Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,429 results · page 27 of 49
Feb 24, 2022Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removiCVE-2022-24610 · Other software · Alecto · reported by MITREHigh 8.6
Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal network connected to the camera.
- Product
- Dvc-215ip Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.alecto.nlsupport.alecto.nl
Feb 18, 2022A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload functCVE-2021-45401 · Network & remote access · Tendacn · reported by MITRECritical 9.8
A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function.
- Product
- Ac10u Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbCVE-2022-0162 · Network & remote access · TP-Link · reported by vdisclose@cert-in.org.inHigh 8.4
The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbase64 format. Successful exploitation of this vulnerability could allow a remote attacker to intercept credentials and subsequently perform administrative operations on the affected device through web-based management interface.
- Product
- TL-WR841N
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert-in.org.incert-in.org.in
Feb 9, 2022Improper input validation in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticaCVE-2021-33155 · Other software · Intel · reported by secure@intel.comMedium 5.7
Improper input validation in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.
- Product
- Ax211 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticaCVE-2021-33139 · Other software · Intel · reported by secure@intel.comMedium 5.7
Improper conditions check in firmware for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products before version 22.100 may allow an authenticated user to potentially enable denial of service via adjacent access.
- Product
- Ax211 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation for some Intel(R) PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of privilege via adjCVE-2021-33115 · Other software · Intel · reported by secure@intel.comHigh 8.8
Improper input validation for some Intel(R) PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- Uefi Wifi Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an authenticatCVE-2021-33114 · Other software · Intel · reported by secure@intel.comMedium 5.7
Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an authenticated user to potentially enable denial of service via adjacent access.
- Product
- AC 3165 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an unauthenticCVE-2021-33113 · Other software · Intel · reported by secure@intel.comHigh 8.1
Improper input validation for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and Killer(TM) WiFi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service or information disclosure via adjacent access.
- Product
- AC 3165 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation for some Intel(R) Wireless Bluetooth(R) products and Killer(TM) Bluetooth(R) products in Windows 10 and 11 before version 22.80 may alCVE-2021-33110 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper input validation for some Intel(R) Wireless Bluetooth(R) products and Killer(TM) Bluetooth(R) products in Windows 10 and 11 before version 22.80 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AC 1550 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Specified Index, Position, or Offset in Input in software for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some CVE-2021-0183 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Validation of Specified Index, Position, or Offset in Input in software for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Use of Validation Framework in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user CVE-2021-0179 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Use of Validation Framework in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentiaCVE-2021-0178 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper input validation in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Consistency within input in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthentiCVE-2021-0177 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Validation of Consistency within input in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may aCVE-2021-0176 · Other software · Intel · reported by secure@intel.comMedium 4.4
Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable denial of service via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Specified Index, Position, or Offset in Input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some CVE-2021-0175 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Validation of Specified Index, Position, or Offset in Input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Use of Validation Framework in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 aCVE-2021-0174 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Use of Validation Framework in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Consistency within input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in WCVE-2021-0173 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper Validation of Consistency within input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may aCVE-2021-0172 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper access control in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an authenticated user to potentially CVE-2021-0171 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper access control in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM)CVE-2021-0170 · Other software · Intel · reported by secure@intel.comMedium 5.5
Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow an authenticated user to potentially enable information disclosure via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Uncontrolled Search Path Element in software for Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalatioCVE-2021-0169 · Other software · Intel · reported by secure@intel.comMedium 6.7
Uncontrolled Search Path Element in software for Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may aCVE-2021-0168 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper access control in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enabCVE-2021-0167 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper access control in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM)CVE-2021-0166 · Other software · Intel · reported by secure@intel.comMedium 6.7
Exposure of Sensitive Information to an Unauthorized Actor in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unCVE-2021-0165 · Other software · Intel · reported by secure@intel.comMedium 6.5
Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper access control in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauCVE-2021-0164 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper access control in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Consistency within input in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthentiCVE-2021-0163 · Other software · Intel · reported by secure@intel.comHigh 8.8
Improper Validation of Consistency within input in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentiaCVE-2021-0162 · Other software · Intel · reported by secure@intel.comHigh 8.8
Improper input validation in software for Intel(R) PROSet/Wireless Wi-Fi and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow a priCVE-2021-0161 · Other software · Intel · reported by secure@intel.comMedium 6.7
Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper Validation of Specified Index, Position, or Offset in Input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some CVE-2021-0076 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper Validation of Specified Index, Position, or Offset in Input in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable denial of service via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may aCVE-2021-0072 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper input validation in firmware for some Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and some Killer(TM) Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable information disclosure via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unCVE-2021-0066 · Other software · Intel · reported by secure@intel.comHigh 8.4
Improper input validation in firmware for Intel(R) PROSet/Wireless Wi-Fi in multiple operating systems and Killer(TM) Wi-Fi in Windows 10 and 11 may allow an unauthenticated user to potentially enable escalation of privilege via local access.
- Product
- AMT AC 8260 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows version(s): Prior to 1.44.0.0, 10.96.0.0CVE-2021-29218 · Other software · HPE · reported by security-alert@hpe.comMedium 6.7
A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows version(s): Prior to 1.44.0.0, 10.96.0.0. This vulnerability could be exploited locally by a user with high privileges to execute malware that may lead to a loss of confidentiality, integrity, and availability. HPE has provided software updates to resolve the vulnerability in HPE Agentless Management Service for Windows.
