Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,299 results · page 25 of 46
Jan 10, 2022There is a Null pointer dereference vulnerability in the camera module in smartphones.CVE-2021-40039 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Null pointer dereference vulnerability in the camera module in smartphones. Successful exploitation of this vulnerability may affect service integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 10, 2022There is a Null pointer dereference vulnerability in the camera module in smartphones.CVE-2021-40031 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Null pointer dereference vulnerability in the camera module in smartphones. Successful exploitation of this vulnerability may affect service integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jan 4, 2022In kd_camera_hw driver, there is a possible information disclosure due to uninitialized data.CVE-2022-20015 · Computers, phones & browsers · MediaTek, Inc. · reported by security@mediatek.comMedium 4.4
In kd_camera_hw driver, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05862966; Issue ID: ALPS05862966.
- Product
- MT6739, MT6757, MT6757C, MT6757CD, MT6757CH, MT6761, MT6762, MT6763, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, MT6877, MT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcorp.mediatek.comcorp.mediatek.com
Dec 14, 2021A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (AllCVE-2021-44165 · Other software · Siemens · reported by productcert@siemens.comHigh 7.2
A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41). The affected firmware contains a buffer overflow vulnerability in the web application that could allow a remote attacker with engineer or admin priviliges to potentially perform remote code execution.
- Product
- POWER METER SICAM Q100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-portal.siemens.comcert-portal.siemens.com
Dec 8, 2021utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2021-3815 · Other software · fabiocaccamo · reported by security@huntr.devCritical 9.8
utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- Product
- fabiocaccamo/utils.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2021This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS.CVE-2020-7879 · Other software · EFM networks & multimedia · reported by vuln@krcert.or.krHigh 8.8
This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wget binary, and there is no validation check. This vulnerability allows remote attackers to execute remote command.
- Product
- ipTIME C200 IP Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2021HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability.CVE-2021-26611 · Other software · Goqual · reported by vuln@krcert.or.krHigh 8.1
HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(reboot, factory reset, snapshot etc..)
- Product
- GKW-IC052
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2021ius_get.cgi in IpTime C200 camera allows remote code execution.CVE-2021-26614 · Other software · EFM networks & multimedia · reported by vuln@krcert.or.krHigh 7.5
ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable web service interface which invokes the arbitrary shell command.
- Product
- ipTIME C200 IP Camera
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files.CVE-2021-40745 · Other software · Adobe · reported by AdobeHigh 7.5
Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server.
- Product
- Campaign
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Nov 12, 2021An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the sameCVE-2021-3793 · Other software · Motorola · reported by psirt@lenovo.comMedium 6.5
An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated attacker on the same network as the device to access administrative pages that could result in information disclosure or device firmware update with verified firmware.
- Product
- Binatone Hubble Cameras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinatoneglobal.combinatoneglobal.com
Nov 12, 2021Some device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encrypted which could lead to the communicationCVE-2021-3792 · Other software · Motorola · reported by psirt@lenovo.comMedium 5.3
Some device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encrypted which could lead to the communication channel being accessible by an attacker.
- Product
- Binatone Hubble Cameras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinatoneglobal.combinatoneglobal.com
Nov 12, 2021An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same sCVE-2021-3791 · Other software · Motorola · reported by psirt@lenovo.comMedium 6.5
An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same subnet to download an encrypted log file containing sensitive information such as WiFi SSID and password.
- Product
- Binatone Hubble Cameras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinatoneglobal.combinatoneglobal.com
Nov 12, 2021A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the sameCVE-2021-3790 · Other software · Motorola · reported by psirt@lenovo.comMedium 6.5
A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same network to perform a denial-of-service attack against the device.
- Product
- Binatone Hubble Cameras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinatoneglobal.combinatoneglobal.com
Nov 12, 2021An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtaiCVE-2021-3789 · Other software · Motorola · reported by psirt@lenovo.comMedium 4.2
An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtain the encryption key used to decrypt firmware update packages.
- Product
- Binatone Hubble Cameras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinatoneglobal.combinatoneglobal.com
Nov 12, 2021An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access unauthorized access tCVE-2021-3788 · Other software · Motorola · reported by psirt@lenovo.comMedium 6.8
An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access unauthorized access to the device.
- Product
- Binatone Hubble Cameras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinatoneglobal.combinatoneglobal.com
Nov 12, 2021A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MQTT credentials thatCVE-2021-3787 · Other software · Motorola · reported by psirt@lenovo.comMedium 6.4
A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MQTT credentials that could result in unauthorized access to backend Hubble services.
