Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
519 results · page 3 of 11
May 13, 2022A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated attacker with physicalCVE-2022-29854 · Email & office · Mitel · reported by MITREMedium 6.8
A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.
- Product
- Minet Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Apr 27, 2022An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos AuthenticatorCVE-2021-25266 · Network & remote access · Sophos · reported by security-alert@sophos.comLow 3.9
An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495.
- Product
- Intercept X for Mobile (Android)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of parameter verificationCVE-2020-14122 · Other software · MI · reported by security@xiaomi.comMedium 5.5
Some Xiaomi phones have information leakage vulnerabilities, and some of them may be able to forge a specific identity due to the lack of parameter verification, resulting in user information leakage.
- Product
- Miui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrust.mi.comtrust.mi.com
Feb 25, 2022There is a DoS vulnerability in smartphones.CVE-2021-37027 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Feb 25, 2022There is a DoS vulnerability in smartphones.CVE-2021-22489 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service availability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 25, 2022There is an improper verification vulnerability in smartphones.CVE-2021-22448 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
There is an improper verification vulnerability in smartphones. Successful exploitation of this vulnerability may cause unauthorized read and write of some files.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Feb 25, 2022There is a software integer overflow leading to a TOCTOU condition in smartphones.CVE-2021-22437 · Other software · Huawei · reported by psirt@huawei.comHigh 7
There is a software integer overflow leading to a TOCTOU condition in smartphones. Successful exploitation of this vulnerability may cause random address access.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Feb 25, 2022There is a memory address out of bounds vulnerability in smartphones.CVE-2021-22434 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
There is a memory address out of bounds vulnerability in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 25, 2022There is a memory address out of bounds in smartphones.CVE-2021-22433 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 25, 2022There is a vulnerability when configuring permission isolation in smartphones.CVE-2021-22432 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
There is a vulnerability when configuring permission isolation in smartphones. Successful exploitation of this vulnerability may cause out-of-bounds access.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 25, 2022There is a vulnerability when configuring permission isolation in smartphones.CVE-2021-22431 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
There is a vulnerability when configuring permission isolation in smartphones. Successful exploitation of this vulnerability may cause out-of-bounds access.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 25, 2022There is a logic bypass vulnerability in smartphones.CVE-2021-22430 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
There is a logic bypass vulnerability in smartphones. Successful exploitation of this vulnerability may cause code injection.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 25, 2022There is a memory address out of bounds in smartphones.CVE-2021-22429 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 25, 2022There is a memory address out of bounds in smartphones.CVE-2021-22426 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 25, 2022There is a code injection vulnerability in smartphones.CVE-2021-22395 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a code injection vulnerability in smartphones. Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 25, 2022There is a buffer overflow vulnerability in smartphones.CVE-2021-22394 · Other software · Huawei · reported by psirt@huawei.comCritical 9.1
There is a buffer overflow vulnerability in smartphones. Successful exploitation of this vulnerability may cause DoS of the apps during Multi-Screen Collaboration.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Feb 25, 2022There is an improper verification vulnerability in smartphones.CVE-2021-22319 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an improper verification vulnerability in smartphones. Successful exploitation of this vulnerability may cause integer overflows.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 10, 2022There is a Null pointer dereference vulnerability in the camera module in smartphones.CVE-2021-40039 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Null pointer dereference vulnerability in the camera module in smartphones. Successful exploitation of this vulnerability may affect service integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 10, 2022There is a Double free vulnerability in the AOD module in smartphones.CVE-2021-40038 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Double free vulnerability in the AOD module in smartphones. Successful exploitation of this vulnerability may affect service integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 10, 2022There is a Vulnerability of accessing resources using an incompatible type (type confusion) in the MPTCP subsystem in smartphones.CVE-2021-40037 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
