Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,298 results · page 19 of 46
Jan 25, 2024A vulnerability classified as problematic has been found in SpyCamLizard 1.230.CVE-2024-0885 · Other software · Spycamlizard · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in SpyCamLizard 1.230. Affected is an unknown function of the component HTTP GET Request Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252036.
- Product
- Spycamlizard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comvuldb.com
Jan 16, 2024Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to obtCVE-2023-49515 · Network & remote access · tp-link · reported by MITREMedium 4.6
Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to obtain sensitive information via a connection to the UART pin components.
- Product
- tapo_tc70_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_distributor.php?id=.CVE-2024-22627 · Other software · Campcodes · reported by MITREHigh 7.2
Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_distributor.php?id=.
- Product
- Supplier Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_retailer.php?id=.CVE-2024-22626 · Other software · Campcodes · reported by MITREHigh 7.2
Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_retailer.php?id=.
- Product
- Supplier Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_category.php?id=.CVE-2024-22625 · Other software · Campcodes · reported by MITREHigh 7.2
Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_category.php?id=.
- Product
- Supplier Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024Insufficient technical documentation issue exists in thermal camera TMC series all firmware versions.CVE-2024-22028 · Other software · THREE R SOLUTION CORP. JAPAN · reported by vultures@jpcert.or.jpMedium 4.6
Insufficient technical documentation issue exists in thermal camera TMC series all firmware versions. The user of the affected product is not aware of the internally saved data. By accessing the affected product physically, an attacker may retrieve the internal data.
- Product
- 3R-TMC01
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2024An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2.CVE-2024-23171 · Other software · Mediawiki · reported by MITREMedium 5.4
An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page allows XSS via the x-xss language setting for internationalization (i18n).
- Product
- Mediawiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgerrit.wikimedia.orgphabricator.wikimedia.org
Jan 10, 2024FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction.CVE-2023-51127 · Other software · Flir · reported by MITREHigh 7.5
FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows an unauthenticated, remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic link file. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.
- Product
- Flir Ax8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2024 in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia camera crash through modify a released pointer.CVE-2023-47857 · Other software · OpenHarmony · reported by scy@openharmony.ioMedium 4
in OpenHarmony v3.2.2 and prior versions allow a local attacker cause multimedia camera crash through modify a released pointer.
- Product
- OpenHarmony
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2023Gallery3d on Tecno Camon X CA7 devices allows attackers to view hidden images by navigating to data/com.android.gallery3d/.privatealbum/.encryptfiles and guessiCVE-2023-52275 · Other software · Tecno-mobile · reported by MITRELow 2.1
Gallery3d on Tecno Camon X CA7 devices allows attackers to view hidden images by navigating to data/com.android.gallery3d/.privatealbum/.encryptfiles and guessing the correct image file extension.
- Product
- Camon X Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2023The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via anCVE-2023-47882 · Other software · Kamivision · reported by MITREHigh 7.1
The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component.
- Product
- YI IOT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.complay.google.com
Dec 19, 2023Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow.CVE-2023-43826 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process. Users are recommended to upgrade to version 1.5.4, which fixes this issue.
- Product
- Apache Guacamole
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comlists.apache.org
Dec 18, 2023 Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and gaiCVE-2023-6691 · Other software · Cambium · reported by ics-cert@hq.dhs.govHigh 7.8
Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote code execution and gain root privileges.
- Product
- ePMP Force 300-25
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2023A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS ofCVE-2023-39509 · Other software · Bosch · reported by psirt@bosch.comHigh 7.2
A command injection vulnerability exists in Bosch IP cameras that allows an authenticated user with administrative rights to run arbitrary commands on the OS of the camera.
- Product
- Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Dec 18, 2023An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabilitieCVE-2022-41677 · Other software · Bosch · reported by psirt@bosch.comMedium 5.3
An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabilities) about the device itself and network settings of the device, disclosing possibly internal network settings if the device is connected to the internet.
- Product
- Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Dec 14, 2023SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (aka odoo-biometric-attendance) v.CVE-2023-48050 · Other software · Camsbiometrics · reported by MITRECritical 9.8
SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (aka odoo-biometric-attendance) v. 13.0 through 16.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the db parameter in the controllers/controllers.py component.
