Threats Tagged 'exploited-in-the-wild'

CVE-2023-27351 is an improper authentication vulnerability in PaperCut NG/MF that allows remote attackers to bypass authentication via the SecurityRequestFilter class. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided.

Microsoft Office Excel contains a remote code execution vulnerability (CVE-2009-0238) that allows an attacker to take complete control of an affected system if a user opens a specially crafted Excel file containing a malformed object. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability (CVE-2012-1854) that could allow remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2023-21529 is a deserialization vulnerability in Microsoft Exchange Server that allows an authenticated attacker to execute remote code. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

Laravel Livewire contains a code injection vulnerability that can allow unauthenticated attackers to execute remote commands under specific conditions. This vulnerability is identified as CVE-2025-54068 and has been exploited in the wild. No specific affected versions or patches are currently provided. The severity is assessed as high due to the potential for remote code execution.

CVE-2021-22054 is a server-side request forgery (SSRF) vulnerability in Omnissa Workspace One UEM (formerly VMware Workspace One UEM). It allows a malicious actor with network access to the UEM to send unauthorized requests and potentially access sensitive information. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

Multiple Hikvision products have an improper authentication vulnerability that allows malicious users to escalate privileges and access sensitive information. This vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided.

Multiple Rockwell products have a vulnerability involving insufficiently protected credentials. Specifically, Studio 5000 Logix Designer software may expose a key used to verify communication with Logix controllers. Exploiting this vulnerability could allow unauthorized applications to connect to Logix controllers if the attacker has network access. This vulnerability has been exploited in the wild.

An integer overflow or wraparound vulnerability exists in multiple Apple products including tvOS, macOS, Safari, iPadOS, and watchOS. This flaw arises from the processing of maliciously crafted web content and may allow an attacker to execute arbitrary code. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-20775 is a path traversal vulnerability in the Cisco SD-WAN CLI that allows an authenticated local attacker to bypass access controls and gain elevated privileges. Exploitation can lead to arbitrary command execution as the root user. This vulnerability has been observed exploited in the wild.

GitLab contains a server-side request forgery (SSRF) vulnerability that affects the handling of requests to the internal network when webhooks are enabled. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided in the available data.

CVE-2020-7796 is a server-side request forgery (SSRF) vulnerability in Synacor Zimbra Collaboration Suite (ZCS) that occurs if the WebEx zimlet is installed and the zimlet JSP is enabled. This vulnerability has been exploited in the wild and is considered high severity.

CVE-2008-0015 is a remote code execution vulnerability in the Microsoft Windows Video ActiveX Control. An attacker can exploit this by crafting a malicious web page that, when viewed by a user, allows the attacker to execute code with the same privileges as the logged-on user. This vulnerability has been exploited in the wild.

Notepad++ contains a vulnerability in its WinGUp updater where code is downloaded without an integrity check. This flaw allows attackers to intercept or redirect update traffic to deliver and execute malicious installers with the user's privileges. The vulnerability has been exploited in the wild and is considered high severity.

GitLab Community and Enterprise Editions have a server-side request forgery (SSRF) vulnerability in the CI Lint API that allows unauthorized external users to perform SSRF attacks. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.

CVE-2019-19006 is an improper authentication vulnerability in Sangoma FreePBX that allows unauthorized users to bypass password authentication and access administrative services. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

CVE-2018-14634 is an integer overflow vulnerability in the Linux Kernel's create_elf_tables() function. This flaw allows an unprivileged local user with access to a SUID or otherwise privileged binary to escalate their privileges on the affected system. The vulnerability has been exploited in the wild. Red Hat issued an important security advisory providing patches for Red Hat Enterprise Linux 7.4 Extended Update Support to address this and related kernel vulnerabilities. Systems must be rebooted after applying the update for the fix to take effect.

Microsoft Office PowerPoint contains a code injection vulnerability (CVE-2009-0556) that allows remote attackers to execute arbitrary code via a specially crafted PowerPoint file. The vulnerability is triggered by an OutlineTextRefAtom with an invalid index value causing memory corruption. This vulnerability has been exploited in the wild.

CVE-2018-4063 is a vulnerability in Sierra Wireless AirLink ALEOS that allows an authenticated attacker to upload files with dangerous types via a specially crafted HTTP request. This can lead to executable code being uploaded and accessible on the webserver. The affected product may be end-of-life or end-of-service, and users are advised to discontinue its use.

A buffer overflow vulnerability (CWE-120) exists in D-Link routers, impacting confidentiality, integrity, and availability. The affected products may be end-of-life or end-of-service, and exploitation is known to occur in the wild. Users are advised to discontinue use of the affected devices.