Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

477new WordPress flaws this week

390,525entries in the database

865 results · page 6 of 18

Mar 25, 2022Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) beforCVE-2022-22687 · Network & remote access · Synology · reported by security@synology.comCritical 9.8
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.
Product
DiskStation Manager (DSM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record synology.com synology.com
Mar 14, 2022Add Subtitle: Does not sanitise or escape the sub-title field (available only with classic editor)CVE-2021-24897 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field (available only with classic editor) when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Product
Add Subtitle
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Add Subtitle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 9, 2022A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperlyCVE-2022-22805 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.8
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)
Product
SmartConnect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record se.com se.com
Nov 30, 2021The Bluetooth Classic implementation on Actions ATS2815 chipsets does not properly handle the reception of continuous unsolicited LMP responses, allowing attackCVE-2021-31787 · Other software · Actions-semi · reported by MITREMedium 6.5
The Bluetooth Classic implementation on Actions ATS2815 chipsets does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and shutdown of a device by flooding the target device with LMP_features_res packets.
Product
Ats2819p Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net launchstudio.bluetooth.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROCVE-2021-31890 · Other software · Siemens · reported by productcert@siemens.comHigh 7.5
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). The total length of an TCP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0017)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROCVE-2021-31889 · Other software · Siemens · reported by productcert@siemens.comHigh 7.5
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0). Malformed TCP packets with a corrupted SACK option leads to Information Leaks and Denial-of-Service conditions. (FSMD-2021-0015)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303).CVE-2021-31883 · Other software · Siemens · reported by productcert@siemens.comHigh 7.1
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP ACK message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0013)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303).CVE-2021-31882 · Other software · Siemens · reported by productcert@siemens.comMedium 6.5
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). The DHCP client application does not validate the length of the Domain Name Server IP option(s) (0x06) when processing DHCP ACK packets. This may lead to Denial-of-Service conditions. (FSMD-2021-0011)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303).CVE-2021-31881 · Other software · Siemens · reported by productcert@siemens.comHigh 7.1
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303). When processing a DHCP OFFER message, the DHCP client application does not validate the length of the Vendor option(s), leading to Denial-of-Service conditions. (FSMD-2021-0008)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROCVE-2021-31346 · Other software · Siemens · reported by productcert@siemens.comHigh 8.2
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). The total length of an ICMP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0007)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROCVE-2021-31345 · Other software · Siemens · reported by productcert@siemens.comHigh 7.5
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions). The total length of an UDP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on a user-defined applications that runs on top of the UDP protocol. (FSMD-2021-0006)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 9, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROCVE-2021-31344 · Other software · Siemens · reported by productcert@siemens.comMedium 6.9
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), PLUSCONTROL 1st Gen (All versions), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), SIMOTICS CONNECT 400 (All versions < V1.0.0.0). ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004)
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Nov 3, 2021Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker tCVE-2021-43082 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0.
Product
Apache Traffic Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Nov 1, 2021An open redirect vulnerability exists in Replicated Classic versions prior to 2.53.1 that could lead to spoofing.CVE-2021-43058 · Other software · Replicated · reported by security@replicated.comMedium 6.1
An open redirect vulnerability exists in Replicated Classic versions prior to 2.53.1 that could lead to spoofing. To exploit this vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link, redirecting the user to an untrusted site.
Product
Replicated Classic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record replicated.com replicated.com
Oct 12, 2021An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in CVE-2021-40618 · Other software · Os4ed · reported by MITRECritical 9.8
An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in HoldAddressFields.php.
Product
Opensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 11, 2021Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET['usrid'] and $_GET[CVE-2021-40543 · Other software · Os4ed · reported by MITRECritical 9.8
Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET['usrid'] and $_GET['prof_id'] in the PasswordCheck.php file.
Product
Opensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 11, 2021Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS).CVE-2021-40542 · Other software · Os4ed · reported by MITREMedium 6.1
Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS). An unauthenticated user can inject and execute JavaScript code through the link_url parameter in Ajax_url_encode.php.
