Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,146 results · page 19 of 43
Oct 19, 2022Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in worksCVE-2022-43434 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.3
Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
- Product
- Jenkins NeuVector Vulnerability Scanner Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 19, 2022Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived arCVE-2022-43433 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
- Product
- Jenkins ScreenRecorder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 19, 2022Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archivCVE-2022-43432 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
- Product
- Jenkins XFramium Builder Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 12, 2022Multiple Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl.dll unpacker handler function crashes.CVE-2022-28887 · Other software · F-Secure and WithSecure · reported by cve-notifications-us@f-secure.comMedium 4.3
Multiple Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl.dll unpacker handler function crashes. This can lead to a possible scanning engine crash.
- Product
- All F-Secure and WithSecure Endpoint Protection products for Windows & Mac F-Secure Linux Security (32-bit) F-Secure Linux Security (64-bit) F-Secure Atlant F-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comwithsecure.com
Oct 11, 2022Microsoft Windows Defender Elevation of Privilege VulnerabilityCVE-2022-37971 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft Windows Defender Elevation of Privilege Vulnerability
- Product
- Microsoft Malware Protection Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Oct 10, 2022A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local attacker to escalate priCVE-2022-41744 · Other software · Trend Micro · reported by security@trendmicro.comHigh 7
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One Vulnerability Protection integrated component could allow a local attacker to escalate privileges and turn a specific working directory into a mount point on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
- Product
- Trend Micro Apex One
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comzerodayinitiative.com
Oct 7, 2022tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware.CVE-2022-39287 · Other software · valexandersaulys · reported by GitHubHigh 8.1
tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- tiny-csrf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.CVE-2022-39875 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.1
Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout.
- Product
- Samsung Account
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Oct 7, 2022Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory.CVE-2022-39854 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.4
Improper protection in IOMMU prior to SMR Oct-2022 Release 1 allows unauthorized access to secure memory.
- Product
- Samsung Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Sep 28, 2022BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.CVE-2020-27602 · Other software · Bigbluebutton · reported by MITRECritical 9.8
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.
- Product
- Bigbluebutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2022A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.so/aerdl.dll may go into an infinite loop when unpacking PECVE-2022-28886 · Other software · F-Secure and WithSecure · reported by cve-notifications-us@f-secure.comMedium 4.3
A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.so/aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine
- Product
- All F-Secure and WithSecure Endpoint Protection products for Windows running 32 bit operating system. F-Secure Linux Security 32 F-Secure Internet Gatekeeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comwithsecure.com
Sep 20, 2022Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local acCVE-2021-33081 · Other software · Intel · reported by secure@intel.comHigh 7.9
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.
- Product
- SSD 600p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsolidigm.comsolidigm.com
Sep 20, 2022Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local acCVE-2021-33079 · Other software · Intel · reported by secure@intel.comMedium 4.1
Protection mechanism failure in firmware for some Intel(R) SSD DC Products may allow a privileged user to potentially enable information disclosure via local access.
- Product
- SSD 600p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsolidigm.comsolidigm.com
Sep 13, 2022Windows DPAPI (Data Protection Application Programming Interface) Information Disclosure VulnerabilityCVE-2022-34723 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows DPAPI (Data Protection Application Programming Interface) Information Disclosure Vulnerability
- Product
- Windows 11 version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 12, 2022Dell BIOS versions contain an Improper Protection Against Voltage and Clock Glitches vulnerability.CVE-2022-31224 · Other software · Dell · reported by security_alert@emc.comLow 2
Dell BIOS versions contain an Improper Protection Against Voltage and Clock Glitches vulnerability. An attacker with physical access to the system could potentially exploit this vulnerability by triggering a fault condition in order to change the behavior of the system.
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2022Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok.CVE-2022-37767 · Other software · Pebbletemplates · reported by MITRECritical 9.8
Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. NOTE: the vendor disputes this because input to the Pebble templating engine is intended to include arbitrary Java code, and thus either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input. The engine is not responsible for validating the input.