There is a Vulnerability of accessing resources using an incompatible type (type confusion) in the MPTCP subsystem in smartphones. Successful exploitation of this vulnerability may cause the system to crash and restart.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 10, 2022There is a Buffer overflow vulnerability due to a boundary error with the Samba server in the file management module in smartphones.CVE-2021-40035 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Buffer overflow vulnerability due to a boundary error with the Samba server in the file management module in smartphones. Successful exploitation of this vulnerability may affect function stability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 10, 2022There is a Null pointer dereference vulnerability in the camera module in smartphones.CVE-2021-40031 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Null pointer dereference vulnerability in the camera module in smartphones. Successful exploitation of this vulnerability may affect service integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jan 10, 2022There is a Buffer overflow vulnerability due to a boundary error with the Samba server in the file management module in smartphones.CVE-2021-40029 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Buffer overflow vulnerability due to a boundary error with the Samba server in the file management module in smartphones. Successful exploitation of this vulnerability may affect function stability.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 10, 2022There is a Heap-based buffer overflow vulnerability in the AOD module in smartphones.CVE-2021-40026 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Heap-based buffer overflow vulnerability in the AOD module in smartphones. Successful exploitation of this vulnerability may affect service integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 10, 2022There is an Out-of-bounds array read vulnerability in the security storage module in smartphones.CVE-2021-40020 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an Out-of-bounds array read vulnerability in the security storage module in smartphones. Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jan 10, 2022There is an Out-of-bounds write vulnerability in the AOD module in smartphones.CVE-2021-40009 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
There is an Out-of-bounds write vulnerability in the AOD module in smartphones. Successful exploitation of this vulnerability may affect service integrity.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 10, 2022There is Vulnerability of APIs being concurrently called for multiple times in HwConnectivityExService a in smartphones.CVE-2021-39998 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is Vulnerability of APIs being concurrently called for multiple times in HwConnectivityExService a in smartphones. Successful exploitation of this vulnerability may cause the system to crash and restart.
- Product
- Harmonyos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 10, 2022There is a Heap-based buffer overflow vulnerability with the NFC module in smartphones.CVE-2021-39996 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
There is a Heap-based buffer overflow vulnerability with the NFC module in smartphones. Successful exploitation of this vulnerability may cause memory overflow.
- Product
- Harmonyos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 10, 2022There is an Integer overflow vulnerability with ACPU in smartphones.CVE-2021-39993 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
There is an Integer overflow vulnerability with ACPU in smartphones. Successful exploitation of this vulnerability may cause out-of-bounds access.
- Product
- Emui
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Jan 3, 2022There is an Out-of-bounds read in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.CVE-2021-39974 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an Out-of-bounds read in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 3, 2022There is a Null pointer dereference in Smartphones.Successful exploitation of this vulnerability may cause the kernel to break down.CVE-2021-39973 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Null pointer dereference in Smartphones.Successful exploitation of this vulnerability may cause the kernel to break down.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 3, 2022There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.CVE-2021-39969 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 3, 2022There is a Vulnerability of obtaining broadcast information improperly due to improper broadcast permission settings in Smartphones.Successful exploitation of tCVE-2021-39967 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a Vulnerability of obtaining broadcast information improperly due to improper broadcast permission settings in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 3, 2022There is an Uninitialized AOD driver structure in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.CVE-2021-39966 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an Uninitialized AOD driver structure in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Jan 3, 2022There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.CVE-2021-37133 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is an Unauthorized file access vulnerability in Smartphones.Successful exploitation of this vulnerability may affect service confidentiality.
- Product
- EMUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 15, 2021In getDeviceId of PhoneSubInfoController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel CVE-2021-0990 · Computers, phones & browsers · Google · reported by security@android.comLow 3.3
In getDeviceId of PhoneSubInfoController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-185591180
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 6, 2021A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system.CVE-2021-34711 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.5
A vulnerability in the debug shell of Cisco IP Phone software could allow an authenticated, local attacker to read any file on the device file system. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by providing crafted input to a debug shell command. A successful exploit could allow the attacker to read any file on the device file system.
