Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,398 results · page 54 of 68
Nov 27, 2018In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow.CVE-2018-16094 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.1
In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow.
- Product
- ThinkSystem SMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 27, 2018In System Management Module (SMM) versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notablyCVE-2018-16092 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.1
In System Management Module (SMM) versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file.
- Product
- ThinkSystem SMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 27, 2018In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows.CVE-2018-16091 · Other software · Lenovo · reported by psirt@lenovo.comHigh 8.1
In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows.
- Product
- ThinkSystem SMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 27, 2018In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection.CVE-2018-16090 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.5
In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection.
- Product
- ThinkSystem SMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 27, 2018In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentCVE-2018-16089 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.5
In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user.
- Product
- ThinkSystem SMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 16, 2018In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command.CVE-2018-9086 · Other software · Lenovo · reported by psirt@lenovo.comHigh 7.2
In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command. This allows a privileged user to download and execute arbitrary code inside the BMC. This can only be exploited by authorized privileged users.
- Product
- ThinkServer BMC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.lenovo.comsupport.lenovo.com
Nov 12, 2018steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML CVE-2018-19206 · Websites & servers · Roundcube · reported by MITREMedium 6.1
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comroundcube.net
Nov 5, 2018When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with a specific byte, memory corruption may occur within a specifiCVE-2018-17905 · Other software · Omron · reported by ics-cert@hq.dhs.govHigh 7.8
When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with a specific byte, memory corruption may occur within a specific object.
- Product
- CX-Supervisor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Nov 3, 2018xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view.CVE-2018-18909 · Other software · Xheditor · reported by MITREMedium 6.1
xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view.
- Product
- Xheditor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2018Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershell"), within a .py file.CVE-2018-18748 · Other software · Sandboxie-plus · reported by MITRECritical 10
Sandboxie 5.26 allows a Sandbox Escape via an "import os" statement, followed by os.system("cmd") or os.system("powershell"), within a .py file. NOTE: the vendor disputes this issue because the observed behavior is consistent with the product's intended functionality
- Product
- Sandboxie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2018* Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input.CVE-2018-18013 · Network & remote access · Citrix · reported by MITREHigh 7.8
* Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input. If this service is supplied with raw serialised Java objects, it deserialises them back into Java objects in memory, giving rise to a remote code execution vulnerability. NOTE: the vendor disputes that this is a vulnerability, stating it is "already mitigated by the internal firewall that limits access to configuration services to localhost.
- Product
- Xenmobile Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvisories.dxw.comadvisories.dxw.com
Oct 23, 2018360 Total Security 3.5.0.1033 allows a Sandbox Escape via an "import os" statement, followed by os.system("CMD") or os.system("PowerShell"), within a .py file.CVE-2018-18603 · Other software · 360totalsecurity · reported by MITREMedium 6.3
360 Total Security 3.5.0.1033 allows a Sandbox Escape via an "import os" statement, followed by os.system("CMD") or os.system("PowerShell"), within a .py file. NOTE: the vendor's position is that this cannot be categorized as a vulnerability, although it is a security-related issue
- Product
- 360 Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexchange.xforce.ibmcloud.com
Oct 20, 2018ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable.CVE-2018-18546 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record98587329.github.iogithub.com
Oct 19, 2018Xfce Thunar 1.6.15, when Xfce 4.12 is used, mishandles the IBus-Unikey input method for file searches within File Manager, leading to an out-of-bounds read and CVE-2018-18398 · Other software · Xfce · reported by MITREMedium 4.7
Xfce Thunar 1.6.15, when Xfce 4.12 is used, mishandles the IBus-Unikey input method for file searches within File Manager, leading to an out-of-bounds read and SEGV. This could potentially be exploited by an arbitrary local user who creates files in /tmp before the victim uses this input method.
