10, 2021A User Mode Write AV in Editor+0x76af of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.CVE-2020-23895 · Other software · Wildbit-soft · reported by MITREMedium 5.5
A User Mode Write AV in Editor+0x76af of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
- Product
- Wildbit Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwildbit-soft.fi
Nov 10, 2021A User Mode Write AV in ntdll!RtlpCoalesceFreeBlocks+0x268 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.CVE-2020-23894 · Other software · Wildbit-soft · reported by MITREMedium 5.5
A User Mode Write AV in ntdll!RtlpCoalesceFreeBlocks+0x268 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
- Product
- Wildbit Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwildbit-soft.fi
Nov 10, 2021A User Mode Write AV in Editor!TMethodImplementationIntercept+0x3c3682 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted CVE-2020-23893 · Other software · Wildbit-soft · reported by MITREMedium 5.5
A User Mode Write AV in Editor!TMethodImplementationIntercept+0x3c3682 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
- Product
- Wildbit Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwildbit-soft.fi
Nov 10, 2021A User Mode Write AV in Editor+0x5cd7 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.CVE-2020-23891 · Other software · Wildbit-soft · reported by MITREMedium 5.5
A User Mode Write AV in Editor+0x5cd7 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
- Product
- Wildbit Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwildbit-soft.fi
Nov 10, 2021A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted JPG file.CVE-2020-23890 · Other software · Wildbit-soft · reported by MITREMedium 5.5
A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted JPG file. Related to Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at JPGCodec+0x753648.
- Product
- Wildbit Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwildbit-soft.fi
Nov 10, 2021A User Mode Write AV starting at Editor!TMethodImplementationIntercept+0x4189c6 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via aCVE-2020-23889 · Other software · Wildbit-soft · reported by MITREMedium 5.5
A User Mode Write AV starting at Editor!TMethodImplementationIntercept+0x4189c6 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted ico file.
- Product
- Wildbit Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwildbit-soft.fi
Nov 10, 2021A User Mode Write AV in Editor!TMethodImplementationIntercept+0x53f6c3 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted CVE-2020-23888 · Other software · Wildbit-soft · reported by MITREMedium 5.5
A User Mode Write AV in Editor!TMethodImplementationIntercept+0x53f6c3 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted psd file.
- Product
- Wildbit Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwildbit-soft.fi
Nov 9, 20213D Viewer Remote Code Execution VulnerabilityCVE-2021-43209 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Viewer Remote Code Execution Vulnerability
- Product
- 3D Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 9, 20213D Viewer Remote Code Execution VulnerabilityCVE-2021-43208 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Viewer Remote Code Execution Vulnerability
- Product
- 3D Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 26, 2021An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer mCVE-2020-7867 · Other software · HelpU · reported by vuln@krcert.or.krHigh 8
An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer menu. It is possible to file in arbitrary directory for user because the viewer program receive the file from agent with privilege of administrator.
- Product
- HelpuViewer.exe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0.CVE-2021-34859 · Other software · TeamViewer · reported by zdi-disclosures@trendmicro.comHigh 8.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TVS files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13697.
- Product
- TeamViewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.teamviewer.comzerodayinitiative.com
Oct 18, 2021Gutenberg PDF Viewer Block: Does not sanitise and escape its blockCVE-2021-24760 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Gutenberg PDF Viewer Block WordPress plugin before 1.0.1 does not sanitise and escape its block, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Gutenberg PDF Viewer Block
- Fixed in
- 1.0.1
- What to do
- Update Gutenberg PDF Viewer Block to 1.0.1 or newer.
Oct 18, 2021WordPress PDF Light Viewer: Allows users with Author roles to execute arbitrary OS command on the server via OS Command InjectionCVE-2021-24684 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript.
- Product
- WordPress PDF Light Viewer
- Fixed in
- 1.4.12
- What to do
- Update WordPress PDF Light Viewer to 1.4.12 or newer.