Product
Opensis
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 7, 2021The Bluetooth Classic implementation on the Texas Instruments CC256XCQFN-EM does not properly handle the reception of continuous LMP_AU_Rand packets, allowing aCVE-2021-34149 · Other software · TI · reported by MITREMedium 6.5
The Bluetooth Classic implementation on the Texas Instruments CC256XCQFN-EM does not properly handle the reception of continuous LMP_AU_Rand packets, allowing attackers in radio range to trigger a denial of service (deadlock) of the device by flooding it with LMP_AU_Rand packets after the paging procedure.
Product
Cc256xcqfn-em Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net ti.com
Sep 7, 2021The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot wCVE-2021-34148 · Other software · Cypress · reported by MITREMedium 6.5
The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with a greater ACL Length after completion of the LMP setup procedure, allowing attackers in radio range to trigger a denial of service (firmware crash) via a crafted LMP packet.
Product
Wireless Internet Connectivity For Embedded Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net cypress.com
Sep 7, 2021The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timingCVE-2021-34147 · Other software · Cypress · reported by MITREMedium 6.5
The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a malformed LMP timing accuracy response followed by multiple reconnections to the link slave, allowing attackers to exhaust device BT resources and eventually trigger a crash via multiple attempts of sending a crafted LMP timing accuracy response followed by a sudden reconnection with a random BDAddress.
Product
Wireless Internet Connectivity For Embedded Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net cypress.com
Sep 7, 2021The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attCVE-2021-34146 · Other software · Cypress · reported by MITREMedium 6.5
The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and restart (crash) of the device by flooding it with LMP_AU_Rand packets after the paging procedure.
Product
Cyw920735q60evb-01 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net cypress.com
Sep 7, 2021The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot wCVE-2021-34145 · Other software · Cypress · reported by MITREMedium 5.3
The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with an invalid Baseband packet type (and LT_ADDRESS and LT_ADDR) after completion of the LMP setup procedure, allowing attackers in radio range to trigger a denial of service (firmware crash) via a crafted LMP packet.
Product
Wireless Internet Connectivity For Embedded Devices
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net cypress.com
Sep 7, 2021The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C_DEMO_V1.0 does not properly handle the reception of continuous unsolicited LMP responses, allowCVE-2021-34143 · Other software · Zh-jieli · reported by MITREMedium 6.5
The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C_DEMO_V1.0 does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (deadlock) of the device by flooding it with LMP_AU_Rand packets after paging procedure. User intervention is required to restart the device.
Product
Fw-ac63 BT SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net github.com
Sep 7, 2021The Bluetooth Classic Audio implementation on Actions ATS2815 and ATS2819 devices does not properly handle a connection attempt from a host with the same BDAddrCVE-2021-31786 · Other software · Actions-semi · reported by MITREMedium 6.5
The Bluetooth Classic Audio implementation on Actions ATS2815 and ATS2819 devices does not properly handle a connection attempt from a host with the same BDAddress as the current connected BT host, allowing attackers to trigger a disconnection and deadlock of the device by connecting with a forged BDAddress that matches the original connected host.
Product
Ats2819p Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net launchstudio.bluetooth.com
Sep 7, 2021The Bluetooth Classic implementation on Actions ATS2815 and ATS2819 chipsets does not properly handle the reception of multiple LMP_host_connection_req packets,CVE-2021-31785 · Other software · Actions-semi · reported by MITREMedium 6.5
The Bluetooth Classic implementation on Actions ATS2815 and ATS2819 chipsets does not properly handle the reception of multiple LMP_host_connection_req packets, allowing attackers in radio range to trigger a denial of service (deadlock) of the device via crafted LMP packets. Manual user intervention is required to restart the device and restore Bluetooth communication.
Product
Ats2819p Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net launchstudio.bluetooth.com
Sep 7, 2021The Bluetooth Classic implementation on Zhuhai Jieli AC690X devices does not properly handle the reception of an oversized LMP packet greater than 17 bytes duriCVE-2021-31612 · Other software · Zh-jieli · reported by MITREMedium 6.5
The Bluetooth Classic implementation on Zhuhai Jieli AC690X devices does not properly handle the reception of an oversized LMP packet greater than 17 bytes during the LMP auto rate procedure, allowing attackers in radio range to trigger a deadlock via a crafted LMP packet.
Product
Ac6901 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zh-jieli.com dl.packetstormsecurity.net
Sep 7, 2021The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure that is followed by CVE-2021-31611 · Other software · Zh-jieli · reported by MITREMedium 5.7
The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure that is followed by a malformed LMP packet, allowing attackers in radio range to deadlock a device via a crafted LMP packet. The user needs to manually reboot the device to restore communication.
Product
Ac6901 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zh-jieli.com dl.packetstormsecurity.net
Sep 7, 2021The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in raCVE-2021-31610 · Other software · MI · reported by MITREMedium 6.5
The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (either restart or deadlock the device) by flooding a device with LMP_AU_rand data.
Product
MI True Wireless Earbuds Basic 2 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bluetrum.com bluetrum.com
Sep 7, 2021The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17 bCVE-2021-31609 · Other software · Silabs · reported by MITREMedium 6.5
The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17 bytes, allowing attackers in radio range to trigger a crash in WT32i via a crafted LMP packet.
Product
Iwrap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net silabs.com
Sep 7, 2021The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response CVE-2021-28139 · Other software · Espressif · reported by MITREHigh 8.8
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield payload.
Product
Esp-idf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net github.com
Sep 7, 2021The Bluetooth Classic implementation on Bluetrum AB5301A devices with unknown firmware versions does not properly handle the reception of oversized DM1 LMP packCVE-2021-34150 · Other software · Bluetrum · reported by MITREMedium 6.5
The Bluetooth Classic implementation on Bluetrum AB5301A devices with unknown firmware versions does not properly handle the reception of oversized DM1 LMP packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections (disabling the AB5301A inquiry and page scan procedures) via a crafted LMP packet. The user needs to manually perform a power cycle (restart) of the device to restore BT connectivity.
Product
Ab5301a Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bluetrum.com dl.packetstormsecurity.net
Sep 7, 2021The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C BT SDK through 0.9.1 does not properly handle the reception of truncated LMP_SCO_Link_Request pCVE-2021-34144 · Other software · Zh-jieli · reported by MITREMedium 6.5
The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C BT SDK through 0.9.1 does not properly handle the reception of truncated LMP_SCO_Link_Request packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections (disabling the AB5301A inquiry and page scan procedures) via a crafted LMP packet. The user needs to manually perform a power cycle (restart) of the device to restore BT connectivity.
Product
Fw-ac63 BT SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net github.com
Sep 7, 2021The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle the reception of a truncated LMP packet during the LMP aCVE-2021-31613 · Other software · Zh-jieli · reported by MITREMedium 6.5
The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle the reception of a truncated LMP packet during the LMP auto rate procedure, allowing attackers in radio range to immediately crash (and restart) a device via a crafted LMP packet.
Product
Ac6901 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record zh-jieli.com dl.packetstormsecurity.net
Sep 7, 2021The Bluetooth Classic implementation on JBL TUNE500BT devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackersCVE-2021-28155 · Other software · JBL · reported by MITREMedium 6.5
The Bluetooth Classic implementation on JBL TUNE500BT devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and shutdown a device by flooding the target device with LMP Feature Response data.
Product
Tune500bt Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net jbl.com.sg
Sep 7, 2021The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets dCVE-2021-28136 · Other software · Espressif · reported by MITREMedium 6.5
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet.
Product
Esp-idf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net github.com
Sep 7, 2021The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowiCVE-2021-28135 · Other software · Espressif · reported by MITREMedium 6.5
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (crash) in ESP32 by flooding the target device with LMP Feature Response data.
Product
Esp-idf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dl.packetstormsecurity.net github.com
Aug 30, 2021OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python code in the class attCVE-2021-39271 · Other software · Bscw · reported by MITREHigh 8.8
OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python code in the class attribute of a .bscw file. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3.
Product
Bscw Classic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 30, 2021OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (reCVE-2021-36359 · Other software · Bscw · reported by MITREHigh 8.8
OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (reached via bscw.cgi op=_editfolder.EditFolder) calls eval on attacker-supplied Python code. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3.
Product
Bscw Classic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Aug 9, 2021JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook.CVE-2021-32797 · Other software · jupyterlab · reported by GitHubHigh 7.4
JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html `<form>`. Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.
Product
jupyterlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 30, 2021Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration.CVE-2020-10590 · Other software · Replicated · reported by MITREHigh 7.5
Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with network access to the Admin Console port (8800) on the Replicated Classic server could retrieve the TLS Keypair (Cert and Key) used to configure the Admin Console.
Product
Replicated Classic
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record blog.replicated.com gradle.com
Jul 23, 2021Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7 allows remote attackers to inject arbitrary web script or HTML.CVE-2021-26799 · Other software · Omeka · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic <=2.7 allows remote attackers to inject arbitrary web script or HTML.
Product
Omeka
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 25, 2021Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability.CVE-2021-33542 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 7.8
Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The attacker needs to get access to an original bus configuration file (*.bcp) to be able to manipulate data inside. After manipulation the attacker needs to exchange the original file by the manipulated one on the application programming workstation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Automated systems in operation which were programmed with one of the above-mentioned products are not affected.
Product
Automation Worx Software Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com zerodayinitiative.com
Jun 25, 2021Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability.CVE-2021-33541 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 7.5
Phoenix Contact Classic Line Controllers ILC1x0 and ILC1x1 in all versions/variants are affected by a Denial-of-Service vulnerability. The communication protocols and device access do not feature authentication measures. Remote attackers can use specially crafted IP packets to cause a denial of service on the PLC's network communication module. A successful attack stops all network communication. To restore the network connectivity the device needs to be restarted. The automation task is not affected.
Product
ILC1x
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
Apr 22, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NECVE-2021-25664 · Other software · Siemens · reported by productcert@siemens.comHigh 8.7
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (All versions including affected IPv6 stack). The function that processes the Hop-by-Hop extension header in IPv6 packets and its options lacks any checks against the length field of the header, allowing attackers to put the function into an infinite loop by supplying arbitrary length values.
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Apr 22, 2021A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NECVE-2021-25663 · Other software · Siemens · reported by productcert@siemens.comHigh 8.7
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.4), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (All versions including affected IPv6 stack). The function that processes IPv6 headers does not check the lengths of extension header options, allowing attackers to put this function into an infinite loop with crafted length values.
Product
Capital Embedded AR Classic 431-422
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert-portal.siemens.com cert-portal.siemens.com
Jan 13, 2021Adobe Campaign Classic Gold Standard 10 (and earlier), 20.3.1 (and earlier), 20.2.3 (and earlier), 20.1.3 (and earlier), 19.2.3 (and earlier) and 19.1.7 (and eaCVE-2021-21009 · Other software · Adobe · reported by AdobeHigh 8.6
Adobe Campaign Classic Gold Standard 10 (and earlier), 20.3.1 (and earlier), 20.2.3 (and earlier), 20.1.3 (and earlier), 19.2.3 (and earlier) and 19.1.7 (and earlier) are affected by a server-side request forgery (SSRF) vulnerability. Successful exploitation could allow an attacker to use the Campaign instance to issue unauthorized requests to internal or external resources.
Product
Campaign
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com helpx.adobe.com
Jan 7, 2021A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic 2.57.00.14 CPR 9 SR 3.CVE-2020-13573 · Other software · Rockwellautomation · reported by talos-cna@cisco.comHigh 7.5
A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic 2.57.00.14 CPR 9 SR 3. A specially crafted network request can lead to a denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.
Product
Rslinx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Dec 10, 2020Adobe Lightroom Classic version 10.0 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execCVE-2020-24447 · Other software · Adobe · reported by AdobeHigh 7
Adobe Lightroom Classic version 10.0 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Product
Lightroom
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com helpx.adobe.com
Dec 3, 2020The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax is vulnerable to SQL injection in ProcessMaker 3.4.11.CVE-2020-13525 · Other software · Processmaker · reported by talos-cna@cisco.comHigh 8.8
The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables_Ajax is vulnerable to SQL injection in ProcessMaker 3.4.11. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Product
Processmaker
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record talosintelligence.com talosintelligence.com
Nov 19, 2020A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now UnitCVE-2020-7559 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.5
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially crafted request over Modbus.
Product
Ecostruxure Control Expert
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record se.com talosintelligence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.