Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

456new WordPress flaws this week

390,714entries in the database

233 results · page 3 of 5

Jul 14, 2021Windows TCP/IP Driver Denial of Service VulnerabilityCVE-2021-31183 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows TCP/IP Driver Denial of Service Vulnerability
Product
Windows 10 Version 1507
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com portal.msrc.microsoft.com
Jun 8, 2021Windows TCP/IP Driver Security Feature Bypass VulnerabilityCVE-2021-31970 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Windows TCP/IP Driver Security Feature Bypass Vulnerability
Product
Windows 10 Version 1809
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com portal.msrc.microsoft.com
Jun 4, 2021An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privilegeCVE-2021-31251 · Other software · Chiyu-tech · reported by MITRECritical 9.8
An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileged connection with the target device by supplying a specially malformed request and an attacker may force the remote telnet server to believe that the user has already authenticated.
Product
Bf-430 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitbook.seguranca-informatica.pt seguranca-informatica.pt
Jun 4, 2021Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitizatCVE-2021-31250 · Other software · Chiyu-tech · reported by MITREMedium 5.4
Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi.
Product
Bf-430 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitbook.seguranca-informatica.pt seguranca-informatica.pt
Jun 4, 2021A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the paCVE-2021-31249 · Other software · Chiyu-tech · reported by MITREMedium 6.5
A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components.
Product
Bf-430 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gitbook.seguranca-informatica.pt seguranca-informatica.pt
Apr 13, 2021Windows TCP/IP Information Disclosure VulnerabilityCVE-2021-28442 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Windows TCP/IP Information Disclosure Vulnerability
Product
Windows 10 Version 1803
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Apr 13, 2021Windows TCP/IP Driver Denial of Service VulnerabilityCVE-2021-28439 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows TCP/IP Driver Denial of Service Vulnerability
Product
Windows 10 Version 1803
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Apr 13, 2021Windows TCP/IP Driver Denial of Service VulnerabilityCVE-2021-28319 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows TCP/IP Driver Denial of Service Vulnerability
Product
Windows 10 Version 1803
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Feb 25, 2021Windows TCP/IP Remote Code Execution VulnerabilityCVE-2021-24094 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows TCP/IP Remote Code Execution Vulnerability
Product
Windows 10 Version 1803
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Feb 25, 2021Windows TCP/IP Denial of Service VulnerabilityCVE-2021-24086 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Windows TCP/IP Denial of Service Vulnerability
Product
Windows 10 Version 1803
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com portal.msrc.microsoft.com
Feb 25, 2021Windows TCP/IP Remote Code Execution VulnerabilityCVE-2021-24074 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.8
Windows TCP/IP Remote Code Execution Vulnerability
Product
Windows 10 Version 1803
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Dec 22, 2020A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denial of service (crash/reset) or to possiblCVE-2020-25066 · Other software · Treck · reported by MITRECritical 10
A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denial of service (crash/reset) or to possibly execute arbitrary code.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.netapp.com treck.com
Nov 5, 2020Resource management error vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" CVE-2020-5649 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Resource management error vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
Product
GT14 Model of GOT 1000 series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp us-cert.cisa.gov
Nov 5, 2020Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of GOCVE-2020-5648 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpCritical 9.8
Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.
Product
GT14 Model of GOT 1000 series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp us-cert.cisa.gov
Nov 5, 2020Improper access control vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ anCVE-2020-5647 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpCritical 9.8
Improper access control vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Product
GT14 Model of GOT 1000 series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp us-cert.cisa.gov
Nov 5, 2020NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" CVE-2020-5646 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.5
NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
Product
GT14 Model of GOT 1000 series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp us-cert.cisa.gov
Nov 5, 2020Session fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earliCVE-2020-5645 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Session fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
Product
GT14 Model of GOT 1000 series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp us-cert.cisa.gov
Nov 5, 2020Buffer overflow vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlieCVE-2020-5644 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpCritical 9.8
Buffer overflow vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Product
GT14 Model of GOT 1000 series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp us-cert.cisa.gov
Nov 2, 2020Resource Management Errors vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module FirstCVE-2020-5658 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Resource Management Errors vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
Product
MELSEC iQ-R series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.co.jp
Nov 2, 2020Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R seriCVE-2020-5657 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpMedium 6.5
Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.
Product
MELSEC iQ-R series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.co.jp
Nov 2, 2020Improper access control vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 CVE-2020-5656 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpCritical 9.8
Improper access control vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Product
MELSEC iQ-R series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.co.jp
Nov 2, 2020NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First CVE-2020-5655 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.5
NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
Product
MELSEC iQ-R series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.co.jp
Nov 2, 2020Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits CVE-2020-5654 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.5
Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.
Product
