Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
57 results · page 1 of 2
Oct 21, 2026Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android.CVE-2026-70387 · Other software · OnePlus · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.4
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
- Product
- OxygenOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on AndroiCVE-2026-70386 · Other software · OnePlus · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158High 8.5
Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus OxygenOS on Android. Any locally installed Android application, with no permissions declared and no user interaction beyond launching it, can execute arbitrary shell commands as uid 0 in the u:r:dumpstate:s0 SELinux domain. Two defects combine: (a) OnePlus's atlasservice binder interface accepts setEvent(String8 name, String8 value) from any caller without authorization, and (b) one event handler (OplusAtlasLogWriter::handleEvent, matching event name atlas_event_multimedia_audio_dumpsys) copies the caller-supplied value into the system property oplus.audio.dumpinfo.type and starts the root init service audiodumpinfo, which passes that property value unsanitized to system(). This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
- Product
- OxygenOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) faCVE-2026-91096 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them. The transport could then invoke a read callback that had been freed.
- Product
- proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Sep 28, 2026In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could retuCVE-2026-91095 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.3
In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed. HQSession then installed those handles as transport read callbacks, which could lead to use of freed memory.
- Product
- proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Sep 28, 2026In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSessCVE-2026-84895 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.3
In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method. The base method notifies the session handler, which may release the last reference to the session and destroy it.
- Product
- proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Sep 28, 2026In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under pCVE-2026-84894 · Other software · Meta Platforms, Inc · reported by cve-assign@fb.comHigh 7.5
In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carries the FIN in the same write.
- Product
- moxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Jul 23, 2026Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer.CVE-2026-44909 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources while preventing the server from transmitting responses, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service. Versions v2017.01.16.00 through v2026.07.20.00 are affected.
- Product
- proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2026Oxygen: Server-Side Request ForgeryCVE-2025-12886 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Oxygen
- Affected
- up to 6.0.8
- What to do
- Affects up to 6.0.8. Update Oxygen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocumentation.laborator.cowordfence.com
Mar 26, 2026MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out administrator and visCVE-2026-33935 · Other software · franklioxygen · reported by GitHubHigh 7.7
MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.72, an unauthenticated attacker can lock out administrator and visitor accounts from password-based authentication by triggering failed login attempts. The application exposes three password verification endpoints, all of which are publicly accessible. All three endpoints share a single file-backed login attempt state stored in `login-attempts.json`. When any endpoint records a failed authentication attempt via `recordFailedAttempt()`, the shared login attempt state is updated, increasing the `failedAttempts` counter and adjusting the associated timestamps and cooldown values. Before verifying a password, each endpoint calls `canAttemptLogin()`. This function checks the shared JSON file to determine whether a cooldown period is active. If the cooldown has not expired, the request is rejected before the password is validated. Because the failed attempt counter and cooldown timer are globally shared, failed authentication attempts against any endpoint affect all other endpoints. An attacker can exploit this by repeatedly sending invalid authentication requests to any of these endpoints, incr
- Product
- MyTube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey CVE-2026-33890 · Other software · franklioxygen · reported by GitHubHigh 8.9
MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.71, an unauthenticated attacker can register an arbitrary passkey and subsequently authenticate with it to obtain a full admin session. The application exposes passkey registration endpoints without requiring prior authentication. Any successfully authenticated passkey is automatically granted an administrator token, allowing full administrative access to the application. This enables a complete compromise of the application without requiring any existing credentials. Version 1.8.71 fixes the issue.
- Product
- MyTube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2026MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the `/api/settings/import-database`CVE-2026-33735 · Other software · franklioxygen · reported by GitHubHigh 7.4
MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the `/api/settings/import-database` endpoint allows attackers with low-privilege credentials to upload and replace the application's SQLite database entirely, leading to a full compromise of the application. The bypass is relevant for other POST routes as well. Version 1.8.69 fixes the issue.
- Product
- MyTube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Oxygen: Server-Side Request Forgery (SSRF)CVE-2025-69299 · WordPress plugins & themes · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in Laborator Oxygen oxygen allows Server Side Request Forgery.This issue affects Oxygen: from n/a through <= 6.0.8.