- Product
- Pebble Templates
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022Missing protection mechanism for alternate hardware interface in SmaCam CS-QR10 all versions and SmaCam Night Vision CS-QR20 all versions allows an attacker to CVE-2022-38399 · Other software · PLANEX COMMUNICATIONS INC. · reported by vultures@jpcert.or.jpMedium 6.8
Missing protection mechanism for alternate hardware interface in SmaCam CS-QR10 all versions and SmaCam Night Vision CS-QR20 all versions allows an attacker to execute an arbitrary OS command by having the product connect to the product's specific serial connection
- Product
- SmaCam CS-QR10 and SmaCam Night Vision CS-QR20
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2022IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes witCVE-2022-37771 · Other software · Iobit · reported by MITREMedium 6.7
IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable.
- Product
- Malware Fighter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmrvar0x.compacketstormsecurity.com
Sep 6, 2022PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify prCVE-2022-36670 · Other software · Pcprotect · reported by MITREMedium 6.7
PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable.
- Product
- Endpoint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmrvar0x.commrvar0x.com
Sep 6, 2022WP Cerber Security: Security protection bypassCVE-2022-2939 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possible. This is due to improper validation on the value supplied through the 'author' parameter found in the ~/cerber-load.php file. In vulnerable versions, the plugin only blocks requests if the value supplied is numeric, making it possible for attackers to supply additional non-numeric characters to bypass the protection. The non-numeric characters are stripped and the user requested is displayed. This can be used by unauthenticated attackers to gather information about users that can targeted in further attacks.
- Product
- WP Cerber Security
- Affected
- up to 9.0
- What to do
- Affects up to 9.0. Update WP Cerber Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 6, 2022A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files.CVE-2022-28884 · Other software · F-Secure and WithSecure · reported by cve-notifications-us@f-secure.comMedium 4.3
A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files. It is possible that this can crash the scanning engine.
- Product
- All F-Secure and WithSecure Endpoint Protection products for Windows and Mac running 32 bit operating system. F-Secure Linux Security 32 F-Secure Atlant F-Secu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwithsecure.comwithsecure.com
Sep 6, 2022AOS-CX lacks Anti-CSRF protections in place for state-changing operations.CVE-2022-23680 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.8
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. This can potentially be exploited by an attacker to execute commands in the context of another user in ArubaOS-CX Switches version(s): AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1020 and below, AOS-CX 10.08.xxxx: 10.08.1060 and below, AOS-CX 10.06.xxxx: 10.06.0200 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address this security vulnerability.
- Product
- Aos-cx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Sep 6, 2022AOS-CX lacks Anti-CSRF protections in place for state-changing operations.CVE-2022-23679 · Other software · Arubanetworks · reported by security-alert@hpe.comHigh 8.8
AOS-CX lacks Anti-CSRF protections in place for state-changing operations. This can potentially be exploited by an attacker to execute commands in the context of another user in ArubaOS-CX Switches version(s): AOS-CX 10.10.xxxx: 10.10.0002 and below, AOS-CX 10.09.xxxx: 10.09.1020 and below, AOS-CX 10.08.xxxx: 10.08.1060 and below, AOS-CX 10.06.xxxx: 10.06.0200 and below. Aruba has released upgrades for ArubaOS-CX Switch Devices that address this security vulnerability.
- Product
- Aos-cx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
Aug 30, 2022Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leCVE-2022-33935 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
- Product
- Data Protection Advisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2022de.fac2 1.34 allows bypassing the User Presence protection mechanism when there is malware on the victim's PC.CVE-2022-33172 · Other software · Bund · reported by MITREMedium 5.5
de.fac2 1.34 allows bypassing the User Presence protection mechanism when there is malware on the victim's PC.
- Product
- De.fac2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl unpack function crashes.CVE-2022-28883 · Other software · F-Secure and WithSecure · reported by cve-notifications-us@f-secure.comLow 3.5
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aerdl unpack function crashes. This can lead to a possible scanning engine crash. The exploit can be triggered remotely by an attacker.