- Product
- Cisco IP Phones with Multiplatform Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Aug 3, 2021Some Huawei Smartphones has an insufficient input validation vulnerability due to the lack of parameter validation.CVE-2021-22400 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
Some Huawei Smartphones has an insufficient input validation vulnerability due to the lack of parameter validation. An attacker may trick a user into installing a malicious APP. The app can modify specific parameters, causing the system to crash. Affected product include:OxfordS-AN00A 10.0.1.10(C00E10R1P1),10.0.1.105(C00E103R3P3),10.0.1.115(C00E110R3P3),10.0.1.123(C00E121R3P3),10.0.1.135(C00E130R3P3),10.0.1.135(C00E130R4P1),10.0.1.152(C00E140R4P1),10.0.1.160(C00E160R4P1),10.0.1.167(C00E166R4P1),10.0.1.173(C00E172R5P1),10.0.1.178(C00E175R5P1) and 10.1.0.202(C00E79R5P1).
- Product
- Oxfords-an00a Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2021There is a logic error vulnerability in several smartphones.CVE-2021-22398 · Other software · Huawei · reported by psirt@huawei.comMedium 4.6
There is a logic error vulnerability in several smartphones. The software does not properly restrict certain operation when the Digital Balance function is on. Successful exploit could allow the attacker to bypass the Digital Balance limit after a series of operations. Affected product versions include: Hulk-AL00C 9.1.1.201(C00E201R8P1);Jennifer-AN00C 10.1.1.171(C00E170R6P3);Jenny-AL10B 10.1.0.228(C00E220R5P1) and OxfordPL-AN10B 10.1.0.116(C00E110R2P1).
- Product
- Hulk-al00c Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2021The Bluetooth function of some Huawei smartphones has a DoS vulnerability.CVE-2021-22399 · Other software · Huawei · reported by psirt@huawei.comMedium 5.5
The Bluetooth function of some Huawei smartphones has a DoS vulnerability. Attackers can install third-party apps to send specific broadcasts, causing the Bluetooth module to crash. This vulnerability is successfully exploited to cause the Bluetooth function to become abnormal. Affected product versions include: HUAWEI P30 10.0.0.195(C432E22R2P5), 10.0.0.200(C00E85R2P11), 10.0.0.200(C461E6R3P1), 10.0.0.201(C10E7R5P1), 10.0.0.201(C185E4R7P1), 10.0.0.206(C605E19R1P3), 10.0.0.209(C636E6R3P4), 10.0.0.210(C635E3R2P4), and versions earlier than 10.1.0.165(C01E165R2P11).
- Product
- P30 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2021There is a JavaScript injection vulnerability in certain Huawei smartphones.CVE-2021-22331 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a JavaScript injection vulnerability in certain Huawei smartphones. A module does not verify some inputs sufficiently. Attackers can exploit this vulnerability by sending a malicious application request to launch JavaScript injection. This may compromise normal service. Affected product versions include HUAWEI P30 versions earlier than 10.1.0.165(C01E165R2P11), 11.0.0.118(C635E2R1P3), 11.0.0.120(C00E120R2P5), 11.0.0.138(C10E4R5P3), 11.0.0.138(C185E4R7P3), 11.0.0.138(C432E8R2P3), 11.0.0.138(C461E4R3P3), 11.0.0.138(C605E4R1P3), and 11.0.0.138(C636E4R3P3).
- Product
- P30 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2021The PowerVR GPU kernel driver in pvrsrvkm.ko through 2021-04-24 for the Linux kernel, as used on Alcatel 1S phones, allows attackers to overwrite heap memory viCVE-2021-31795 · Other software · Pvrsrvkm.ko Project · reported by MITREHigh 7
The PowerVR GPU kernel driver in pvrsrvkm.ko through 2021-04-24 for the Linux kernel, as used on Alcatel 1S phones, allows attackers to overwrite heap memory via PhysmemNewRamBackedPMR.
- Product
- Pvrsrvkm.ko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmcyoloswagham.github.iomcyoloswagham.github.io
Dec 29, 2020There is a denial of service vulnerability in some Huawei smartphones.CVE-2020-9223 · Other software · Huawei · reported by psirt@huawei.comHigh 7.5
There is a denial of service vulnerability in some Huawei smartphones. Due to the improper processing of received abnormal messages, remote attackers may exploit this vulnerability to cause a denial of service (DoS) on the specific module.