- Product
- Binatone Hubble Cameras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinatoneglobal.combinatoneglobal.com
Nov 12, 2021An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same neCVE-2021-3577 · Other software · Motorola · reported by psirt@lenovo.comHigh 8.8
An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same network unauthorized access to the device.
- Product
- Binatone Hubble Cameras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbinatoneglobal.combinatoneglobal.com
Nov 2, 2021RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve an arbitrary read or write opCVE-2021-36925 · Network & remote access · Realtek · reported by MITREHigh 7.8
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve an arbitrary read or write operation from/to physical memory (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.
- Product
- Rtsupx USB Utility Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrealtek.comsentinelone.com
Nov 2, 2021RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool overflow (leading to ECVE-2021-36924 · Network & remote access · Realtek · reported by MITREHigh 7.8
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool overflow (leading to Escalation of Privileges, Denial of Service, and Code Execution) via a crafted Device IO Control packet to a device.
- Product
- Rtsupx USB Utility Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrealtek.comsentinelone.com
Nov 2, 2021RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB deCVE-2021-36923 · Network & remote access · Realtek · reported by MITREHigh 7.8
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB device privileged IN and OUT instructions (leading to Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.
- Product
- Rtsupx USB Utility Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrealtek.comsentinelone.com
Nov 2, 2021RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB deCVE-2021-36922 · Network & remote access · Realtek · reported by MITREHigh 7.8
RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthorized access to USB devices (Escalation of Privileges, Denial of Service, Code Execution, and Information Disclosure) via a crafted Device IO Control packet to a device.
- Product
- Rtsupx USB Utility Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrealtek.comsentinelone.com
Nov 1, 2021WPeMatico RSS Feed Fetcher: Does not escape the Feed URL added to a campaign before outputting it in an attributeCVE-2021-24793 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- WPeMatico RSS Feed Fetcher
- Fixed in
- 2.6.12
- What to do
- Update WPeMatico RSS Feed Fetcher to 2.6.12 or newer.
Oct 26, 2021caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.CVE-2011-4119 · Other software · Inria · reported by Red HatCritical 9.8
caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
- Product
- Caml-light
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgnats.netbsd.orgseclists.org
Oct 20, 2021In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch CVE-2021-25972 · Other software · camaleon_cms · reported by vulnerabilitylab@mend.ioMedium 4.9
In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.
- Product
- camaleon_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Oct 20, 2021In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception.CVE-2021-25971 · Other software · camaleon_cms · reported by vulnerabilitylab@mend.ioMedium 4.3
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
- Product
- camaleon_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Oct 20, 2021Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password.CVE-2021-25970 · Other software · camaleon_cms · reported by vulnerabilitylab@mend.ioHigh 8.8
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.
- Product
- camaleon_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Oct 20, 2021In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comCVE-2021-25969 · Other software · camaleon_cms · reported by vulnerabilitylab@mend.ioMedium 6.1
In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment.
- Product
- camaleon_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Oct 20, 2021Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Notification Framework).CVE-2021-35606 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.7
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Notification Framework). Supported versions that are affected are 9.0 and 9.2. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise CS Campus Community executes to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Campus Community accessible data. CVSS 3.1 Base Score 5.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
- Product
- PeopleSoft Enterprise CS Campus Community
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2021Possible stack overflow due to improper validation of camera name length before copying the name in VR Service in Snapdragon Compute, Snapdragon Connectivity, SCVE-2021-30256 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Possible stack overflow due to improper validation of camera name length before copying the name in VR Service in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT
- Product
- Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Sep 22, 2021Hikvision Improper Input ValidationCVE-2021-36260 · Network & remote access · Hikvision · reported by hsrc@hikvision.comExploitedCritical 9.8
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
- Product
- Security cameras web server
- On CISA’s list since
- Jan 10, 2022 (federal fix deadline Jan 24, 2022)
- What to do
- Attackers are using this now. Install Hikvision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Sep 15, 2021Dahua IP Camera Authentication Bypass VulnerabilityCVE-2021-33045 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comExploitedCritical 9.8
Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.
- Product
- IP Camera Firmware
- On CISA’s list since
- Aug 21, 2024 (federal fix deadline Sep 11, 2024)
- What to do
- Attackers are using this now. Install Dahua’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comseclists.org
Sep 15, 2021Dahua IP Camera Authentication Bypass VulnerabilityCVE-2021-33044 · Network & remote access · Dahua · reported by cybersecurity@dahuatech.comExploitedCritical 9.8
Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.