- Product
- All F-Secure and WithSecure Endpoint Protection products for Windows & Mac F-Secure Linux Security (32-bit) F-Secure Linux Security (64-bit) F-Secure Atlant F-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwithsecure.comwithsecure.com
Aug 23, 2022A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aegen.dll will go into an infinite loop when unpacking PE fCVE-2022-28882 · Other software · F-Secure and WithSecure · reported by cve-notifications-us@f-secure.comMedium 4.3
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure & WithSecure products whereby the aegen.dll will go into an infinite loop when unpacking PE files. This eventually leads to scanning engine crash. The exploit can be triggered remotely by an attacker.
- Product
- All F-Secure and WithSecure Endpoint Protection products for Windows & Mac F-Secure Linux Security (32-bit) F-Secure Linux Security (64-bit) F-Secure Atlant F-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwithsecure.comwithsecure.com
Aug 22, 2022Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path whichCVE-2021-28861 · Other software · Siemens · reported by MITREHigh 7.4
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.python.orggithub.com
Aug 15, 2022Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI.CVE-2022-36312 · Other software · Airspan · reported by cve-assign@fb.comHigh 8.8
Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.
- Product
- AirVelocity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpdesk.airspan.comhelpdesk.airspan.com
Aug 15, 2022Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections.CVE-2022-38359 · Other software · Eyeofnetwork · reported by vulnreport@tenable.comHigh 8.8
Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections. An attacker can, for instance, delete the admin user by directing an authenticated user to the URL https://<target-address>/module/admin_user/index.php?DataTables_Table_0_length=10&user_selected%5B%5D=1&user_mgt_list=delete_user&action=submit by means of a crafted link.
- Product
- Eyes Of Network Web
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Aug 12, 2022In Settings, there is a possible way to bypass factory reset protections due to a sandbox escape.CVE-2022-20302 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.6
In Settings, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of privilege if the attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-200746457
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Aug 12, 2022In Settings, there is a possible way to bypass factory reset protections due to a logic error in the code.CVE-2022-20297 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Settings, there is a possible way to bypass factory reset protections due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-201561699
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Aug 12, 2022In Settings, there is a possible way to bypass factory reset protections due to a logic error in the code.CVE-2022-20292 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Settings, there is a possible way to bypass factory reset protections due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-202975040
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Aug 10, 2022An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application.CVE-2022-2634 · Other software · Digi · reported by ics-cert@hq.dhs.govCritical 10
An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed.
- Product
- ConnectPort X2D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2022A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the aerdl.dll component used in certain WithSecure products unpacker function CVE-2022-28881 · Other software · F-Secure and WithSecure · reported by cve-notifications-us@f-secure.comMedium 4.3
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the aerdl.dll component used in certain WithSecure products unpacker function crashes which leads to scanning engine crash. The exploit can be triggered remotely by an attacker.
- Product
- All F-Secure and WithSecure Endpoint Protection products for Windows & Mac F-Secure Linux Security (32-bit) F-Secure Linux Security (64-bit) F-Secure Atlant F-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comwithsecure.com
Aug 5, 2022A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files it is possible tCVE-2022-28880 · Other software · F-Secure · reported by cve-notifications-us@f-secure.comMedium 4.3
A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files it is possible that can crash the scanning engine. The exploit can be triggered remotely by an attacker.
- Product
- All F-Secure and WithSecure Endpoint Protection products for Mac F-Secure Linux Security (32-bit) F-Secure Linux Security (64-bit) F-Secure Atlant F-Secure Inte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comwithsecure.com
Jul 27, 2022Insufficient policy enforcement in Safe Browsing in Google Chrome on Mac prior to 102.0.5005.61 allowed a remote attacker to bypass downloads protection policy CVE-2022-1874 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Insufficient policy enforcement in Safe Browsing in Google Chrome on Mac prior to 102.0.5005.61 allowed a remote attacker to bypass downloads protection policy via a crafted HTML page.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Jul 22, 2022A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aepack.dll component can cCVE-2022-28879 · Other software · F-Secure · reported by cve-notifications-us@f-secure.comMedium 4.3
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aepack.dll component can crash the scanning engine.
- Product
- All F-Secure and WithSecure Endpoint Protection products for Mac F-Secure Linux Security (32-bit) F-Secure Linux Security (64-bit) F-Secure Atlant F-Secure Inte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comwithsecure.com
Jul 22, 2022A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed APK file it is possible that caCVE-2022-28878 · Other software · F-Secure · reported by cve-notifications-us@f-secure.comMedium 4.3
A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed APK file it is possible that can crash the scanning engine.