- Product
- Oxygen
- Affected
- up to 6.0.8
- What to do
- Affects up to 6.0.8. Update Oxygen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2026MyTube is a self-hosted downloader and player for several video websites.CVE-2026-24140 · Other software · franklioxygen · reported by GitHubLow 2.7
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below have a Mass Assignment vulnerability in the settings management functionality due to insufficient input validation. The application's saveSettings() function accepts arbitrary key-value pairs without validating property names against allowed settings. The function uses Record<string, any> as input type and iterates over all entries using Object.entries() without filtering unauthorized properties. Any field sent by the attacker is directly persisted to the database, regardless of whether it corresponds to a legitimate application setting. This issue has been fixed in version 1.7.78.
- Product
- MyTube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 23, 2026MyTube is a self-hosted downloader and player for several video websites.CVE-2026-24139 · Other software · franklioxygen · reported by GitHubHigh 8.7
MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing guest users to download the complete application database. The application fails to properly validate user permissions on the database export endpoint, enabling low-privileged users to access sensitive data they should not have permission to view.
- Product
- MyTube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026MyTube is a self-hosted downloader and player for several video websites.CVE-2026-23848 · Other software · franklioxygen · reported by GitHubMedium 6.5
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.7.71, a rate limiting bypass via `X-Forwarded-For` header spoofing allows unauthenticated attackers to bypass IP-based rate limiting on general API endpoints. Attackers can spoof client IPs by manipulating the `X-Forwarded-For` header, enabling unlimited requests to protected endpoints, including general API endpoints (enabling DoS) and other rate-limited functionality. Version 1.7.71 contains a patch for the issue.
- Product
- MyTube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026MyTube is a self-hosted downloader and player for several video websites.CVE-2026-23837 · Other software · franklioxygen · reported by GitHubCritical 9.8
MyTube is a self-hosted downloader and player for several video websites. A vulnerability present in version 1.7.65 and poetntially earlier versions allows unauthenticated users to bypass the mandatory authentication check in the roleBasedAuthMiddleware. By simply not providing an authentication cookie (making req.user undefined), a request is incorrectly passed through to downstream handlers. All users running MyTube with loginEnabled: true are impacted. This flaw allows an attacker to access and modify application settings via /api/settings, change administrative and visitor passwords, and access other protected routes that rely on this specific middleware. The problem is patched in v1.7.66. MyTube maintainers recommend all users upgrade to at least version v1.7.64 immediately to secure their instances. The fix ensures that the middleware explicitly blocks requests if a user is not authenticated, rather than defaulting to next(). Those who cannot upgrade immediately can mitigate risk by restricting network access by usi a firewall or reverse proxy (like Nginx) to restrict access to the /api/ endpoints to trusted IP addresses only or, if they are comfortable editing the source cod
- Product
- MyTube
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 22, 2025ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials.CVE-2025-67418 · Other software · Oxygenz · reported by MITRECritical 9.8
ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials. An unauthenticated remote attacker can log in to the administrative panel using these default credentials, resulting in full administrative control of the application.
- Product
- Clipbucket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2025Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing eveCVE-2025-55181 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.3
Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.
- Product
- proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Sep 23, 2025The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permissioCVE-2025-10184 · Other software · OnePlus · reported by cve@rapid7.comHigh 8.2
The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information disclosure and could effectively break the security provided by SMS-based Multi-Factor Authentication (MFA) checks. The root cause is a combination of missing permissions for write operations in several content providers (com.android.providers.telephony.PushMessageProvider, com.android.providers.telephony.PushShopProvider, com.android.providers.telephony.ServiceNumberProvider), and a blind SQL injection in the update method of those providers.
- Product
- OxygenOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.contentstack.iorapid7.com
Sep 18, 2025An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary fCVE-2025-55912 · Other software · Oxygenz · reported by MITREHigh 7.3
An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary files without any authentication, due to missing access controls in the upload handler
- Product
- Clipbucket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2025An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameterCVE-2025-55911 · Other software · Oxygenz · reported by MITREMedium 6.5
An issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the file_downloader.php and the file parameter
- Product
- Clipbucket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2025Oxygen MyData for WooCommerce: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-32631 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in oxygensuite Oxygen MyData for WooCommerce oxygen-mydata allows Path Traversal.This issue affects Oxygen MyData for WooCommerce: from n/a through <= 1.0.64.
- Product
- Oxygen MyData for WooCommerce
- Affected
- up to 1.0.64
- What to do
- Affects up to 1.0.64. Update Oxygen MyData for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2024Oxygen Builder: Unauthorized modification of dataCVE-2024-6688 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxy_save_css_from_admin AJAX action in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update stylesheets.