- Product
- Zkteco, Essl, Cams Biometrics Integration Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2023In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code.CVE-2023-48414 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 6.7
In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 4, 2023Integer overflow vulnerability in landmarkCopyImageToNative of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allows attacker to trigCVE-2023-42563 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.7
Integer overflow vulnerability in landmarkCopyImageToNative of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allows attacker to trigger heap overflow.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Dec 4, 2023Integer overflow vulnerability in detectionFindFaceSupportMultiInstance of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allows attaCVE-2023-42562 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.7
Integer overflow vulnerability in detectionFindFaceSupportMultiInstance of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allows attacker to trigger heap overflow.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Dec 4, 2023Memory Corruption in camera while installing a fd for a particular DMA buffer.CVE-2023-22383 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 6.7
Memory Corruption in camera while installing a fd for a particular DMA buffer.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 3, 2023In cameraisp, there is a possible information disclosure due to improper input validation.CVE-2023-32852 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.4
In cameraisp, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07670971; Issue ID: ALPS07670971.
- Product
- MT6779
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Dec 3, 2023In camera service, there is a possible missing permission check.CVE-2023-42747 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comHigh 7.8
In camera service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2023In camera service, there is a possible out of bounds read due to a missing bounds check.CVE-2023-42723 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 5.5
In camera service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2023In camera service, there is a possible use after free due to a logic error.CVE-2023-42722 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 6.7
In camera service, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files and escalate privilCVE-2023-45253 · Other software · Huddly · reported by MITREHigh 7.8
An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files and escalate privileges via RollingFileAppender.DeleteFile method performed by the log4net library.
- Product
- Huddlycameraservices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2023DLL Hijacking vulnerability in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, due to the installation of the service in a directorCVE-2023-45252 · Other software · Huddly · reported by MITREHigh 7.8
DLL Hijacking vulnerability in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, due to the installation of the service in a directory that grants write privileges to standard users, allows attackers to manipulate files, execute arbitrary code, and escalate privileges.
- Product
- Huddlycameraservice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023Campaign Monitor for: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-38474 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Reflected XSS.This issue affects Campaign Monitor for WordPress: from n/a through 2.8.12.
- Product
- Campaign Monitor for
- Affected
- up to 2.8.12
- What to do
- Affects up to 2.8.12. Update Campaign Monitor for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 23, 2023Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal.CVE-2023-6118 · Other software · Neutron · reported by iletisim@usom.gov.trHigh 7.5
Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal. This issue affects IP Camera: before b1130.1.0.1.
- Product
- IP Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Nov 22, 2023Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera vCVE-2023-3103 · Other software · Unitree Robotics · reported by cve-coordination@incibe.esHigh 8
Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera video stream. In addition, if a MITM attack is carried out, it is possible to consume the robot's resources, which could lead to a denial-of-service (DOS) condition.
- Product
- A1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2023Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated user to potentially enable escalation of priCVE-2023-38411 · Other software · Intel · reported by secure@intel.comLow 3.9
Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Smart Campus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2023Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device.CVE-2023-5747 · Other software · Hanwha Vision Co., Ltd. · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882High 7.2
Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing an attacker to run arbitrary code. HanwhaVision has released patched firmware for the highlighted flaw. Please refer to the hanwhavision security report for more information and solution."
- Product
- PNV-A6081R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavision.comhanwhavision.com
Nov 13, 2023badmonkey, a Security Researcher has found a flaw that allows for a authenticated command injection on the camera.CVE-2023-5037 · Other software · Hanwha Vision Co., Ltd. · reported by fc9afe74-3f80-4fb7-a313-e6f036a89882High 7.1
badmonkey, a Security Researcher has found a flaw that allows for a authenticated command injection on the camera. An attacker could inject malicious into request packets to execute command. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
- Product
- A-Series, Q-Series, PNM-series Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhanwhavision.comhanwhavision.com
Nov 8, 2023Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 has a command injCVE-2023-4249 · Other software · Zavio · reported by ics-cert@hq.dhs.govHigh 8.8
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 has a command injection vulnerability in their implementation of their binaries and handling of network requests.
- Product
- IP Camera CF7500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to CVE-2023-45225 · Other software · Zavio · reported by ics-cert@hq.dhs.govCritical 9.8
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While parsing certain XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
- Product
- IP Camera CF7500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable toCVE-2023-43755 · Other software · Zavio · reported by ics-cert@hq.dhs.govCritical 9.8
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. During the processing and parsing of certain fields in XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
- Product
- IP Camera CF7500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to CVE-2023-3959 · Other software · Zavio · reported by ics-cert@hq.dhs.govCritical 9.8
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. While processing XML elements from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
- Product
- IP Camera CF7500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 8, 2023Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to sCVE-2023-39435 · Other software · Zavio · reported by ics-cert@hq.dhs.govHigh 8.8
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to stack-based overflows. During the process of updating certain settings sent from incoming network requests, the product does not sufficiently check or validate allocated buffer size. This may lead to remote code execution.
