Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,964 results · page 369 of 780
Dec 7, 2023Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode.CVE-2023-49411 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX3 V16.03.12.11 was discovered to contain a Command Execution vulnerability via the function /goform/telnet.CVE-2023-49409 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX3 V16.03.12.11 was discovered to contain a Command Execution vulnerability via the function /goform/telnet.
- Product
- Ax3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the function set_device_name.CVE-2023-49408 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the function set_device_name.
- Product
- Ax3 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet.CVE-2023-49406 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function UploadCfg.CVE-2023-49405 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function UploadCfg.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formAdvancedSetListSet.CVE-2023-49404 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formAdvancedSetListSet.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions VulnerabilityCVE-2023-40302 · Other software · Netscout · reported by MITRECritical 9.1
NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability
- Product
- Ngeniuspulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Dec 7, 2023NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability.CVE-2023-40301 · Other software · Netscout · reported by MITRECritical 9.8
NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability.
- Product
- Ngeniuspulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Dec 7, 2023NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.CVE-2023-40300 · Other software · Netscout · reported by MITRECritical 9.8
NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.
- Product
- Ngeniuspulse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetscout.comnetscout.com
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode.CVE-2023-50002 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline.CVE-2023-50001 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode.CVE-2023-50000 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setUmountUSBPartition.CVE-2023-49999 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setUmountUSBPartition.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function via the function set_wan_status.CVE-2023-49410 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function via the function set_wan_status.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setFixTools.CVE-2023-49403 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setFixTools.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function localMsg.CVE-2023-49402 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function localMsg.
- Product
- W30e Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.CVE-2023-49436 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.
- Product
- Ax9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX9 V22.03.01.46 is vulnerable to command injection.CVE-2023-49435 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX9 V22.03.01.46 is vulnerable to command injection.
- Product
- Ax9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetNetControlList.CVE-2023-49434 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetNetControlList.
- Product
- Ax9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetVirtualServerCfg.CVE-2023-49433 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetVirtualServerCfg.
- Product
- Ax9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'deviceList' parameter at /goform/setMacFilterCfg.CVE-2023-49432 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'deviceList' parameter at /goform/setMacFilterCfg.
- Product
- Ax9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.CVE-2023-49431 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.
- Product
- Ax9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetStaticRouteCfg.CVE-2023-49430 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetStaticRouteCfg.
- Product
- Ax9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX9 V22.03.01.46 was discovered to contain a SQL command injection vulnerability in the 'setDeviceInfo' feature through the 'mac' parameter at /goform/setCVE-2023-49429 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AX9 V22.03.01.46 was discovered to contain a SQL command injection vulnerability in the 'setDeviceInfo' feature through the 'mac' parameter at /goform/setModules.
- Product
- ax9_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.CVE-2023-49437 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.
- Product
- Ax12 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.CVE-2023-49428 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName.
- Product
- ax12_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg.CVE-2023-49426 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg.
- Product
- Ax12 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg .CVE-2023-49425 · Network & remote access · Tenda · reported by MITRECritical 9.8
Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg .
- Product
- Ax12 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023The affected devices use publicly available default credentials with administrative privileges.CVE-2023-39169 · Other software · SENEC · reported by info@cert.vde.comCritical 9.8
The affected devices use publicly available default credentials with administrative privileges.
- Product
- Storage Box V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 7, 2023Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.CVE-2023-49424 · Network & remote access · tenda · reported by MITRECritical 9.8
Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.
- Product
- ax12_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.CVE-2023-39172 · Other software · SENEC · reported by info@cert.vde.comCritical 9.1
The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network traffic.
- Product
- Storage Box V1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Dec 7, 2023Password Reset with Code for WordPress REST API: Improper Restriction of Excessive Authentication AttemptsCVE-2023-35039 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Restriction of Excessive Authentication Attempts vulnerability in Be Devious Web Development Password Reset with Code for WordPress REST API allows Authentication Abuse.This issue affects Password Reset with Code for WordPress REST API: from n/a through 0.0.15.
- Product
- Password Reset with Code for WordPress REST API
- Affected
- up to 0.0.15
- What to do
- Affects up to 0.0.15. Update Password Reset with Code for WordPress REST API to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Dec 7, 2023An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be usCVE-2023-50164 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or Struts 6.3.0.2 or greater to fix this issue.
