Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

519 results · page 2 of 11

Mar 4, 2024An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based meCVE-2023-41827 · Other software · Motorola · reported by psirt@lenovo.comMedium 5.1
An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inject an HTML-based message on screen UI.
Product
Phones
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record en-us.support.motorola.com en-us.support.motorola.com
Dec 28, 2023 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.CVE-2023-51431 · Other software · Honor · reported by 3836d913-7555-4dd0-a509-f5667fdf5fe4High 7
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.
Product
com.hihonor.phoneservice
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hihonor.com hihonor.com
Nov 21, 2023A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to conduct a stored croCVE-2023-20265 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to view a page containing malicious HTML or script content. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid credentials to access the web-based management interface of the affected device.
Product
Cisco IP Phones with Multiplatform Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Sep 1, 2023I some cases, when the device is USB-tethered to a host PC, and the device is sharing its mobile network connection with the host PC, if the user originates a cCVE-2022-3407 · Other software · Motorola Mobility · reported by psirt@lenovo.comMedium 4.9
I some cases, when the device is USB-tethered to a host PC, and the device is sharing its mobile network connection with the host PC, if the user originates a call on the device, then the device's modem may reset and cause the phone call to not succeed. This may block the user from dialing emergency services. This patch resolves the device's modem reset issue.
Product
Motorola smartphones
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record en-us.support.motorola.com en-us.support.motorola.com
Aug 16, 2023 There is a permission and access control vulnerability in some ZTE mobile phones.CVE-2023-25647 · Other software · ZTE · reported by psirt@zte.com.cnMedium 4.7
There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event.
Product
Some ZTE Mobile Phones
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.zte.com.cn support.zte.com.cn
Aug 16, 2023A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, CVE-2023-20221 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a user of the web-based management interface of an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an authenticated user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform a factory reset of the affected device, resulting in a Denial of Service (DoS) condition.
Product
Cisco IP Phones with Multiplatform Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Aug 11, 2023An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000.CVE-2023-22957 · Other software · audiocodes_ltd · reported by MITREHigh 7.5
An issue was discovered in libac_des3.so on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of hard-coded cryptographic key, an attacker with access to backup or configuration files is able to decrypt encrypted values and retrieve sensitive information, e.g., the device root password.
Product
voip_phones
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 11, 2023An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000.CVE-2023-22956 · Other software · audiocodes_ltd · reported by MITREHigh 7.5
An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. Due to the use of a hard-coded cryptographic key, an attacker is able to decrypt encrypted configuration files and retrieve sensitive information.
Product
voip_phones
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 11, 2023An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000.CVE-2023-22955 · Other software · audiocodes_ltd · reported by MITREHigh 7.8
An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store the required checksums for the flasher tool, an attacker is able to store malicious firmware.
Product
voip_phones
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 3, 2023A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to moCVE-2023-20218 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.8
A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remote attacker to to modify a web page in the context of a user's browser. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious websites, or the attacker could use this vulnerability to conduct further client-side attacks. Cisco will not release software updates that address this vulnerability. {{value}} ["%7b%7bvalue%7d%7d"])}]]
Product
Cisco Small Business IP Phones
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Aug 3, 2023A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conductCVE-2023-20181 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.1
A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduct XSS attacks. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Product
Cisco Small Business IP Phones
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Jun 19, 2023Vulnerability of unauthorized calling on HUAWEI phones and tablets.Successful exploitation of this vulnerability may affect availability.CVE-2023-34155 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Vulnerability of unauthorized calling on HUAWEI phones and tablets.Successful exploitation of this vulnerability may affect availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
Jun 19, 2023Vulnerability of missing authentication on certain HUAWEI phones.Successful exploitation of this vulnerability can lead to ads and other windows to display at aCVE-2022-48491 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
Vulnerability of missing authentication on certain HUAWEI phones.Successful exploitation of this vulnerability can lead to ads and other windows to display at any time.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 30, 2023There is an unauthorized access vulnerability in some ZTE mobile phones.CVE-2022-39075 · Other software · ZTE · reported by psirt@zte.com.cnHigh 7.1
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could delete some system files without user permission.
Product
Blade A52 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.zte.com.cn support.zte.com.cn
May 30, 2023There is an unauthorized access vulnerability in some ZTE mobile phones.CVE-2022-39074 · Other software · ZTE · reported by psirt@zte.com.cnLow 3.3
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could start a non-public interface of an application without user permission.
Product
Blade A52 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.zte.com.cn support.zte.com.cn
May 30, 2023There is an unauthorized access vulnerability in some ZTE mobile phones.CVE-2022-39071 · Other software · ZTE · reported by psirt@zte.com.cnHigh 7.1
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could overwrite some system configuration files and user installers without user permission.
Product
Blade A52 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.zte.com.cn support.zte.com.cn
May 26, 2023Integer overflow vulnerability in some phones.CVE-2022-48480 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Integer overflow vulnerability in some phones. Successful exploitation of this vulnerability may affect service confidentiality.
Product
EMUI
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com
May 4, 2023A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitraryCVE-2023-20126 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to a missing authentication process within the firmware upgrade function. An attacker could exploit this vulnerability by upgrading an affected device to a crafted version of firmware. A successful exploit could allow the attacker to execute arbitrary code on the affected device with full privileges. Cisco has not released firmware updates to address this vulnerability.
