Threats Tagged 'exploited-in-the-wild'

Sunhillo SureLine contains an OS command injection vulnerability in the /cgi/networkDiag.cgi endpoint. This flaw allows attackers to inject shell metacharacters via the ipAddr or dnsAddr parameters, potentially causing denial-of-service or enabling persistent unauthorized access on the network. The vulnerability is known to be exploited in the wild. No specific affected versions or patches are provided in the available data.

Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.

ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.

CVE-2020-3259 is an information disclosure vulnerability in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) affecting certain AnyConnect and WebVPN configurations. The flaw allows an attacker to retrieve memory contents due to a buffer tracking issue when parsing invalid URLs via the web services interface. This could lead to exposure of confidential information. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.

Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.

Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.

Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication.

CVE-2018-15133 is a high-severity vulnerability in the Laravel Framework involving deserialization of untrusted data. It allows remote command execution but requires that an attacker has access to the application's encryption key (APP_KEY). This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.

D-Link DSL-2750B devices have a command injection vulnerability that permits remote, unauthenticated attackers to execute arbitrary commands via the login.cgi cli parameter. This vulnerability is known to be exploited in the wild, posing a significant risk to affected devices.

Multiple Qualcomm chipsets have a use-after-free vulnerability triggered during process initialization when shell memory is freed via an IOCTL munmap call. This vulnerability has been exploited in the wild and is rated as high severity.

GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.

CVE-2020-2551 is an unspecified vulnerability in Oracle Fusion Middleware's WebLogic Server core components. It allows an unauthenticated attacker with network access via the IIOP protocol to compromise the WebLogic Server. The vulnerability has been exploited in the wild. Oracle released patches for this and other vulnerabilities in their January 2020 Critical Patch Update and strongly recommends applying these patches promptly.

Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.

Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.

Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.

Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.

F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.