Threat database

CVE-2024-38112 is a spoofing vulnerability in the Microsoft Windows MSHTML Platform that impacts confidentiality, integrity, and availability. It has a high severity with a CVSS score of 7.5 and is known to be exploited in the wild. The vulnerability requires user interaction and has a high attack complexity. No specific affected versions or patch information is provided in the available data.

CVE-2024-38080 is a privilege escalation vulnerability in Microsoft Windows Hyper-V that allows a local attacker with user-level permissions to gain SYSTEM privileges. It has a high severity score of 7.8 and has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2020-13965 is a high-severity cross-site scripting (XSS) vulnerability in Roundcube Webmail. It allows a remote attacker to manipulate data by sending a malicious XML attachment. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-2586 is a use-after-free vulnerability in the Linux Kernel's nft_object component that allows local attackers to escalate privileges. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

OSGeo GeoServer JAI-EXT contains a code injection vulnerability (CVE-2022-24816) that can lead to remote code execution when Jiffle scripts are accepted via network requests in programs using jt-jiffle. This vulnerability has been exploited in the wild and is considered high severity.

CVE-2024-26169 is a high-severity vulnerability in the Microsoft Windows Error Reporting Service that allows a local attacker with user-level permissions to escalate privileges to SYSTEM level. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. It involves improper privilege management, enabling unauthorized privilege escalation without user interaction.

CVE-2017-3506 is an OS command injection vulnerability in Oracle WebLogic Server, part of the Fusion Middleware suite. It allows attackers to execute arbitrary code by sending a specially crafted HTTP request containing a malicious XML document. This vulnerability has been exploited in the wild. Oracle released patches for affected versions as part of their April 2017 Critical Patch Update and strongly recommends applying these patches promptly.

CVE-2024-24919 is an information disclosure vulnerability in Check Point Quantum Security Gateways and related product lines. It allows attackers to access sensitive information on gateways connected to the internet with IPSec VPN, Remote Access VPN, or Mobile Access enabled. The vulnerability has a high severity score of 8.6 and has been exploited in the wild, including use in ransomware campaigns.

Apache Flink contains an improper access control vulnerability (CVE-2020-17519) that allows an attacker to read any file on the local filesystem of the JobManager via its REST interface. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

The D-Link DIR-600 router is affected by a cross-site request forgery (CSRF) vulnerability that enables attackers to change router configurations by hijacking an active administrator session. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

The D-Link DIR-605 router has an information disclosure vulnerability (CVE-2021-40655) that allows attackers to obtain a username and password by sending a forged POST request to the /getcfg.php page. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2024-30040 is a high-severity security feature bypass vulnerability in the Microsoft Windows MSHTML Platform. It allows attackers to bypass security features, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2024-30051 is a high-severity privilege escalation vulnerability in the Microsoft DWM Core Library that allows an attacker with limited privileges to gain SYSTEM-level privileges. It has been exploited in the wild and is known to be used in ransomware campaigns. The vulnerability has a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No specific affected versions or patch information is provided in the available data.

GitLab Community and Enterprise Editions have an improper access control vulnerability that allows attackers to trigger password reset emails to unverified email addresses. This flaw can be exploited to facilitate account takeover. The vulnerability is critical with a CVSS score of 10 and has been observed exploited in the wild.

CVE-2024-29988 is a high-severity security feature bypass vulnerability in Microsoft SmartScreen Prompt that allows attackers to bypass the Mark of the Web (MotW) protection. This vulnerability can be exploited in combination with other vulnerabilities (CVE-2023-38831 and CVE-2024-21412) to execute malicious files. It has been observed exploited in the wild. No specific affected versions or patch information is provided.

CVE-2024-4040 is a high-severity vulnerability in CrushFTP that allows a remote attacker to escape the virtual file system (VFS) sandbox. This sandbox escape enables the attacker to potentially access or manipulate files outside the intended restricted environment. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

CVE-2022-38028 is a privilege escalation vulnerability in the Microsoft Windows Print Spooler service. It allows an attacker to modify a JavaScript constraints file and execute it with SYSTEM-level permissions. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

CVE-2024-3400 is a critical command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect feature. It allows an unauthenticated attacker to execute arbitrary commands with root privileges on the firewall. The vulnerability has a CVSS score of 10.0 and is known to be exploited in the wild, including use in ransomware campaigns.

CVE-2021-44529 is a code injection vulnerability in Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) that allows unauthenticated users to execute malicious code with limited permissions. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. The flaw involves CWE-94, indicating improper control of code injection. No specific affected versions or patch information is provided.

The Nice Linear eMerge E3-Series product contains an OS command injection vulnerability (CVE-2019-7256) that enables remote code execution by an attacker. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.