MELSEC iQ-R series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.co.jp
Nov 2, 2020Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits oCVE-2020-5653 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpCritical 9.8
Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Product
MELSEC iQ-R series
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.co.jp
Oct 16, 2020A denial of service vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets.CVE-2020-16899 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
A denial of service vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could cause a target system to stop responding. To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer. The vulnerability would not allow an attacker to execute code or to elevate user rights directly. The update addresses the vulnerability by correcting how the Windows TCP/IP stack handles ICMPv6 Router Advertisement packets.
Product
Windows 10 Version 1803
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Oct 16, 2020A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets.CVE-2020-16898 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client. To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer. The update addresses the vulnerability by correcting how the Windows TCP/IP stack handles ICMPv6 Router Advertisement packets.
Product
Windows 10 Version 1803
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Jul 7, 2020A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP.CVE-2020-10745 · Other software · Samba · reported by Red HatHigh 7.5
A flaw was found in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4 in the way it processed NetBios over TCP/IP. This flaw allows a remote attacker could to cause the Samba server to consume excessive CPU use, resulting in a denial of service. This highest threat from this vulnerability is to system availability.
Product
Samba
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jul 7, 2020TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23CVE-2020-5600 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.5
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains a resource management error vulnerability, which may allow a remote attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Product
GOT2000 series GT27, GT25, and GT23
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.com
Jul 7, 2020TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23CVE-2020-5599 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpCritical 9.8
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains an improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability, which may allow a remote attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Product
GOT2000 series GT27, GT25, and GT23
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.com
Jul 7, 2020TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23CVE-2020-5598 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.5
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains an improper access control vulnerability, which may which may allow a remote attacker tobypass access restriction and stop the network functions of the products or execute a malicious program via a specially crafted packet.
Product
GOT2000 series GT27, GT25, and GT23
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.com
Jul 7, 2020TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23CVE-2020-5597 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.5
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains a null pointer dereference vulnerability, which may allow a remote attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Product
GOT2000 series GT27, GT25, and GT23
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.com
Jul 7, 2020TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23CVE-2020-5596 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpHigh 7.5
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) does not properly manage sessions, which may allow a remote attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Product
GOT2000 series GT27, GT25, and GT23
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.com
Jul 7, 2020TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23CVE-2020-5595 · Other software · Mitsubishi Electric Corporation · reported by vultures@jpcert.or.jpCritical 9.8
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains a buffer overflow vulnerability, which may allow a remote attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Product
GOT2000 series GT27, GT25, and GT23
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.CVE-2020-11914 · Other software · Treck · reported by MITREMedium 4.3
The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.CVE-2020-11913 · Other software · Treck · reported by MITREMedium 5.3
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.CVE-2020-11912 · Other software · Treck · reported by MITREMedium 5.3
The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.CVE-2020-11911 · Other software · Treck · reported by MITREMedium 5.3
The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.CVE-2020-11910 · Other software · Treck · reported by MITREMedium 5.3
The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow.CVE-2020-11909 · Other software · Treck · reported by MITREMedium 5.3
The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 4.7.1.27 mishandles '\0' termination in DHCP.CVE-2020-11908 · Other software · Treck · reported by MITREMedium 4.3
The Treck TCP/IP stack before 4.7.1.27 mishandles '\0' termination in DHCP.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP.CVE-2020-11907 · Other software · Treck · reported by MITREMedium 6.3
The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow.CVE-2020-11906 · Other software · Treck · reported by MITREMedium 6.3
The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.CVE-2020-11905 · Other software · Treck · reported by MITREMedium 6.5
The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write.CVE-2020-11904 · Other software · Treck · reported by MITREHigh 7.3
The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.CVE-2020-11903 · Other software · Treck · reported by MITREMedium 6.5
The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.CVE-2020-11902 · Other software · Treck · reported by MITREHigh 7.3
The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.CVE-2020-11901 · Other software · Treck · reported by MITRECritical 9
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free.CVE-2020-11900 · Other software · Treck · reported by MITREHigh 8.2
The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com
Jun 17, 2020Treck TCP/IP stack Out-of-Bounds Read VulnerabilityCVE-2020-11899 · Other software · Treck TCP/IP stack · reported by MITREExploitedMedium 5.4
The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability.
Product
IPv6
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Treck TCP/IP stack’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arubanetworks.com cwe.mitre.org
Jun 17, 2020The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an informCVE-2020-11898 · Other software · Treck · reported by MITRECritical 9.1
The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an information leak.
Product
Tcp/ip
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record arubanetworks.com jsof-tech.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.