Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,781 results · page 21 of 36
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28352 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Windows Speech Runtime Elevation of Privilege VulnerabilityCVE-2021-28351 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Speech Runtime Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Windows Speech Runtime Elevation of Privilege VulnerabilityCVE-2021-28347 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Speech Runtime Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28346 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28345 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28344 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28343 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28342 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28341 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28340 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28339 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28338 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28337 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28336 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28335 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28334 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28333 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28332 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28331 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28330 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28329 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Apr 13, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-28327 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Mar 26, 2021MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premiCVE-2021-1628 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
MuleSoft is aware of a XML External Entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Affected versions: Mule 4.x runtime released before February 2, 2021.
- Product
- Mule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.salesforce.comhelp.salesforce.com
Mar 26, 2021MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-preCVE-2021-1627 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
MuleSoft is aware of a Server Side Request Forgery vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. This affects: Mule 3.8.x,3.9.x,4.x runtime released before February 2, 2021.
- Product
- Mule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.salesforce.comhelp.salesforce.com
Mar 26, 2021MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise cCVE-2021-1626 · Other software · Salesforce · reported by security@salesforce.comCritical 9.8
MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Versions affected: Mule 4.1.x and 4.2.x runtime released before February 2, 2021.
- Product
- Mule
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.salesforce.comhelp.salesforce.com
Mar 23, 2021XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2021-21380 · Other software · xwiki · reported by GitHubHigh 7.7
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform (and only those with the Ratings API installed), the Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. This might lead to an SQL script injection quite easily for any user having Script rights on XWiki. The problem has been patched in XWiki 12.9RC1. The only workaround besides upgrading XWiki would be to uninstall the Ratings API in XWiki from the Extension Manager.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjira.xwiki.org
Mar 12, 2021XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2021-21379 · Other software · xwiki · reported by GitHubHigh 7.7
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions of XWiki Platform, the `{{wikimacrocontent}}` executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro (very often a user which has Programming rights). Fortunately, no such macro exists by default in XWiki Standard but one could have been created or installed with an extension. This vulnerability has been patched in versions XWiki 12.6.3, 11.10.11 and 12.8-rc-1. There is no easy workaround other than disabling the affected macros. Inserting content in a safe way or knowing what is the user who called the wiki macro is not easy.
- Product
- xwiki-platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comjira.xwiki.org
Mar 10, 2021In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through KuCVE-2021-21334 · Other software · containerd · reported by GitHubMedium 6.3
In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may receive incorrect environment variables, including values that are defined for other containers. If the affected containers have different security contexts, this may allow sensitive information to be unintentionally shared. If you are not using containerd's CRI implementation (through one of the mechanisms described above), you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image which have different environment variables, you are not vulnerable to this issue. If you are not launching multiple containers or Kubernetes pods from the same image in rapid succession, you have reduced likelihood of being vulnerable to this issue This vulnerability has been fixed in containerd 1.3.10 and containerd 1.4.4. Users should update to these versions.
- Product
- containerd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2021Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Runtime Catalog).CVE-2021-2089 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Runtime Catalog). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iStore, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle iStore accessible data as well as unauthorized update, insert or delete access to some of Oracle iStore accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
- Product
- iStore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2021Windows Remote Procedure Call Runtime Elevation of Privilege VulnerabilityCVE-2021-1702 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Remote Procedure Call Runtime Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-1701 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-1700 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-1673 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-1671 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-1667 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-1666 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-1664 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-1660 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2021-1658 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Remote Procedure Call Runtime Remote Code Execution Vulnerability
- Product
- Windows 10 Version 20H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 12, 2021Windows Runtime C++ Template Library Elevation of Privilege VulnerabilityCVE-2021-1650 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Runtime C++ Template Library Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1803
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Jan 11, 2021In updatePermissionSourcePackage of PermissionManagerService.java, there is a possible automatic runtime permission grant due to a confused deputy.CVE-2021-0307 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In updatePermissionSourcePackage of PermissionManagerService.java, there is a possible automatic runtime permission grant due to a confused deputy. This could lead to local escalation of privilege allowing a malicious app to silently gain access to a dangerous permission with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Android ID: A-155648771.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 8, 2021Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability.CVE-2020-26186 · Other software · Dell · reported by security_alert@emc.comMedium 6.8
Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local attacker with access to system memory may exploit this vulnerability by overwriting the RuntimeServices structure to execute arbitrary code in System Management Mode (SMM).
- Product
- CPG BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2021GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.CVE-2020-36067 · Other software · Gjson Project · reported by MITREHigh 7.5
GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
- Product
- Gjson
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2020An issue was discovered in the lucet-runtime-internals crate before 0.5.1 for Rust.CVE-2020-35859 · Other software · Lucet-runtime-internals Project · reported by MITRECritical 9.1
An issue was discovered in the lucet-runtime-internals crate before 0.5.1 for Rust. It mishandles sigstack allocation. Guest programs may be able to obtain sensitive information, or guest programs can experience memory corruption.
- Product
- Lucet-runtime-internals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrustsec.orgrustsec.org
Dec 28, 2020dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.CVE-2020-29245 · Other software · TAG Project · reported by MITREMedium 6.5
dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.
- Product
- TAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2020dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readTextWithDescrFrame.CVE-2020-29244 · Other software · TAG Project · reported by MITREMedium 6.5
dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readTextWithDescrFrame.
- Product
- TAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2020dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame.CVE-2020-29243 · Other software · TAG Project · reported by MITREMedium 6.5
dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame.
- Product
- TAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2020dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame.CVE-2020-29242 · Other software · TAG Project · reported by MITREMedium 6.5
dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame.
- Product
- TAG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2020jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.CVE-2020-35381 · Other software · Jsonparser Project · reported by MITREHigh 7.5
jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.
- Product
- Jsonparser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Nov 30, 2020containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows.CVE-2020-15257 · Other software · containerd · reported by GitHubMedium 5.2
containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effe
- Product
- containerd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.