- Product
- Oxygen Builder
- Affected
- up to 4.8.3
- What to do
- Affects up to 4.8.3. Update Oxygen Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordoxygenbuilder.comwordfence.com
May 23, 2024Oxygen Builder: Remote Code ExecutionCVE-2024-4662 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributors, to inject arbitrary PHP code via the WordPress user interface and gain elevated privileges.
- Product
- Oxygen Builder
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Oxygen Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordoxygenbuilder.comwordfence.com
May 14, 2024Oxygen XML Web Author v26.0.0 and older and Oxygen Content Fusion v6.1 and older are vulnerable to Cross-Site Scripting (XSS) for malicious URLs.CVE-2024-25662 · Other software · reported by MITREMedium 6.1
Oxygen XML Web Author v26.0.0 and older and Oxygen Content Fusion v6.1 and older are vulnerable to Cross-Site Scripting (XSS) for malicious URLs.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoxygenxml.comoxygenxml.com
Apr 3, 2024Oxygen Builder: Improper Control of Generation of Code ('Code Injection')CVE-2024-31380 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection. Vendor is ignoring report, refuses to patch the issue.This issue affects Oxygen Builder: from n/a through 4.9.
- Product
- Oxygen Builder
- Affected
- up to 4.9
- What to do
- Affects up to 4.9. Update Oxygen Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comsnicco.io
Jan 11, 2024Oxygen Builder: Stored Cross-Site ScriptingCVE-2023-6938 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Version 4.8.1 of the Oxygen Builder plugin for WordPress addresses this vulnerability by implementing an optional filter to provide output escaping for dynamic data. Please see https://oxygenbuilder.com/documentation/other/security/#filtering-dynamic-data for more details.
- Product
- Oxygen Builder
- Affected
- up to 4.8
- What to do
- Affects up to 4.8. Update Oxygen Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordoxygenbuilder.comwordfence.com
Oct 3, 2023Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Oxygen Builder plugin <= 4.4 versions.CVE-2022-46841 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Oxygen Builder plugin <= 4.4 versions.
- Fixed in
- 4.4
- What to do
- Update the plugin to 4.4 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 14, 2023A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an CVE-2023-26559 · Other software · Sync · reported by MITREMedium 5.3
A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2023022015 allows an attacker to read files from a WEB-INF directory via a crafted HTTP request. (XML Web Author 24.1.0.3 build 2023021714 and 23.1.1.4 build 2023021715 are also fixed versions.)
- Product
- Oxygen Content Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoxygenxml.comoxygenxml.com
Jul 13, 2022An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310.CVE-2021-46827 · Other software · Sync · reported by MITREMedium 6.1
An issue was discovered in Oxygen XML WebHelp before 22.1 build 2021082006 and 23.x before 23.1 build 2021090310. An XSS vulnerability in search terms proposals (in online documentation generated using Oxygen XML WebHelp) allows attackers to execute JavaScript by convincing a user to type specific text in the WebHelp output search field.
- Product
- Oxygen Publishing Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoxygenxml.comoxygenxml.com
May 18, 2020A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific CVE-2020-1897 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific sequence. This issue affects versions of proxygen prior to v2020.05.18.00.
- Product
- proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfacebook.comfacebook.com
Mar 16, 2020Oxygen XML Editor 21.1.1 allows XXE to read any file.CVE-2019-20191 · Other software · Sync · reported by MITREHigh 7.5
Oxygen XML Editor 21.1.1 allows XXE to read any file.
- Product
- Oxygen XML Author
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2019In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corruCVE-2019-11940 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations can place the header table into a corrupted state, leading to a use-after-free condition and undefined behavior. This issue affects Proxygen from v0.29.0 until v2017.04.03.00.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
Jul 25, 2019An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformeCVE-2019-11921 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.8
An out of bounds write is possible via a specially crafted packet in certain configurations of Proxygen due to improper handling of Base64 when parsing malformed binary content in Structured HTTP Headers. This issue affects versions of proxygen prior to v2019.07.22.00.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comfacebook.com
May 24, 2019Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.CVE-2016-10245 · Other software · Doxygen · reported by MITREMedium 6.1
Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.
