Threats Tagged 'exploited-in-the-wild'

CVE-2021-39144 is a remote code execution vulnerability in XStream that allows attackers to manipulate input streams to inject or replace objects, leading to execution of local commands on the server. This flaw affects multiple products, including VMware Cloud Foundation. It has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

CVE-2020-5741 is a remote code execution vulnerability in Plex Media Server. It allows an attacker who has access to the server administrator's Plex account to upload a malicious file through the Camera Upload feature, which the media server then executes. This vulnerability has been exploited in the wild.

CVE-2022-28810 is a high-severity vulnerability in Zoho ManageEngine ADSelfService Plus that allows remote code execution during password change or reset operations. The vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.

Apache Spark contains a command injection vulnerability in its User Interface (UI) when Access Control Lists (ACLs) are enabled. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided in the available data.

Teclib GLPI contains a remote code execution vulnerability due to a flaw in the third-party library htmlawed. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.

CVE-2022-36537 is a high-severity vulnerability in the ZK Framework AuUploader servlets that allows an attacker to retrieve the content of files located within the web context. This unspecified vulnerability affects multiple products using the ZK Framework, including ConnectWise R1Soft Server Backup Manager. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.

IBM Aspera Faspex contains a high-severity vulnerability (CVE-2022-47986) due to a YAML deserialization flaw that allows remote code execution. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information are provided in the available data.

CVE-2022-41223 is a code injection vulnerability in the Director component of Mitel MiVoice Connect. It allows an authenticated attacker with internal network access to execute arbitrary code within the application context. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

CVE-2022-40765 is a command injection vulnerability in the Mitel Edge Gateway component of MiVoice Connect. It allows an authenticated attacker with internal network access to execute arbitrary commands on the system. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided.

Cacti contains a command injection vulnerability (CVE-2022-46169) that allows an unauthenticated attacker to execute arbitrary code on the affected system. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

CVE-2015-2291 is a high-severity denial-of-service vulnerability in Intel Ethernet Diagnostics Driver for Windows (IQVW32.sys and IQVW64.sys). The vulnerability allows an attacker to cause a denial-of-service condition. It has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided.

TerraMaster OS has a remote command execution vulnerability (CVE-2022-24990) that allows unauthenticated attackers to execute arbitrary commands on affected devices. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided.

CVE-2022-21587 is an unspecified vulnerability in Oracle E-Business Suite that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. Oracle has released security patches addressing this and other vulnerabilities in their October 2022 Critical Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.

CVE-2017-11357 is an insecure direct object reference vulnerability in Telerik UI for ASP.NET AJAX's RadAsyncUpload component. This flaw can allow attackers to upload files to restricted locations, potentially leading to remote code execution. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

CWP Control Web Panel (formerly CentOS Web Panel) has an OS command injection vulnerability that enables remote attackers to execute arbitrary commands via shell metacharacters in the login parameter. This vulnerability is known to be exploited in the wild and is considered high severity.

CVE-2022-41080 is a privilege escalation vulnerability in Microsoft Exchange Server. It can be combined with CVE-2022-41082, which allows remote code execution, to facilitate more severe attacks. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the available data.

CVE-2018-5430 is a vulnerability in TIBCO JasperReports Server that allows any authenticated user to gain read-only access to the web application's contents, including important configuration files. This information disclosure flaw has been exploited in the wild and is considered high severity.

CVE-2018-18809 is a directory traversal vulnerability in TIBCO JasperReports Library that allows web server users to access arbitrary files on the host system. This vulnerability has been exploited in the wild and is considered high severity due to the potential exposure of sensitive system files.

Apple iOS contains a type confusion vulnerability (CVE-2022-42856) that can be triggered by processing maliciously crafted web content, potentially allowing code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

Fortinet FortiOS SSL-VPN contains a heap-based buffer overflow vulnerability that allows unauthenticated remote attackers to execute arbitrary code or commands. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the available data.