- Product
- IP Camera Firmware
- On CISA’s list since
- Aug 21, 2024 (federal fix deadline Sep 11, 2024)
- What to do
- Attackers are using this now. Install Dahua’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comseclists.org
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbCVE-2021-33554 · Other software · Geutebrück · reported by info@cert.vde.comHigh 7.2
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
- Product
- E2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govrandorisec.fr
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbCVE-2021-33553 · Other software · Geutebrück · reported by info@cert.vde.comHigh 7.2
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
- Product
- E2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govrandorisec.fr
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbCVE-2021-33552 · Other software · Geutebrück · reported by info@cert.vde.comHigh 7.2
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
- Product
- E2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govrandorisec.fr
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbCVE-2021-33551 · Other software · Geutebrück · reported by info@cert.vde.comHigh 7.2
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
- Product
- E2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govrandorisec.fr
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbCVE-2021-33550 · Other software · Geutebrück · reported by info@cert.vde.comHigh 7.2
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
- Product
- E2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govrandorisec.fr
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, whichCVE-2021-33549 · Other software · Geutebrück · reported by info@cert.vde.comHigh 7.2
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code.
- Product
- E2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comus-cert.cisa.gov
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbCVE-2021-33548 · Other software · Geutebrück · reported by info@cert.vde.comHigh 7.2
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
- Product
- E2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govrandorisec.fr
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the profile parameter whichCVE-2021-33547 · Other software · Geutebrück · reported by info@cert.vde.comHigh 7.2
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the profile parameter which may allow an attacker to remotely execute arbitrary code.
- Product
- E2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govrandorisec.fr
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the name parameter, which mCVE-2021-33546 · Other software · Geutebrück · reported by info@cert.vde.comHigh 7.2
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the name parameter, which may allow an attacker to remotely execute arbitrary code.
- Product
- E2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govrandorisec.fr
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the counter parameter whichCVE-2021-33545 · Other software · Geutebrück · reported by info@cert.vde.comHigh 7.2
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the counter parameter which may allow an attacker to remotely execute arbitrary code.
- Product
- E2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govrandorisec.fr
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbCVE-2021-33544 · Other software · Geutebrück · reported by info@cert.vde.comHigh 7.2
Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
- Product
- E2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govrandorisec.fr
Sep 13, 2021Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authenticatioCVE-2021-33543 · Other software · Geutebrück · reported by info@cert.vde.comCritical 9.8
Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. This can lead to manipulation of the device and denial of service.
- Product
- E2 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govrandorisec.fr
Sep 10, 2021A stack buffer overflow vulnerability has been reported to affect QNAP device running QUSBCam2.CVE-2021-34344 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twCritical 9.8
A stack buffer overflow vulnerability has been reported to affect QNAP device running QUSBCam2. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QUSBCam2: QTS 4.5.4: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 5.0: QUSBCam2 2.0.1 ( 2021/08/03 ) and later QTS 4.3.6: QUSBCam2 1.1.4 ( 2021/07/30 ) and later QTS 4.3.3: QUSBCam2 1.1.4 ( 2021/08/06 ) and later QuTS hero 4.5.3: QUSBCam2 1.1.4 ( 2021/07/30 ) and later
- Product
- QUSBCam2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2021A memory corruption issue was addressed with improved state management.CVE-2021-30675 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A memory corruption issue was addressed with improved state management. This issue is fixed in Boot Camp 6.1.14. A malicious application may be able to elevate privileges.
- Product
- Boot Camp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Aug 30, 2021Stack-based Buffer Overflow vulnerability in the ONVIF server component of Victure PC420 smart camera allows an attacker to execute remote code on the target deCVE-2020-15744 · Other software · Victure · reported by cve-requests@bitdefender.comCritical 9.6
Stack-based Buffer Overflow vulnerability in the ONVIF server component of Victure PC420 smart camera allows an attacker to execute remote code on the target device. This issue affects: Victure PC420 firmware version 1.2.2 and prior versions.
- Product
- PC420
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Aug 18, 2021A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for the Cisco Video Surveillance 7000 Series IP Cameras firmware could allow an unautCVE-2021-34734 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.5
A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for the Cisco Video Surveillance 7000 Series IP Cameras firmware could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper management of memory resources, referred to as a double free. An attacker could exploit this vulnerability by sending crafted LLDP packets to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Note: LLDP is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).
- Product
- Cisco Video Surveillance 7000 Series IP Cameras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Aug 17, 2021A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration.CVE-2021-3617 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.2
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. This vulnerability is the same as CNVD-2020-68652.
- Product
- Smart Camera X3, X5, and C2E firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiknow.lenovo.com.cncnvd.org.cn
Aug 17, 2021A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content andCVE-2021-3616 · Other software · Lenovo · reported by psirt@lenovo.comCritical 9.4
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content and device configuration. This vulnerability is the same as CNVD-2020-68651.
- Product
- Smart Camera X3, X5, and C2E firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiknow.lenovo.com.cncnvd.org.cn
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.