Oct 1, 2021cwlviewer is a web application to view and share Common Workflow Language workflows.CVE-2021-41110 · Other software · common-workflow-language · reported by GitHubCritical 9.1
cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch.
- Product
- cwlviewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2021Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that triggers a buffer overflow.CVE-2021-35297 · Other software · Scalabium · reported by MITREHigh 7.8
Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that triggers a buffer overflow. An attacker can use the Structured Exception Handler (SEH) records and redirect execution to attacker-controlled code.
- Product
- Dbase Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgovtech-csg.github.iogovtech-csg.github.io
Sep 27, 2021Adobe svg-native-viewer 8182d14dfad5d1e10f53ed830328d7d9a3cfa96d and earlier versions are affected by a heap buffer overflow vulnerability due to insecure handlCVE-2021-39823 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe svg-native-viewer 8182d14dfad5d1e10f53ed830328d7d9a3cfa96d and earlier versions are affected by a heap buffer overflow vulnerability due to insecure handling of a malicious .svg file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
- Product
- SVG Native Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Sep 17, 2021RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service (application crash) via crafted RFB protocol data.CVE-2021-41380 · Other software · Realvnc · reported by MITREMedium 6.5
RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service (application crash) via crafted RFB protocol data. NOTE: It is asserted that this issue requires social engineering a user into connecting to a fake VNC Server. The VNC Viewer application they are using will then hang, until terminated, but no memory leak occurs - the resources are freed once the hung process is terminated and the resource usage is constant during the hang. Only the process that is connected to the fake Server is affected. This is an application bug, not a security issue
- Product
- VNC Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 15, 2021PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the execution of arbitrary CVE-2021-39307 · Other software · Pdftron · reported by MITREMedium 6.1
PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the execution of arbitrary JavaScript code.
- Product
- Webviewer UI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.nccgroup.compdftron.com
Sep 14, 2021When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the application crashes and becomes temporarCVE-2021-38174 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the application crashes and becomes temporarily unavailable to the user until restart of the application.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Sep 14, 2021A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2021.2.1).CVE-2021-25665 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2021.2.1). The starview+.exe application lacks proper validation of user-supplied data when parsing scene files. This could result in an out of bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13700)
- Product
- Simcenter STAR-CCM+ Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comzerodayinitiative.com
Sep 13, 2021Fileviewer: Does not have CSRF checks in placeCVE-2021-24491 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a result, attackers could make a logged in administrator delete and upload arbitrary files via a CSRF attack
- Product
- Fileviewer
- Affected
- up to 2.2
- What to do
- Affects up to 2.2. Update Fileviewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 7, 2021A buffer overflow issue was discovered in ZOOK solution(remote administration tool) through processing 'ConnectMe' command while parsing a crafted OUTERIP valueCVE-2020-7877 · Other software · mastersoft · reported by vuln@krcert.or.krHigh 8
A buffer overflow issue was discovered in ZOOK solution(remote administration tool) through processing 'ConnectMe' command while parsing a crafted OUTERIP value because of missing boundary check. This vulnerability allows the attacker to execute remote arbitrary command.
- Product
- ZOOKViewer_Setup.exe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2021Marmoset Viewer: Does not property sanitizeCVE-2021-24495 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Marmoset Viewer WordPress plugin before 1.9.3 does not property sanitize, validate or escape the 'id' parameter before outputting back in the page, leading to a reflected Cross-Site Scripting issue.
- Product
- Marmoset Viewer
- Fixed in
- 1.9.3
- What to do
- Update Marmoset Viewer to 1.9.3 or newer.