Product
Cisco Small Business IP Phones
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Mar 28, 2023This vulnerability allows local attackers to execute arbitrary code on affected installations of Samsung Galaxy S21 prior to 4.5.40.5 phones.CVE-2022-1230 · Computers, phones & browsers · Samsung · reported by zdi-disclosures@trendmicro.comLow 3.9
This vulnerability allows local attackers to execute arbitrary code on affected installations of Samsung Galaxy S21 prior to 4.5.40.5 phones. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of redirections. An attacker can force a redirection to a site that serves malicious content. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the current user. Was ZDI-CAN-15918.
Product
Galaxy S21
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com zerodayinitiative.com
Mar 27, 2023Some smartphones have configuration issues.CVE-2022-48353 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which results in system service exceptions.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 27, 2023Some smartphones have data initialization issues.CVE-2022-48352 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Some smartphones have data initialization issues. Successful exploitation of this vulnerability may cause a system panic.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Mar 16, 2023Improper privilege management vulnerability in PhoneStatusBarPolicy in System UI prior to SMR Mar-2023 Release 1 allows attacker to turn off Do not disturb via CVE-2023-21458 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Improper privilege management vulnerability in PhoneStatusBarPolicy in System UI prior to SMR Mar-2023 Release 1 allows attacker to turn off Do not disturb via unprotected intent.
Product
Samsung Mobile Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Mar 3, 2023Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary cCVE-2023-20079 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.
Product
Cisco IP Phones with Multiplatform Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Mar 3, 2023Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary cCVE-2023-20078 · Network & remote access · Cisco · reported by psirt@cisco.comCritical 9.8
Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.
Product
Cisco IP Phones with Multiplatform Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Jan 20, 2023A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass auCVE-2023-20018 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 8.6
A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to access certain parts of the web interface that would normally require authentication.
Product
Cisco Session Initiation Protocol (SIP) Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Dec 20, 2022Some smartphones have the input validation vulnerability.CVE-2022-46328 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Some smartphones have the input validation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 20, 2022Some smartphones have configuration issues.CVE-2022-46327 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause privilege escalation, which results in system service exceptions.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 20, 2022Some smartphones have the out-of-bounds write vulnerability.CVE-2022-46326 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 20, 2022Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptions.CVE-2022-46325 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptions.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 20, 2022Some smartphones have the out-of-bounds write vulnerability.CVE-2022-46324 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 20, 2022Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptions.CVE-2022-46323 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptions.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 20, 2022Some smartphones have the out-of-bounds write vulnerability.CVE-2022-46322 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Dec 20, 2022Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed.CVE-2022-41590 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed. Successful exploitation of this vulnerability affects the smartphone availability.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record device.harmonyos.com device.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41603 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41602 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41601 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41600 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41598 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41597 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41595 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41594 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41593 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Oct 14, 2022The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of tCVE-2022-41592 · Other software · Huawei · reported by psirt@huawei.comLow 3.4
The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application (TA).Successful exploitation of this vulnerability may affect the fingerprint service.
Product
HarmonyOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com device.harmonyos.com
Jul 14, 2022A denial of service vulnerability exists in some Xiaomi models of phones.CVE-2020-14127 · Other software · MI · reported by security@xiaomi.comHigh 7.5
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by heap overflow and can be exploited by attackers to make remote denial of service.
Product
Miui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record trust.mi.com trust.mi.com
Jul 12, 2022Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allows local attackers CVE-2022-33711 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 5.5
Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allows local attackers to delete arbitrary directory using directory junction.
Product
Samsung USB Driver Windows Installer for Mobile Phones
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.samsungmobile.com security.samsungmobile.com
Jun 15, 2022A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified CommunicatioCVE-2022-20817 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.4
A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager (CUCM) is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could result in duplicated manufactured keys installed on multiple devices. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on the secure communication between the phone and the CUCM. A successful exploit could allow the attacker to impersonate another user's phone. This vulnerability cannot be addressed with software updates. There is a workaround that addresses this vulnerability.
Product
Cisco IP Phones with Multiplatform Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Jun 8, 2022A denial of service vulnerability exists in some Xiaomi models of phones.CVE-2020-14125 · Other software · MI · reported by security@xiaomi.comHigh 7.5
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound read/write and can be exploited by attackers to make denial of service.
Product
Miui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record trust.mi.com trust.mi.com
Jun 7, 2022PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesystemCVE-2019-9972 · Other software · 3cx · reported by MITREHigh 8.8
PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the phonesystem user privileges because of "<space><space> followed by <shift><enter>" mishandling.
Product
Phone System Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gosecure.net gosecure.net
Jun 7, 2022PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo with the tcpdump commaCVE-2019-9971 · Other software · 3cx · reported by MITREHigh 8.8
PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo with the tcpdump command, without a password. This occurs because the -z (aka postrotate-command) option to tcpdump can be unsafe when used in conjunction with sudo.
Product
Phone System Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gosecure.net gosecure.net
May 13, 2022There is a configuration defect in the activation lock of mobile phones.Successful exploitation of this vulnerability may affect application availability.CVE-2022-29793 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a configuration defect in the activation lock of mobile phones.Successful exploitation of this vulnerability may affect application availability.
Product
Emui
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record consumer.huawei.com consumer.huawei.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.