- Product
- Agentless Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hpe.comsupport.hpe.com
Feb 4, 2022The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairinCVE-2018-25029 · Other software · Silicon Labs · reported by cret@cert.orgHigh 8.1
The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairing to downgrade and then exploit a different vulnerability (CVE-2013-20003) to intercept and spoof traffic.
- Product
- Z-Wave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.silabs.compentestpartners.com
Feb 3, 2022Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetWirelessRepeat.CVE-2022-24149 · Network & remote access · Tenda · reported by MITREHigh 7.5
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetWirelessRepeat. This vulnerability allows attackers to cause a Denial of Service (DoS) via the wpapsk_crypto parameter.
- Product
- Ax3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022gh-ost is a triggerless online schema migration solution for MySQL.CVE-2022-21687 · Other software · Github · reported by GitHubMedium 6.8
gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker must have access to the target host or trick an administrator into executing a malicious gh-ost command on a host running gh-ost, plus network access from host running gh-ost to the attack's malicious MySQL server. The `-database` parameter does not properly sanitize user input which can lead to arbitrary file reads.
- Product
- Gh-ost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere witCVE-2022-23126 · Other software · Teslamate · reported by MITRECritical 9.8
TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls.
- Product
- Teslamate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2022In libming 0.4.8, the parseSWF_DEFINELOSSLESS2 function in util/parser.c lacks a boundary check that would lead to denial-of-service attacks via a crafted SWF fCVE-2021-44591 · Other software · Libming · reported by MITREMedium 6.5
In libming 0.4.8, the parseSWF_DEFINELOSSLESS2 function in util/parser.c lacks a boundary check that would lead to denial-of-service attacks via a crafted SWF file.
- Product
- Libming
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2021Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authentiCVE-2021-20134 · Other software · Dlink · reported by vulnreport@tenable.comHigh 8.4
Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set an arbitrary file on the router's filesystem as the log file used by either Quagga service (zebra or ripd). Subsequent log messages will be appended to the file, prefixed by a timestamp and some logging metadata. Remote code execution can be achieved by using this vulnerability to append to a shell script on the router's filesystem, and then awaiting or triggering the execution of that script. A remote, unauthenticated root shell can easily be obtained on the device in this fashion.
- Product
- Dir-2640-us Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 30, 2021Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authentiCVE-2021-20133 · Other software · Dlink · reported by vulnreport@tenable.comMedium 6.1
Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set the "message of the day" banner to any file on the system, allowing them to read all or some of the contents of those files. Such sensitive information as hashed credentials, hardcoded plaintext passwords for other services, configuration files, and private keys can be disclosed in this fashion. Improper handling of filenames that identify virtual resources, such as "/dev/urandom" allows an attacker to effect a denial of service attack against the command line interfaces of the Quagga services (zebra and ripd).
- Product
- Dir-2640-us Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 30, 2021Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrCVE-2021-20132 · Other software · Dlink · reported by vulnreport@tenable.comHigh 8.8
Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router (i.e., as the "admin" user, UID 0).
- Product
- Dir-2640-us Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 22, 2021An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4.CVE-2021-21881 · Other software · Lantronix · reported by talos-cna@cisco.comCritical 9.9
An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
- Product
- Premierwave 2050 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Dec 20, 2021OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root acceCVE-2020-8105 · Other software · Abode · reported by cve-requests@bitdefender.comCritical 9.6
OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attacker to inject commands and gain root access. This issue affects: Abode iota All-In-One Security Kit versions prior to 1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE oz.
- Product
- iota All-In-One Security Kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Dec 15, 2021Microsoft 4K Wireless Display Adapter Remote Code Execution VulnerabilityCVE-2021-43899 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability
- Product
- Microsoft 4K Wireless Display Adapter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 9, 2021An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php.CVE-2021-43703 · Other software · Zzcms · reported by MITRECritical 9.8
An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2021Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Insulet manufactured PeCVE-2020-10627 · Other software · Insulet · reported by ics-cert@hq.dhs.govHigh 7.3
Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Insulet manufactured Personal Diabetes Manager device. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with access to one of the affected insulin pump models may be able to modify and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
- Product
- Omnipod Insulin Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govmyomnipod.com
Nov 23, 2021Video Lessons Manager: And Video Lessons Manager Pro WordPress plugin before 3CVE-2021-24713 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Video Lessons Manager WordPress plugin before 1.7.2 and Video Lessons Manager Pro WordPress plugin before 3.5.9 do not properly sanitize and escape values when updating their settings, which could allow high privilege users to perform Cross-Site Scripting attacks
- Product
- Video Lessons Manager
- Fixed in
- 1.7.2
- What to do
- Update Video Lessons Manager to 1.7.2 or newer.
Nov 17, 2021Improper verification of cryptographic signature in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products in Windows 10 mayCVE-2021-0152 · Other software · Intel · reported by secure@intel.comMedium 5.5
Improper verification of cryptographic signature in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products in Windows 10 may allow an authenticated user to potentially enable denial of service via local access.
- Product
- Ax210 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Improper access control in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products in Windows 10 may allow an authenticated uCVE-2021-0151 · Other software · Intel · reported by secure@intel.comHigh 7.8
Improper access control in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products in Windows 10 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Ax210 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 17, 2021Uncontrolled search path in software installer for Intel(R) PROSet/Wireless WiFi in Windows 10 may allow an authenticated user to potentially enable escalation CVE-2021-0082 · Other software · Intel · reported by secure@intel.comHigh 7.8
Uncontrolled search path in software installer for Intel(R) PROSet/Wireless WiFi in Windows 10 may allow an authenticated user to potentially enable escalation of privilege via local access.
- Product
- Ax210 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.