Threats Tagged 'exploited-in-the-wild'

D-Link DCS-2530L and DCS-2670L devices have a command injection vulnerability in the cgi-bin/ddns_enc.cgi component. This vulnerability allows attackers to execute arbitrary commands on affected devices. The impacted products may be end-of-life or end-of-service, and users are advised to discontinue use. Exploitation of this vulnerability has been observed in the wild.

PHPMailer contains a command injection vulnerability in its mail() function due to improper sanitization of user input. This flaw allows attackers to execute arbitrary code within the application context. Unsuccessful exploitation attempts can cause denial-of-service conditions. The vulnerability has been exploited in the wild.

Multi-Router Looking Glass (MRLG) has a buffer overflow vulnerability (CVE-2014-3931) that allows remote attackers to perform arbitrary memory writes and cause memory corruption. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2019-9621 is a server-side request forgery (SSRF) vulnerability in the ProxyServlet component of Synacor Zimbra Collaboration Suite (ZCS). This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.

CVE-2019-5418 is a path traversal vulnerability in Ruby on Rails' Action View component. It allows specially crafted Accept headers combined with calls to `render file:` to cause arbitrary files on the server to be rendered, potentially disclosing their contents. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.

CVE-2019-6693 is a vulnerability in Fortinet FortiOS involving the use of hard-coded credentials. This flaw allows an attacker who knows the hard-coded key to decipher sensitive data contained in FortiOS configuration backup files. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the available data.

CVE-2019-9875 is a deserialization vulnerability in Sitecore CMS and Experience Platform (XP) within the Sitecore.Security.AntiCSRF module. It allows an authenticated attacker to execute arbitrary code by sending a malicious serialized .NET object in the HTTP POST parameter __CSRFTOKEN. This vulnerability has been exploited in the wild and is considered high severity.

The reviewdog action-setup GitHub Action contains an embedded malicious code vulnerability that causes exposed secrets to be dumped into GitHub Actions Workflow Logs. This vulnerability has been exploited in the wild, posing a high risk of secret leakage during automated workflows.

CVE-2017-12637 is a directory traversal vulnerability in SAP NetWeaver Application Server Java. It allows remote attackers to read arbitrary files by exploiting a '..' (dot dot) sequence in the query string of a specific JavaScript resource. This vulnerability has been exploited in the wild and is considered high severity.

CVE-2022-43769 is a special element injection vulnerability in Hitachi Vantara Pentaho Business Analytics (BA) Server. It allows attackers to inject Spring templates into properties files, leading to arbitrary command execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2022-43939 is an authorization bypass vulnerability in Hitachi Vantara Pentaho Business Analytics (BA) Server caused by the use of non-canonical URL paths in authorization decisions. This flaw allows attackers to bypass authorization controls. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

Sophos XG Firewall has a buffer overflow vulnerability in its HTTP/S bookmark feature that enables remote code execution. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided.

CyberoamOS (CROS) contains a SQL injection vulnerability in its WebAdmin interface that allows unauthenticated remote attackers to execute arbitrary SQL commands. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. The vulnerability is classified as high severity due to its potential impact on system integrity and confidentiality.

CVE-2022-23748 is a process control vulnerability in the Dante Discovery application, specifically in the mDNSResponder.exe component. This flaw allows a local attacker to perform a DLL sideloading attack, enabling arbitrary code execution. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information are provided.

Paessler PRTG Network Monitor has a local file inclusion vulnerability (CVE-2018-19410) that enables a remote, unauthenticated attacker to create users with read-write privileges, including administrator access. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

CVE-2018-9276 is an OS command injection vulnerability in Paessler PRTG Network Monitor that allows attackers with administrative privileges to execute arbitrary operating system commands via the PRTG System Administrator web console. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

JQuery contains a persistent cross-site scripting (XSS) vulnerability that allows execution of untrusted code in the user's browser when maliciously formed input enclosed in HTML tags is processed by JQuery's DOM manipulators. This vulnerability has been exploited in the wild and is considered high severity.

CVE-2020-2883 is an unspecified vulnerability in Oracle WebLogic Server that can be exploited by unauthenticated attackers with network access via IIOP or T3 protocols. The vulnerability is known to be exploited in the wild. Oracle has released security patches addressing this and other vulnerabilities in their April 2020 Critical Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.

Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that can enable an attacker to achieve remote code execution on the affected system. Exploitation requires obtaining the MachineKey through another vulnerability or channel. This vulnerability is known to be exploited in the wild and is classified as high severity.

The Reolink RLC-410W IP camera has an authenticated OS command injection vulnerability in its network settings functionality. This vulnerability allows an attacker with valid credentials to execute arbitrary operating system commands on the device. It has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided.