Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

1,629 results · page 6 of 33

May 19, 2020Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.CVE-2020-9753 · Other software · NAVER Corporation · reported by cve@navercorp.comCritical 9.1
Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.
Product
Whale Browser Installer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cve.naver.com cve.naver.com
Apr 27, 2020A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE serveCVE-2020-7135 · Other software · HPE · reported by security-alert@hpe.comHigh 7.8
A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant (SPP) releases 2018.06.0, 2018.09.0, and 2018.11.0. The vulnerable software is the Supplemental Update / Online ROM Flash Component for Linux (x64) software. The installer in this software component could be locally exploited to execute arbitrary code. Drive Models can be found in the Vulnerability Resolution field of the security bulletin. The 2019_03 SPP and Supplemental update / Online ROM Flash Component for Linux (x64) after 2019.03.0 has fixed this issue.
Product
HPE Service Pack for ProLiant
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com support.hpe.com
Mar 30, 2020In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting (XSS) vulnerability in the Upload Flash File feature allows authenticated remote attackers to CVE-2019-19912 · Other software · Intland · reported by MITREMedium 4.8
In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting (XSS) vulnerability in the Upload Flash File feature allows authenticated remote attackers to inject arbitrary scripts via an active script embedded in an SWF file.
Product
Codebeamer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Feb 13, 2020XSS in Telligent Community 5.6.583.20496 via a flash file and related to the allowScriptAccess parameter.CVE-2012-1903 · Other software · Telligent · reported by MITREMedium 5.4
XSS in Telligent Community 5.6.583.20496 via a flash file and related to the allowScriptAccess parameter.
Product
Community
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web.archive.org web.archive.org
Feb 13, 2020Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion vulnerabiliCVE-2020-3757 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
Product
Adobe Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com helpx.adobe.com
Feb 8, 2020Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remoCVE-2011-3642 · Other software · Flowplayer · reported by MITRECritical 9.6
Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.
Product
Flowplayer Flash
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record appsec.ws secunia.com
Jan 27, 2020A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and CVE-2019-19823 · Other software · Totolink · reported by MITREHigh 7.5
A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK A3002RU through 2.0.0, A702R through 2.1.3, N301RT through 2.1.6, N302R through 3.4.0, N300RT through 3.4.0, N200RE through 4.0.0, N150RT through 3.4.0, and N100RE through 3.4.0; Rutek RTK 11N AP through 2019-12-12; Sapido GR297n through 2019-12-12; CIK TELECOM MESH ROUTER through 2019-12-12; KCTVJEJU Wireless AP through 2019-12-12; Fibergate FGN-R2 through 2019-12-12; Hi-Wifi MAX-C300N through 2019-12-12; HCN MAX-C300N through 2019-12-12; T-broad GN-866ac through 2019-12-12; Coship EMTA AP through 2019-12-12; and IO-Data WN-AC1167R through 2019-12-12.
Product
A3002ru Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record opensource.actiontec.com packetstormsecurity.com
Jan 27, 2020IrfanView FlashPix Plugin 4.3.4 0 has an Integer Overflow VulnerabilityCVE-2013-3486 · Other software · IrfanView FlashPix PlugIn · reported by PSIRT-CNA@flexerasoftware.comCritical 9.6
IrfanView FlashPix Plugin 4.3.4 0 has an Integer Overflow Vulnerability
Product
IrfanView FlashPix PlugIn
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Jan 6, 2020On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) enablement.CVE-2019-16272 · Other software · Dten · reported by MITRECritical 9.8
On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) enablement.
Product
D5 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forescout.com forescout.com
Jan 2, 2020Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTMCVE-2014-4553 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters.
Product
spreadshirt-rss-3d-cube-flash-gallery
Affected
2014 to 2014
What to do
Affects 2014 to 2014. Update spreadshirt-rss-3d-cube-flash-gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Dec 27, 2019Xorbin Analog Flash Clock 1.0 extension for Joomia has XSSCVE-2013-4692 · Other software · Xorbin · reported by MITREMedium 6.1
Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS
Product
Analog Flash Clock
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Dec 27, 2019WordPress Xorbin Digital Flash Clock 1.0 has XSSCVE-2013-4693 · WordPress plugins & themes · reported by MITREMedium 6.1
WordPress Xorbin Digital Flash Clock 1.0 has XSS
Affected
1.0 to 1.0
What to do
Affects 1.0 to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Nov 22, 2019Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) attCVE-2013-6880 · Other software · Elvedia · reported by MITREMedium 6.1
Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) attacks via the HTTP Referer header.
Product
Flashcanvas
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record archives.neohapsis.com 7elements.co.uk
Nov 18, 2019NVIDIA NVFlash, NVUFlash Tool prior to v5.588.0 and GPUModeSwitch Tool prior to 2019-11, NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sys, and nvflsh64.sys)CVE-2019-5688 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 6.7
NVIDIA NVFlash, NVUFlash Tool prior to v5.588.0 and GPUModeSwitch Tool prior to 2019-11, NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sys, and nvflsh64.sys) contains a vulnerability in which authenticated users with administrative privileges can gain access to device memory and registers of other devices not managed by NVIDIA, which may lead to escalation of privileges, information disclosure, or denial of service.
Product
NVIDIA NVFlash, NVUFlash, GPUModeSwitch Tool
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Nov 13, 2019phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag.CVE-2011-0544 · Websites & servers · phpbb3 · reported by Red HatMedium 6.1
phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag.
Product
phpbb3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com security-tracker.debian.org
Nov 13, 2019views/upload.php in the ProJoom Smart Flash Header (NovaSFH) component 3.0.2 and earlier for Joomla! allows remote attackers to upload and execute arbitrary filCVE-2014-1214 · Other software · Projoom · reported by MITREHigh 8.8
views/upload.php in the ProJoom Smart Flash Header (NovaSFH) component 3.0.2 and earlier for Joomla! allows remote attackers to upload and execute arbitrary files via a crafted (1) dest parameter and (2) arbitrary extension in the Filename parameter.
Product
Smart Flash Header
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com portcullis-security.com
Nov 13, 2019In Phoenix SCT WinFlash 1.1.12.0 through 1.5.74.0, the included drivers could be used by a malicious Windows application to gain elevated privileges.CVE-2019-18279 · Other software · Phoenix · reported by MITREHigh 8.8
In Phoenix SCT WinFlash 1.1.12.0 through 1.5.74.0, the included drivers could be used by a malicious Windows application to gain elevated privileges. Adverse impacts are limited to the Windows environment and there is no known direct impact to the UEFI firmware. This was fixed in late June 2019.
Product
Securecore Technology
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record eclypsium.com eclypsium.com
Sep 27, 2019Adobe Flash Player version 32.0.0.192 and earlier versions have a Same Origin Policy Bypass vulnerability.CVE-2019-8075 · Other software · Adobe · reported by AdobeHigh 7.5
Adobe Flash Player version 32.0.0.192 and earlier versions have a Same Origin Policy Bypass vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
Product
Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record chromereleases.googleblog.com crbug.com
Sep 25, 2019SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.CVE-2019-12205 · Other software · Silverstripe · reported by MITREMedium 6.1
SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.
Product
Silverstripe
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forum.silverstripe.org silverstripe.org
Sep 24, 2019On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeateCVE-2019-14239 · Other software · NXP · reported by MITREMedium 6.6
On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeated by leveraging a load instruction inside the execute-only region to expose the protected code into a CPU register.