Full record and what to do →NVD recordjohnjhacking.comwpscan.com
Aug 2, 2021Steam Group Viewer: Does not sanitise or escape its "Steam Group Address" settings before outputting it in the pageCVE-2021-24476 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Steam Group Viewer WordPress plugin through 2.1 does not sanitise or escape its "Steam Group Address" settings before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue
- Product
- Steam Group Viewer
- Affected
- up to 2.1
- What to do
- Affects up to 2.1. Update Steam Group Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 14, 2021SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out of bounds write and caCVE-2021-33681 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out of bounds write and causes the application to crash and becoming temporarily unavailable until the user restarts the application.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jul 14, 2021SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes buffer overflow and causesCVE-2021-33680 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.5
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes buffer overflow and causes the application to crash and becoming temporarily unavailable until the user restarts the application.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jul 8, 2021Improper component protection vulnerability in SmsViewerActivity of Samsung Message prior to SMR July-2021 Release 1 allows untrusted applications to access MesCVE-2021-25426 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comHigh 7.5
Improper component protection vulnerability in SmsViewerActivity of Samsung Message prior to SMR July-2021 Release 1 allows untrusted applications to access Message files.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.oversecured.comsecurity.samsungmobile.com
Jun 25, 2021In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) CVE-2021-34427 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgCritical 9.8
In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance.
- Product
- Eclipse BIRT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 25, 2021Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS.CVE-2021-3314 · Other software · Oracle · reported by MITREMedium 6.1
Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Glassfish Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordn4nj0.github.iogruppotim.it
Jun 24, 2021A vulnerability in agent program of HelpU remote control solution could allow an authenticated remote attacker to execute arbitrary commands This vulnerability CVE-2020-7862 · Other software · Helpu,inc · reported by vuln@krcert.or.krHigh 7
A vulnerability in agent program of HelpU remote control solution could allow an authenticated remote attacker to execute arbitrary commands This vulnerability is due to insufficient input santization when communicating customer process.
- Product
- HelpuViewer.exe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpu.co.krkrcert.or.kr
Jun 16, 2021TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations.CVE-2021-34803 · Other software · Teamviewer · reported by MITREHigh 7.8
TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations.
- Product
- Teamviewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.teamviewer.comcommunity.teamviewer.com
Jun 9, 2021The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user CVE-2021-32942 · Other software · AVEVA · reported by ics-cert@hq.dhs.govMedium 6.6
The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.
- Product
- InTouch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govaveva.com
Jun 9, 2021SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the applicCVE-2021-33661 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jun 9, 2021SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FLI file received from untrusted sources which results in crashing of the applicCVE-2021-33660 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FLI file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jun 9, 2021SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the applicCVE-2021-33659 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jun 9, 2021SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the applicCVE-2021-27643 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jun 9, 2021SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the applicCVE-2021-27642 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jun 9, 2021SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in crashing of the applicCVE-2021-27641 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jun 9, 2021SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the applicCVE-2021-27640 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jun 9, 2021SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the applicaCVE-2021-27639 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jun 9, 2021SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the applicaCVE-2021-27638 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.5
SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
- Product
- SAP 3D Visual Enterprise Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Jun 8, 20213D Viewer Information Disclosure VulnerabilityCVE-2021-31944 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5
3D Viewer Information Disclosure Vulnerability
- Product
- 3D Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 8, 20213D Viewer Remote Code Execution VulnerabilityCVE-2021-31943 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Viewer Remote Code Execution Vulnerability
- Product
- 3D Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 8, 20213D Viewer Remote Code Execution VulnerabilityCVE-2021-31942 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
3D Viewer Remote Code Execution Vulnerability
- Product
- 3D Viewer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Jun 4, 2021A vulnerability in the multimedia viewer feature of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an authenticated, remote attacker to bypassCVE-2021-1517 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5
A vulnerability in the multimedia viewer feature of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an authenticated, remote attacker to bypass security protections. This vulnerability is due to unsafe handling of shared content within the multimedia viewer feature. An attacker could exploit this vulnerability by sharing a file through the multimedia viewer feature. A successful exploit could allow the attacker to bypass security protections and prevent warning dialogs from appearing before files are offered to other users.
- Product
- Cisco WebEx Meetings Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.