- Product
- Doxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgsecurityfocus.com
Dec 31, 2018An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack.CVE-2018-6347 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior to v2018.12.31.00.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency).CVE-2018-6346 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This affects Proxygen prior to v2018.12.31.00.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2018Proxygen fails to validate that a secondary auth manager is set before dereferencing it.CVE-2018-6343 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2018A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate resources.CVE-2018-6332 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.9
A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 settings which can cause the server to spend disproportionate resources. This affects all supported versions of HHVM (3.24.3 and 3.21.7 and below) when using the proxygen server to handle HTTP2 requests.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2018An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier.CVE-2017-5947 · Other software · Oneplus · reported by MITREMedium 6.8
An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker can reboot the device into the Qualcomm Emergency Download (EDL) mode through ADB or by using Volume-Up when connected to USB, which in turn could allow for downgrading partitions such as the Android Bootloader.
- Product
- Oxygenos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalephsecurity.comalephsecurity.com
May 11, 2017An issue was discovered on OnePlus One and X devices.CVE-2017-8851 · Other software · Oneplus · reported by MITREMedium 5.9
An issue was discovered on OnePlus One and X devices. Due to a lenient updater-script on the OnePlus One and X OTA images, the fact that both products use the same OTA verification keys, and the fact that both products share the same 'ro.build.product' system property, attackers can install OTAs of one product over the other, even on locked bootloaders. That could theoretically allow for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. Moreover, the vulnerability may result in having the device unusable until a Factory Reset is performed. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use 'adb sideload' to push the OTA.
- Product
- Oxygenos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalephsecurity.comalephsecurity.com
May 11, 2017An issue was discovered on OnePlus One, X, 2, 3, and 3T devices.CVE-2017-8850 · Other software · Oneplus · reported by MITREMedium 5.9
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).
- Product
- Oxygenos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalephsecurity.comalephsecurity.com
May 11, 2017An issue was discovered on OnePlus One, X, 2, 3, and 3T devices.CVE-2017-5948 · Other software · Oneplus · reported by MITREMedium 5.9
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or equal to the given image's. Downgrades can occur even on locked bootloaders and without triggering a factory reset, allowing for exploitation of now-patched vulnerabilities with access to user data. This vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, a physical attacker can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).
- Product
- Oxygenos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalephsecurity.comalephsecurity.com
May 11, 2017An issue was discovered on OnePlus devices such as the 3T.CVE-2016-10370 · Other software · Oneplus · reported by MITREHigh 7.5
An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850, and CVE-2017-8851.
- Product
- Oxygenos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comalephsecurity.com
Apr 25, 2017In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbiCVE-2017-5625 · Other software · Oneplus · reported by MITREMedium 4.6
In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition (except 'keystore') by issuing the 'fastboot oem dump <partition>' fastboot command.
- Product
- Oxygenos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalephsecurity.comalephsecurity.com
Apr 9, 2017Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks.CVE-2015-7265 · Other software · Proxygen Project · reported by cret@cert.orgHigh 7.5
Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comgroups.google.com
Apr 9, 2017The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.CVE-2015-7264 · Other software · Proxygen Project · reported by cret@cert.orgCritical 9.8
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comgroups.google.com
Apr 9, 2017The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value.CVE-2015-7263 · Other software · Proxygen Project · reported by cret@cert.orgHigh 7.5
The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value.
- Product
- Proxygen
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgroups.google.comgroups.google.com
Mar 26, 2017With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled.CVE-2017-5622 · Other software · Oneplus · reported by MITREMedium 5.9
With OxygenOS before 4.0.3, when a charger is connected to a powered-off OnePlus 3 or 3T device, the platform starts with adbd enabled. Therefore, a malicious charger or a physical attacker can open up, without authorization, an ADB session with the device, in order to further exploit other vulnerabilities and/or exfiltrate sensitive information.
- Product
- Oxygenos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comalephsecurity.com
Mar 19, 2017An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices.CVE-2017-5623 · Other software · Oneplus · reported by MITREMedium 6.6
An issue was discovered in OxygenOS before 4.1.0 on OnePlus 3 and 3T devices. The attacker can change the bootmode of the device by issuing the 'fastboot oem boot_mode {rf/wlan/ftm/normal} command' in contradiction to the threat model of Android where the bootloader MUST NOT allow any security-sensitive operation to be run unless the bootloader is unlocked.
- Product
- Oxygenos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comalephsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.