- Product
- Honor 20 Pro Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2020On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) device to pair silently wCVE-2020-35693 · Computers, phones & browsers · Google · reported by MITREHigh 8.8
On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) device to pair silently with a vulnerable target device, without any user interaction, when the target device's Bluetooth is on, and it is running an app that offers a connectable BLE advertisement. An example of such an app could be a Bluetooth-based contact tracing app, such as Australia's COVIDSafe app, Singapore's TraceTogether app, or France's TousAntiCovid (formerly StopCovid). As part of the pairing process, two pieces (among others) of personally identifiable information are exchanged: the Identity Address of the Bluetooth adapter of the target device, and its associated Identity Resolving Key (IRK). Either one of these identifiers can be used to perform re-identification of the target device for long term tracking. The list of affected devices includes (but is not limited to): Galaxy Note 5, Galaxy S6 Edge, Galaxy A3, Tab A (2017), J2 Pro (2018), Galaxy Note 4, and Galaxy S5.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2020There is a privilege escalation vulnerability on some Huawei smart phones due to design defects.CVE-2020-9119 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
There is a privilege escalation vulnerability on some Huawei smart phones due to design defects. The attacker needs to physically contact the mobile phone and obtain higher privileges, and execute relevant commands, resulting in the user's privilege promotion.
- Product
- Mate 10 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The Bluetooth handset of Mitel MiVoice 6940 and 6930 MiNet phones with firmware before 1.5.3 could allow an unauthenticated attacker within Bluetooth range to pCVE-2020-27640 · Email & office · Mitel · reported by MITREHigh 8.1
The Bluetooth handset of Mitel MiVoice 6940 and 6930 MiNet phones with firmware before 1.5.3 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth device when a phone handset loses connection, due to an improper pairing mechanism. A successful exploit could allow an attacker to eavesdrop on conversations.
- Product
- Mivoice 6940 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2020The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth CVE-2020-27639 · Email & office · Mitel · reported by MITREHigh 8.1
The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth device when a phone handset loses connection, due to an improper pairing mechanism. A successful exploit could allow an attacker to eavesdrop on conversations.
- Product
- 6873i SIP Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2020A vulnerability in the TCP packet processing functionality of Cisco IP Phones could allow an unauthenticated, remote attacker to cause the phone to stop respondCVE-2020-3574 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
A vulnerability in the TCP packet processing functionality of Cisco IP Phones could allow an unauthenticated, remote attacker to cause the phone to stop responding to incoming calls, drop connected calls, or unexpectedly reload. The vulnerability is due to insufficient TCP ingress packet rate limiting. An attacker could exploit this vulnerability by sending a high and sustained rate of crafted TCP traffic to the targeted device. A successful exploit could allow the attacker to impact operations of the phone or cause the phone to reload, leading to a denial of service (DoS) condition.
- Product
- Cisco IP Phones with Multiplatform Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Oct 12, 2020There is an information disclosure vulnerability in several smartphones.CVE-2020-9109 · Other software · Huawei · reported by psirt@huawei.comMedium 4.6
There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, and successful exploit could cause information disclosure.Affected product versions include:HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI Mate 20 X versions earlier than 10.1.0.160(C00E160R2P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8);Laya-AL00EP versions earlier than 10.1.0.160(C786E160R3P8);Tony-AL00B versions earlier than 10.1.0.160(C00E160R2P11);Tony-TL00B versions earlier than 10.1.0.160(C01E160R2P11).
- Product
- Mate 20 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2020A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device.CVE-2019-15959 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 6.6
A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit this vulnerability by accessing the physical interface of a device and inserting a USB storage device. A successful exploit could allow the attacker to execute scripts on the device in an elevated security context.
- Product
- Cisco SPA525G2 5-line IP Phone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comtools.cisco.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.