Product
Kinetis Kv1x Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record usenix.org usenix.org
Sep 12, 2019Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability.CVE-2019-8070 · Other software · Adobe · reported by AdobeCritical 9.8
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Use after free vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
Product
Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com security.gentoo.org
Sep 12, 2019Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability.CVE-2019-8069 · Other software · Adobe · reported by AdobeCritical 9.8
Adobe Flash Player 32.0.0.238 and earlier versions, 32.0.0.207 and earlier versions have a Same Origin Method Execution vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
Product
Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com security.gentoo.org
Sep 12, 2019On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeateCVE-2019-14237 · Other software · NXP · reported by MITRECritical 9.8
On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeated by observing CPU registers and the effect of code/instruction execution.
Product
Kinetis Kv1x Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record usenix.org usenix.org
Aug 26, 2019FlashLingo before 2019-06-12 allows SQL injection, related to flashlingo.js and db.js.CVE-2019-15561 · Other software · Flashlingo Project · reported by MITRECritical 9.8
FlashLingo before 2019-06-12 allows SQL injection, related to flashlingo.js and db.js.
Product
Flashlingo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 27, 2019In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function.CVE-2016-10764 · Computers, phones & browsers · Linux · reported by MITRECritical 9.8
In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so the ">" should be ">=" instead.
Product
Linux Kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org github.com
Jul 23, 2019POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements.CVE-2019-11712 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Product
Firefox ESR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org lists.opensuse.org
Jun 24, 2019The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" CVE-2019-7229 · Other software · ABB · reported by MITREHigh 8.3
The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device" and "Remote provisioning process via ABB Panel Builder 600 over FTP." Neither of these transmission methods implements any form of encryption or authenticity checks against the new firmware HMI software binary files.
Product
Board Support Package Un31
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Jun 12, 2019Adobe Flash Player versions 32.0.0.192 and earlier, 32.0.0.192 and earlier, and 32.0.0.192 and earlier have an use after free vulnerability.CVE-2019-7845 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 32.0.0.192 and earlier, 32.0.0.192 and earlier, and 32.0.0.192 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Product
Adobe Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record access.redhat.com helpx.adobe.com
May 24, 2019Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome versions 32.0.0.114 and earlier, and Flash Player for Microsoft EdgCVE-2019-7090 · Other software · Adobe · reported by AdobeMedium 6.5
Flash Player Desktop Runtime versions 32.0.0.114 and earlier, Flash Player for Google Chrome versions 32.0.0.114 and earlier, and Flash Player for Microsoft Edge and Internet Explorer 11 versions 32.0.0.114 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Product
Flash Player Desktop Runtime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com helpx.adobe.com
May 23, 2019Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an out-of-bounds read vulnerability.CVE-2019-7108 · Other software · Adobe · reported by AdobeHigh 7.5
Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
Product
Adobe Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com security.gentoo.org
May 23, 2019Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability.CVE-2019-7096 · Other software · Adobe · reported by AdobeCritical 9.8
Adobe Flash Player versions 32.0.0.156 and earlier, 32.0.0.156 and earlier, and 32.0.0.156 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Product
Adobe Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com security.gentoo.org
May 22, 2019Adobe Flash Player versions 32.0.0.171 and earlier, 32.0.0.171 and earlier, and 32.0.0.171 and earlier have a use after free vulnerability.CVE-2019-7837 · Other software · Adobe · reported by AdobeHigh 8.8
Adobe Flash Player versions 32.0.0.171 and earlier, 32.0.0.171 and earlier, and 32.0.0.171 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Product
Adobe Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com access.redhat.com
Apr 10, 2019In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash.CVE-2019-6156 · Other software · Lenovo · reported by psirt@lenovo.comLow 3.3
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). Lenovo was notified that after resuming from S3 sleep mode in various versions of BIOS for Lenovo systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
Product
BIOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.lenovo.com support.lenovo.com
Apr 8, 2019A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects.CVE-2019-0612 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
A security feature bypass vulnerability exists when Click2Play protection in Microsoft Edge improperly handles flash objects. By itself, this bypass vulnerability does not allow arbitrary code execution, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.
Product
Microsoft Edge
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record portal.msrc.microsoft.com portal.msrc.microsoft.com
Apr 2, 2019A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attacCVE-2018-18035 · Other software · Open-emr · reported by MITREMedium 6.1
A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.
