Threat database

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVE-2021-27876 is a high-severity file access vulnerability in the Veritas Backup Exec Agent. It allows attackers to craft specific input parameters in a data management protocol command to access files on the Backup Exec Agent machine. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.

CVE-2021-27877 is an improper authentication vulnerability in the Veritas Backup Exec Agent. It allows unauthorized attackers to gain access to the Backup Exec Agent by exploiting weaknesses in the SHA authentication scheme. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the available data.

CVE-2021-27878 is a command execution vulnerability in the Veritas Backup Exec Agent. It allows an attacker to execute arbitrary commands on the Backup Exec Agent machine by leveraging a data management protocol command. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. The vulnerability is rated as high severity due to its potential impact on system control.

CVE-2019-1388 is a privilege escalation vulnerability in the Microsoft Windows Certificate Dialog that allows attackers to execute processes with elevated privileges. It has been exploited in the wild and is known to have been used in ransomware campaigns. The vulnerability affects Microsoft Windows but specific affected versions are not provided. The severity is assessed as high due to the potential impact of privilege escalation.

Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

CVE-2022-27926 is a high-severity cross-site scripting (XSS) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). The vulnerability arises because an endpoint URL accepts parameters without proper sanitization, allowing malicious scripts to be injected. This flaw has been exploited in the wild. No specific affected versions or patch information is provided.

Microsoft Internet Explorer has a memory corruption vulnerability (CVE-2013-3163) that can be exploited by remote attackers through crafted websites to execute arbitrary code or cause a denial of service. This vulnerability has been observed in the wild and is considered high severity.

CVE-2017-7494 is a remote code execution vulnerability in Samba that allows a malicious client to upload a shared library to a writable share and trigger the server to load and execute it. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. It poses a high risk due to the ability to execute arbitrary code remotely on affected systems.

CVE-2022-42948 is a high-severity remote code execution vulnerability in the Fortra Cobalt Strike User Interface. The flaw is rooted in Java Swing components and allows remote attackers to execute arbitrary code. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2022-39197 is a high-severity cross-site scripting (XSS) vulnerability in Fortra Cobalt Strike's Teamserver component. It allows an attacker to set a malformed username in the Beacon configuration, enabling remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

CVE-2021-30900 is an out-of-bounds write vulnerability in Apple GPU drivers affecting iOS, iPadOS, and macOS. This flaw may allow a malicious application to execute code with kernel privileges. The vulnerability has been exploited in the wild. Vendor advisories linked are unavailable, and no patch information is confirmed from the provided data.

CVE-2022-38181 is a use-after-free vulnerability in the Arm Mali GPU Kernel Driver. This flaw may allow a non-privileged user to gain root privileges or disclose sensitive information. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-3038 is a use-after-free vulnerability in the Google Chromium Network Service that allows remote attackers to potentially cause heap corruption by crafting a malicious HTML page. This vulnerability affects multiple Chromium-based web browsers such as Google Chrome, Microsoft Edge, and Opera. It has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-22706 is a high-severity vulnerability in the Arm Mali GPU Kernel Driver that allows a non-privileged user to gain write access to read-only memory pages. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.