- Product
- All F-Secure and WithSecure Endpoint Protection products for Windows & Mac F-Secure Linux Security 64 F-Secure Linux Security 32 F-Secure Atlant F-Secure Intern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comwithsecure.com
Jul 21, 2022This vulnerability allows local user to delete arbitrary file in the system and bypassing security protection which can be abused for local privilege escalationCVE-2022-28877 · Other software · F-Secure and WithSecure · reported by cve-notifications-us@f-secure.comMedium 4.3
This vulnerability allows local user to delete arbitrary file in the system and bypassing security protection which can be abused for local privilege escalation on affected F-Secure & WithSecure windows endpoint products. An attacker must have code execution rights on the victim machine prior to successful exploitation.
- Product
- All F-Secure and WithSecure Endpoint Protection Products for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comwithsecure.com
Jul 21, 2022Dell EMC Data Protection Central versions 19.1, 19.2, 19.3, 19.4, 19.5, 19.6, contain(s) a Cross-Site Request Forgery Vulnerability.CVE-2022-34367 · Other software · Dell · reported by security_alert@emc.comMedium 5.4
Dell EMC Data Protection Central versions 19.1, 19.2, 19.3, 19.4, 19.5, 19.6, contain(s) a Cross-Site Request Forgery Vulnerability. A(n) remote unauthenticated attacker could potentially exploit this vulnerability, leading to processing of unintended server operations.
- Product
- Data Protection Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2022A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault.CVE-2020-36558 · Computers, phones & browsers · Linux · reported by MITREMedium 5.1
A race condition in the Linux kernel before 5.5.7 involving VT_RESIZEX could lead to a NULL pointer dereference and general protection fault.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcdn.kernel.orggit.kernel.org
Jul 14, 2022A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aeheur.dll component can cCVE-2022-28876 · Other software · F-Secure · reported by cve-notifications-us@f-secure.comMedium 4.3
A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aeheur.dll component can crash the scanning engine. The exploit can be triggered remotely by an attacker.
- Product
- All F-Secure & WithSecure endpoint protection products for Windows and Mac. F-Secure Linux Security (32-bit). F-Secure Linux Security (64-bit). F-Secure Atlan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comwithsecure.com
Jul 12, 2022Implemented protections on AWS credentials that were not properly protected.CVE-2022-22998 · Network & remote access · Western Digital · reported by psirt@wdc.comHigh 8
Implemented protections on AWS credentials that were not properly protected.
- Product
- My Cloud Home
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwesterndigital.comwesterndigital.com
Jul 7, 2022Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administraCVE-2022-23744 · Other software · Checkpoint · reported by cve@checkpoint.comLow 2.3
Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administrator.
- Product
- Endpoint Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupportcenter.checkpoint.comsupportcenter.checkpoint.com
Jun 24, 2022Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for CVE-2022-2105 · Other software · Secheron · reported by ics-cert@hq.dhs.govCritical 9.4
Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for the vendor. Web server root level access allows for changing of safety critical parameters.
- Product
- SEPCOS Control and Protection Relay firmware package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash).CVE-2022-2104 · Other software · Secheron · reported by ics-cert@hq.dhs.govCritical 9.9
The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash).
- Product
- SEPCOS Control and Protection Relay firmware package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable CVE-2022-2103 · Other software · Secheron · reported by ics-cert@hq.dhs.govCritical 9.8
An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable directories.
- Product
- SEPCOS Control and Protection Relay firmware package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022Controls limiting uploads to certain file extensions may be bypassed.CVE-2022-2102 · Other software · Secheron · reported by ics-cert@hq.dhs.govCritical 9.4
Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file upload into a location where PHP scripts may be executed.
- Product
- SEPCOS Control and Protection Relay firmware package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.CVE-2022-1668 · Other software · Secheron · reported by ics-cert@hq.dhs.govCritical 9.8
Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.
- Product
- SEPCOS Control and Protection Relay firmware package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.