Threats Tagged 'exploited-in-the-wild'

Microsoft Defender SmartScreen has a security feature bypass vulnerability (CVE-2022-44698) that allows attackers to evade Mark of the Web (MOTW) protections using specially crafted malicious files. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided.

CVE-2022-27518 is an authentication bypass vulnerability in Citrix Application Delivery Controller (ADC) and Gateway when configured with SAML SP or IdP. This flaw allows attackers to bypass authentication and execute code with administrator privileges. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

CVE-2022-26500 is a remote code execution vulnerability in Veeam Backup & Replication's Distribution Service. It allows unauthenticated attackers to access internal API functions and potentially upload and execute malicious code remotely. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.

CVE-2022-26501 is a remote code execution vulnerability in Veeam Backup & Replication's Distribution Service. It allows unauthenticated attackers to access internal API functions and potentially upload and execute malicious code remotely. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

CVE-2022-4262 is a type confusion vulnerability in the Google Chromium V8 JavaScript engine that can be exploited remotely via a crafted HTML page. This flaw may lead to heap corruption and affects multiple Chromium-based browsers such as Google Chrome, Microsoft Edge, and Opera. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2021-35587 is a high severity vulnerability in Oracle Fusion Middleware Access Manager that allows an unauthenticated attacker with network access via HTTP to take over the Access Manager product. This vulnerability has been exploited in the wild. Oracle has released patches addressing this and other vulnerabilities in their January 2022 Critical Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.

CVE-2022-4135 is a heap buffer overflow vulnerability in the Google Chromium GPU component. It allows a remote attacker who has compromised the renderer process to potentially escape the sandbox by using a crafted HTML page. This vulnerability affects multiple Chromium-based browsers such as Google Chrome, Microsoft Edge, and Opera. Exploitation in the wild has been observed. No specific affected versions or patch information is provided.

CVE-2022-41049 is a security feature bypass vulnerability in Microsoft Windows Mark of the Web (MOTW) that results in a limited loss of integrity and availability of security features. It has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2022-41091 is a security feature bypass vulnerability in Microsoft Windows Mark of the Web (MOTW) that results in a limited loss of integrity and availability of security features. It has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

CVE-2022-41073 is a high-severity privilege escalation vulnerability in the Microsoft Windows Print Spooler service. It allows an attacker to gain SYSTEM-level privileges. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

CVE-2022-41125 is a high-severity privilege escalation vulnerability in the Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service. It allows an attacker to gain SYSTEM-level privileges. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Samsung mobile devices have an improper access control vulnerability in the clipboard service that allows untrusted applications to read or write arbitrary files. This vulnerability has been exploited in the wild and was chained with other vulnerabilities (CVE-2021-25369 and CVE-2021-25370). No specific affected versions or patch information is provided.

CVE-2021-25369 is an improper access control vulnerability in Samsung mobile devices using Mali GPUs. It involves the sec_log file, where exploitation allows exposure of sensitive kernel information to userspace. This vulnerability has been exploited in the wild and was chained with CVE-2021-25337 and CVE-2021-25370. No specific affected versions or patch information is provided.

CVE-2021-25370 is a memory corruption vulnerability in Samsung mobile devices using the Mali GPU. It arises from an incorrect handling of file descriptors in the dpu driver, which can cause memory corruption and lead to a kernel panic. This vulnerability has been exploited in the wild and was chained with other vulnerabilities (CVE-2021-25337 and CVE-2021-25369).

Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.

CVE-2022-3723 is a high-severity type confusion vulnerability in the Google Chromium V8 JavaScript engine. It allows a remote attacker to potentially cause heap corruption by crafting a malicious HTML page. This vulnerability affects multiple Chromium-based web browsers, including Google Chrome, Microsoft Edge, and Opera. Exploits for this vulnerability have been observed in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-42827 is an out-of-bounds write vulnerability in the Apple iOS and iPadOS kernel that allows an application to execute code with kernel privileges. This vulnerability has been exploited in the wild. It affects Apple iOS and iPadOS but specific affected versions are not provided. The severity is high due to the potential for privilege escalation to kernel level.

CVE-2020-3433 is a DLL hijacking vulnerability in Cisco AnyConnect Secure Mobility Client for Windows. The vulnerability arises from insufficient validation of resources loaded at runtime via the interprocess communication channel. An attacker with valid Windows credentials could exploit this flaw to execute code with SYSTEM privileges on the affected machine. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

CVE-2020-3153 is a vulnerability in Cisco AnyConnect Secure Mobility Client for Windows involving improper handling of directory paths. An attacker with valid Windows credentials can exploit this flaw to copy malicious files to arbitrary locations with system-level privileges, enabling attacks such as DLL pre-loading and DLL hijacking. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.

Multiple GIGABYTE products including GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU contain low-level driver vulnerabilities that allow local attackers to read and write arbitrary physical memory. This flaw enables privilege escalation on affected systems. The vulnerability is known to be exploited in the wild and has been used in ransomware campaigns.