- Product
- IP Camera CF7500
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023In camera driver, there is a possible out of bounds write due to a incorrect bounds check.CVE-2022-48456 · Other software · Unisoc (Shanghai) Technologies Co., Ltd. · reported by security@unisoc.comMedium 4.4
In camera driver, there is a possible out of bounds write due to a incorrect bounds check. This could lead to local denial of service with System execution privileges needed
- Product
- SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2023Campaign Monitor Forms by Optin Cat: Does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true"CVE-2023-5098 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string "true", which could lead to a variety of outcomes, including DoS.
- Product
- Campaign Monitor Forms by Optin Cat
- Fixed in
- 2.5.6
- What to do
- Update Campaign Monitor Forms by Optin Cat to 2.5.6 or newer.
Oct 26, 2023An issue was discovered on certain ABUS TVIP cameras.CVE-2018-17879 · Other software · Abus · reported by MITRECritical 9.8
An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There are several injection points in various scripts.
- Product
- Tvip 10000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023Buffer Overflow vulnerability in certain ABUS TVIP cameras allows attackers to gain control of the program via crafted string sent to sprintf() function.CVE-2018-17878 · Other software · Abus · reported by MITRECritical 9.8
Buffer Overflow vulnerability in certain ABUS TVIP cameras allows attackers to gain control of the program via crafted string sent to sprintf() function.
- Product
- Tvip 10000 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2023Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS TVIP cameras.CVE-2018-17559 · Other software · abus · reported by MITREHigh 7.5
Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS TVIP cameras.
- Product
- tvip_72500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023A vulnerability regarding use of externally-controlled format string is found in the cgi component.CVE-2023-5746 · Network & remote access · Synology · reported by security@synology.comCritical 9.8
A vulnerability regarding use of externally-controlled format string is found in the cgi component. This allows remote attackers to execute arbitrary code via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.5-0185 may be affected: BC500 and TC500.
- Product
- Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Oct 20, 2023An OS command injection vulnerability has been reported to affect QUSBCam2.CVE-2023-23373 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 8.8
An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: QUSBCam2 2.0.3 ( 2023/06/15 ) and later
- Product
- QUSBCam2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20).CVE-2023-45205 · Other software · Siemens · reported by productcert@siemens.comHigh 7.8
A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges to `NT AUTHORITY/SYSTEM`.
- Product
- SICAM PAS/PQS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Oct 10, 2023A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22).CVE-2023-38640 · Other software · Siemens · reported by productcert@siemens.comMedium 6.6
A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to read and modify configuration data in the context of the application process.
- Product
- SICAM PAS/PQS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Oct 3, 2023The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera CCVE-2023-0506 · Other software · ByDemes Group · reported by cve-coordination@incibe.esHigh 8.8
The web service of ByDemes Group Airspace CCTV Web Service in its 2.616.BY00.11 version, contains a privilege escalation vulnerability, detected in the Camera Control Panel, whose exploitation could allow a low-privileged attacker to gain administrator access.
- Product
- Airspace CCTV Web Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023Transient DOS in Modem while triggering a camping on an 5G cell.CVE-2023-24843 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.5
Transient DOS in Modem while triggering a camping on an 5G cell.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Oct 1, 2023In camera middleware, there is a possible out of bounds write due to a missing input validation.CVE-2023-32827 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In camera middleware, there is a possible out of bounds write due to a missing input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07993539; Issue ID: ALPS07993539.
- Product
- MT6879, MT6886, MT6895, MT6983, MT6985, MT6989, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8185, MT8188, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8390, MT8395
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Oct 1, 2023In camera middleware, there is a possible out of bounds write due to a missing input validation.CVE-2023-32826 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 6.7
In camera middleware, there is a possible out of bounds write due to a missing input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07993539; Issue ID: ALPS07993544.
- Product
- MT6879, MT6886, MT6895, MT6983, MT6985, MT6989, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8185, MT8188, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8390, MT8395
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.