- Product
- Apache Struts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comlists.apache.org
Dec 7, 2023TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrCVE-2023-48860 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrictions and execute arbitrary code.
- Product
- N300rt Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parametCVE-2023-48823 · Other software · Mayurik · reported by MITRECritical 9.8
A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload via the email parameter during login.
- Product
- Courier Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 7, 2023strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charCVE-2023-41913 · Other software · Strongswan · reported by MITRECritical 9.8
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
- Product
- Strongswan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.fedoraproject.org
Dec 6, 2023Burst Statistics – Privacy-Friendly Analytics for: SQL InjectionCVE-2023-5761 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 (free) and versions 1.4.0 to 1.5.0 (pro) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Burst Statistics – Privacy-Friendly Analytics for
- Affected
- 1.4.0 to 1.4.6.1
- What to do
- Affects 1.4.0 to 1.4.6.1. Update Burst Statistics – Privacy-Friendly Analytics for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Dec 6, 2023In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL injection.CVE-2023-46353 · Other software · Mypresta · reported by MITRECritical 9.8
In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The method TiconProduct::getTiconByProductAndTicon() has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection.
- Product
- Product TAG Icons Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.friendsofpresta.orgsecurity.friendsofpresta.org
Dec 6, 2023The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user to login and obtain aCVE-2023-36655 · Other software · Prolion · reported by MITRECritical 9.8
The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user to login and obtain an authentication token by specifying a username with different uppercase/lowercase character combination.
- Product
- Cryptospike
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprolion.comcvcn.gov.it
Dec 6, 2023Permission management vulnerability in the PMS module.CVE-2023-46773 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Dec 6, 2023Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering.CVE-2023-48849 · Other software · Ruijie · reported by MITRECritical 9.8
Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering.
- Product
- Rg-eg1000c Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2023Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability.CVE-2023-22524 · Websites & servers · Atlassian · reported by security@atlassian.comCritical 9.8
Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code.
- Product
- Companion for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconfluence.atlassian.comjira.atlassian.com
Dec 5, 2023xinhu xinhuoa 2.2.1 contains a File upload vulnerability.CVE-2023-48930 · Other software · Rockoa · reported by MITRECritical 9.8
xinhu xinhuoa 2.2.1 contains a File upload vulnerability.
- Product
- Xinhu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Dec 5, 2023Unitronics Vision PLC and HMI Insecure Default Password VulnerabilityCVE-2023-6448 · Other software · Unitronics · reported by 9119a7d8-5eab-497f-8521-727c672e3725ExploitedCritical 9.8
Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.
- Product
- Vision PLC and HMI
- On CISA’s list since
- Dec 11, 2023 (federal fix deadline Dec 18, 2023)
- What to do
- Attackers are using this now. Install Unitronics’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogdownloads.unitronicsplc.comdownloads.unitronicsplc.com
Dec 5, 2023An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" (SCVE-2023-6269 · Other software · Atos Unify · reported by 551230f0-3615-47bd-b7cc-93e92e730bbfCritical 10
An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" (SBC) and "Branch", before version V10 R3.4.0, and OpenScape "BCF" before versions V10R10.12.00 and V10R11.05.02. This allows an unauthenticated attacker to gain root access to the appliance via SSH (scope change) and also bypass authentication for the administrative interface and gain access as an arbitrary (administrative) user.
- Product
- OpenScape Session Border Controller (SBC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 5, 2023Pre-auth RCE in Apache Ofbiz 18.12.09.CVE-2023-49070 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are recommended to upgrade to version 18.12.10
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comissues.apache.org
Dec 4, 2023Memory corruption in WLAN Host while processing RRM beacon on the AP.CVE-2023-33083 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption in WLAN Host while processing RRM beacon on the AP.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 4, 2023Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.CVE-2023-33082 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.8
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 4, 2023Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.CVE-2023-33054 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9.1
Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 4, 2023Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications.CVE-2023-48692 · Other software · azure-rtos · reported by GitHubCritical 9
Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can cause remote code execution due to memory overflow vulnerabilities in Azure RTOS NETX Duo. The affected components include processes/functions related to icmp, tcp, snmp, dhcp, nat and ftp in RTOS v6.2.1 and below. The fixes have been included in NetX Duo release 6.3.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- netxduo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.