- Product
- Thunar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record0xd0ff9.wordpress.com0xd0ff9.wordpress.com
Oct 19, 2018The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) stores the username and password within the cookies of a sessionCVE-2018-12674 · Other software · Sv3c · reported by MITREMedium 5.7
The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) stores the username and password within the cookies of a session. If an attacker gained access to these session cookies, it would be possible to gain access to the username and password of the logged-in account.
- Product
- H.264 POE IP Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbishopfox.combishopfox.com
Oct 19, 2018ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable.CVE-2018-18530 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable. NOTE: a backquote character is required in the attack URI.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2018ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable.CVE-2018-18529 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2018Remote Code Execution in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-18396 · Other software · Moxa · reported by vulnerability@kaspersky.comCritical 9.8
Remote Code Execution in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
- Product
- ThingsPro IIoT Gateway and Device Management Software Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comics-cert.kaspersky.com
Oct 19, 2018Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-18395 · Other software · Moxa · reported by vulnerability@kaspersky.comCritical 9.8
Hidden Token Access in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
- Product
- ThingsPro IIoT Gateway and Device Management Software Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comics-cert.kaspersky.com
Oct 19, 2018Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-18394 · Other software · Moxa · reported by vulnerability@kaspersky.comCritical 9.8
Sensitive Information Stored in Clear Text in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
- Product
- ThingsPro IIoT Gateway and Device Management Software Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comics-cert.kaspersky.com
Oct 19, 2018Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-18393 · Other software · Moxa · reported by vulnerability@kaspersky.comCritical 9.8
Password Management Issue in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
- Product
- ThingsPro IIoT Gateway and Device Management Software Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comics-cert.kaspersky.com
Oct 19, 2018Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-18392 · Other software · Moxa · reported by vulnerability@kaspersky.comHigh 8.8
Privilege Escalation via Broken Access Control in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
- Product
- ThingsPro IIoT Gateway and Device Management Software Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comics-cert.kaspersky.com
Oct 19, 2018User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-18391 · Other software · Moxa · reported by vulnerability@kaspersky.comHigh 8.8
User Privilege Escalation in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
- Product
- ThingsPro IIoT Gateway and Device Management Software Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comics-cert.kaspersky.com
Oct 19, 2018User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.CVE-2018-18390 · Other software · Moxa · reported by vulnerability@kaspersky.comHigh 7.5
User Enumeration in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.
- Product
- ThingsPro IIoT Gateway and Device Management Software Solutions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comics-cert.kaspersky.com
Oct 18, 2018Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field.CVE-2018-12374 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comaccess.redhat.com
Oct 10, 2018In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, buCVE-2018-12542 · Other software · The Eclipse Foundation · reported by emo@eclipse.orgCritical 9.8
In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.
- Product
- Eclipse Vert.x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.eclipse.orggithub.com
Oct 1, 2018An exploitable uninitialized length vulnerability exists within the Word document-parser of the Atlantis Word Processor 3.0.2.3 and 3.0.2.5.CVE-2018-3984 · Other software · The Atlantis Word Processor Team · reported by talos-cna@cisco.comHigh 7.8
An exploitable uninitialized length vulnerability exists within the Word document-parser of the Atlantis Word Processor 3.0.2.3 and 3.0.2.5. A specially crafted document can cause Atlantis to skip initializing a value representing the number of columns of a table. Later, the application will use this as a length within a loop that will write to a pointer on the heap. Due to this value being controlled, a buffer overflow will occur, which can lead to code execution under the context of the application. An attacker must convince a victim to open a document in order to trigger this vulnerability.
- Product
- Atlantis Word Processor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 30, 2018An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2.CVE-2018-17218 · Other software · PTC · reported by MITREMedium 5.4
An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is reflected XSS in the SQUEAL search function.
- Product
- Thingworx Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2018An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2.CVE-2018-17217 · Other software · PTC · reported by MITREHigh 7.5
An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key.
- Product
- Thingworx Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2018An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2.CVE-2018-17216 · Other software · PTC · reported by MITREMedium 6.5
An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users.