Product
Openemr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record open-emr.org purplemet.com
Feb 27, 2019IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to downCVE-2018-1775 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757.
Product
torwize V7000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Jan 18, 2019Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library loading (dll hijacking) vulnerability.CVE-2018-15983 · Other software · Adobe · reported by AdobeHigh 7.8
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
Product
Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com helpx.adobe.com
Jan 18, 2019Adobe Flash Player Use-After-Free VulnerabilityCVE-2018-15982 · Other software · Adobe · reported by AdobeExploitedRansomwareHigh 7.8
Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability
Product
Flash Player
On CISA’s list since
Feb 15, 2022 (federal fix deadline Aug 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com access.redhat.com
Dec 18, 2018There is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in Espruino 2V00, leading to a denial of service or possibly unspecified CVE-2018-20201 · Other software · Pur3 · reported by MITREHigh 7.8
There is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in Espruino 2V00, leading to a denial of service or possibly unspecified other impact via a crafted js file.
Product
Espruino
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 29, 2018Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability.CVE-2018-15981 · Other software · Adobe · reported by AdobeCritical 9.8
Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.
Product
Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Nov 29, 2018Flash Player versions 31.0.0.122 and earlier have an out-of-bounds read vulnerability.CVE-2018-15978 · Other software · Adobe · reported by AdobeHigh 7.5
Flash Player versions 31.0.0.122 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
Product
Flash Player Desktop Runtime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Nov 27, 2018In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing fastboot flash command, memory leak CVE-2018-11943 · Computers, phones & browsers · Google · reported by product-security@qualcomm.comHigh 7.8
In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing fastboot flash command, memory leak or unexpected behavior may occur due to processing of unintialized data buffers.
Product
Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record source.codeaurora.org codeaurora.org
Oct 18, 2018IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely CVE-2018-1822 · Other software · IBM · reported by psirt@us.ibm.comCritical 9.8
IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296.
Product
FlashSystem 900
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com exchange.xforce.ibmcloud.com
Oct 18, 2018NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the targeCVE-2018-12364 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery (CSRF) attacks. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
Product
Thunderbird
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Oct 10, 2018Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacker to conduct a crossCVE-2018-17784 · Other software · Sugarcrm · reported by MITREMedium 6.1
Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.
Product
Sugarcrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twitter.com exploit-db.com
Oct 2, 2018In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially alCVE-2018-9069 · Other software · Lenovo Group LTD · reported by psirt@lenovo.comMedium 5.9
In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.
Product
IdeaPad
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.lenovo.com support.lenovo.com
Sep 25, 2018Adobe Flash Player versions 30.0.0.154 and earlier have a privilege escalation vulnerability.CVE-2018-15967 · Other software · Adobe · reported by AdobeHigh 7.5
Adobe Flash Player versions 30.0.0.154 and earlier have a privilege escalation vulnerability. Successful exploitation could lead to information disclosure.
Product
Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Sep 18, 2018In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when flashing image using FastbootLib if size is notCVE-2018-11275 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comMedium 5.5
In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when flashing image using FastbootLib if size is not divisible by block size, information leak occurs.
Product
Android for MSM, Firefox OS for MSM, QRD Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com source.codeaurora.org
Sep 11, 2018CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite theCVE-2018-16832 · Other software · Xunfeng Project · reported by MITREMedium 6.5
CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because views/lib/AntiCSRF.py can overwrite the request.host value with the content of the X-Forwarded-Host HTTP header.
Product
Xunfeng
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 29, 2018Adobe Flash Player 30.0.0.134 and earlier have a "use of a component with a known vulnerability" vulnerability.CVE-2018-12828 · Other software · Adobe · reported by AdobeCritical 9.8
Adobe Flash Player 30.0.0.134 and earlier have a "use of a component with a known vulnerability" vulnerability. Successful exploitation could lead to privilege escalation.
Product
Flash Player
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.