Threat database

CVE-2021-27876 is a high-severity file access vulnerability in the Veritas Backup Exec Agent. It allows attackers to craft specific input parameters in a data management protocol command to access files on the Backup Exec Agent machine. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.

CVE-2021-27878 is a command execution vulnerability in the Veritas Backup Exec Agent. It allows an attacker to execute arbitrary commands on the Backup Exec Agent machine by leveraging a data management protocol command. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. The vulnerability is rated as high severity due to its potential impact on system control.

CVE-2022-27926 is a high-severity cross-site scripting (XSS) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). The vulnerability arises because an endpoint URL accepts parameters without proper sanitization, allowing malicious scripts to be injected. This flaw has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2022-3038 is a use-after-free vulnerability in the Google Chromium Network Service that allows remote attackers to potentially cause heap corruption by crafting a malicious HTML page. This vulnerability affects multiple Chromium-based web browsers such as Google Chrome, Microsoft Edge, and Opera. It has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2021-30900 is an out-of-bounds write vulnerability in Apple GPU drivers affecting iOS, iPadOS, and macOS. This flaw may allow a malicious application to execute code with kernel privileges. The vulnerability has been exploited in the wild. Vendor advisories linked are unavailable, and no patch information is confirmed from the provided data.

CVE-2022-39197 is a high-severity cross-site scripting (XSS) vulnerability in Fortra Cobalt Strike's Teamserver component. It allows an attacker to set a malformed username in the Beacon configuration, enabling remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

CVE-2022-38181 is a use-after-free vulnerability in the Arm Mali GPU Kernel Driver. This flaw may allow a non-privileged user to gain root privileges or disclose sensitive information. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-22706 is a high-severity vulnerability in the Arm Mali GPU Kernel Driver that allows a non-privileged user to gain write access to read-only memory pages. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

CVE-2017-7494 is a remote code execution vulnerability in Samba that allows a malicious client to upload a shared library to a writable share and trigger the server to load and execute it. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. It poses a high risk due to the ability to execute arbitrary code remotely on affected systems.

Microsoft Internet Explorer has a memory corruption vulnerability (CVE-2013-3163) that can be exploited by remote attackers through crafted websites to execute arbitrary code or cause a denial of service. This vulnerability has been observed in the wild and is considered high severity.

CVE-2022-42948 is a high-severity remote code execution vulnerability in the Fortra Cobalt Strike User Interface. The flaw is rooted in Java Swing components and allows remote attackers to execute arbitrary code. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2022-41328 is a path traversal vulnerability in Fortinet FortiOS that allows a local privileged attacker to read and write arbitrary files using crafted CLI commands. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

CVE-2023-23397 is a critical privilege escalation vulnerability in Microsoft Office Outlook that enables an NTLM Relay attack, allowing an attacker to authenticate as the user to another service without user interaction. This vulnerability has been exploited in the wild and carries a high impact on confidentiality, integrity, and availability.

CVE-2020-5741 is a remote code execution vulnerability in Plex Media Server. It allows an attacker who has access to the server administrator's Plex account to upload a malicious file through the Camera Upload feature, which the media server then executes. This vulnerability has been exploited in the wild.

CVE-2021-39144 is a remote code execution vulnerability in XStream that allows attackers to manipulate input streams to inject or replace objects, leading to execution of local commands on the server. This flaw affects multiple products, including VMware Cloud Foundation. It has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

Teclib GLPI contains a remote code execution vulnerability due to a flaw in the third-party library htmlawed. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.

Apache Spark contains a command injection vulnerability in its User Interface (UI) when Access Control Lists (ACLs) are enabled. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided in the available data.

CVE-2022-28810 is a high-severity vulnerability in Zoho ManageEngine ADSelfService Plus that allows remote code execution during password change or reset operations. The vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-36537 is a high-severity vulnerability in the ZK Framework AuUploader servlets that allows an attacker to retrieve the content of files located within the web context. This unspecified vulnerability affects multiple products using the ZK Framework, including ConnectWise R1Soft Server Backup Manager. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.

CVE-2022-41223 is a code injection vulnerability in the Director component of Mitel MiVoice Connect. It allows an authenticated attacker with internal network access to execute arbitrary code within the application context. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.