- Product
- Thingworx Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2018In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.CVE-2018-17566 · Other software · Thinkphp · reported by MITRECritical 9.8
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2018The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page.CVE-2018-11352 · Other software · Wallabag · reported by MITREMedium 4
The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be exploited with authentication and used to target administrators and steal their sessions.
- Product
- Wallabag
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbishopfox.combishopfox.com
Sep 21, 2018An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings HubCVE-2018-3915 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comHigh 8.2
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 64 bytes. An attacker can send an arbitrarily long "bucket" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 21, 2018An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings HubCVE-2018-3914 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comHigh 7.8
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 2000 bytes. An attacker can send an arbitrarily long "sessionToken" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 21, 2018An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings HubCVE-2018-3913 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comMedium 6.7
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 32 bytes. An attacker can send an arbitrarily long "accessKey" value in order to exploit this vulnerability.
- Product
- Sth-eth-250 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 21, 2018An exploitable stack-based buffer overflow vulnerability exists in the retrieval of a database field in video-core's HTTP server of Samsung SmartThings Hub.CVE-2018-3906 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comHigh 8.2
An exploitable stack-based buffer overflow vulnerability exists in the retrieval of a database field in video-core's HTTP server of Samsung SmartThings Hub. The video-core process insecurely extracts the shard.videoHostURL field from its SQLite database, leading to a buffer overflow on the stack. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 21, 2018An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-FirmwaCVE-2018-3894 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comHigh 8.8
An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can send an arbitrarily long "startTime" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 21, 2018An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware versiCVE-2018-3877 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comCritical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer, which has a size of 160 bytes. An attacker can send an arbitrarily long "directory" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 21, 2018An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware versiCVE-2018-3876 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comHigh 8.8
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer, which has a size of 64 bytes. An attacker can send an arbitrarily long "bucket" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 21, 2018An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware versiCVE-2018-3874 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comCritical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer, which has a size of 32 bytes. An attacker can send an arbitrarily long "accessKey" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 21, 2018An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware versiCVE-2018-3873 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comCritical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer, which has a size of 128 bytes. An attacker can send an arbitrarily long "secretKey" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 20, 2018The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL Injection within dowCVE-2018-14592 · Other software · Cwjoomla · reported by MITRECritical 9.8
The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL Injection within download.php.
- Product
- CW Article Attachments Free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwjoomla.comexploit-db.com
Sep 20, 2018An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - FirmwarCVE-2018-3865 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comHigh 8.8
An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long "cameraIp" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 20, 2018An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - FirmwarCVE-2018-3864 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comHigh 8.8
An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an arbitrarily long "password" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 12, 2018stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.CVE-2018-16981 · Other software · Nothings · reported by MITREHigh 8.8
stb stb_image.h 2.19, as used in catimg, Emscripten, and other products, has a heap-based buffer overflow in the stbi__out_gif_code function.
- Product
- STB Image.h
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Sep 12, 2018razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.CVE-2018-16727 · Other software · Razorcms · reported by MITREMedium 5.4
razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.
- Product
- Razorcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2018razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.CVE-2018-16726 · Other software · Razorcms · reported by MITREMedium 5.4
razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.
- Product
- Razorcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2018An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware versiCVE-2018-3875 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comCritical 9.9
An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy overflows the destination buffer, which has a size of 2,000 bytes. An attacker can send an arbitrarily long "sessionToken" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 10, 2018An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware verCVE-2018-3897 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comHigh 8.8
An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can send an arbitrarily long "callbackUrl" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 10, 2018An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware verCVE-2018-3896 · Computers, phones & browsers · Samsung · reported by talos-cna@cisco.comHigh 8.8
An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub with Firmware version 0.20.17. The video-core process incorrectly extracts fields from a user-controlled JSON payload, leading to a buffer overflow on the stack. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can send an arbitrarily long "correlationId" value in order to exploit this vulnerability.
- Product
- SmartThings Hub STH-ETH-250
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.