SonicWall SMA 100 Appliances are affected by an unauthenticated stack-based buffer overflow vulnerability (CVE-2021-20038) that can lead to remote code execution. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
The Grandstream UCM6200 series devices are vulnerable to an unauthenticated remote SQL injection via crafted HTTP requests. Successful exploitation can lead to code execution with root privileges on the affected device. This vulnerability has been exploited in the wild.
CVE-2020-0787 is a privilege elevation vulnerability in Microsoft Windows Background Intelligent Transfer Service (BITS) caused by improper handling of symbolic links. Exploitation allows an attacker to execute arbitrary code with system-level privileges. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions are stated in the provided data.
CVE-2017-5689 is a privilege escalation vulnerability affecting Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability. This vulnerability allows attackers to elevate their privileges on affected systems. It has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.
CVE-2014-6271 is a high-severity vulnerability in GNU Bash up to version 4.3 that allows remote attackers to execute arbitrary code. This occurs because Bash improperly processes trailing strings after function definitions in environment variable values. The vulnerability has been exploited in the wild.
CVE-2014-7169 is a high-severity vulnerability in GNU Bash versions through 4.3 that allows remote attackers to execute arbitrary code by exploiting the way Bash processes trailing strings after function definitions in environment variable values. This vulnerability is a follow-up fix to CVE-2014-6271 and has been exploited in the wild.
Apache Struts 1 versions before 1.2.9 that use BeanUtils 1.7 contain a vulnerability in ActionForm that allows denial-of-service (DoS) attacks. This vulnerability has been exploited in the wild. No explicit patch information is provided in the input data.
CVE-2012-0391 is a high severity vulnerability in Apache Struts 2 prior to version 2.2.3.1. It involves improper input validation in the ExceptionDelegator component, which can be exploited remotely to execute arbitrary code. This vulnerability has been exploited in the wild.
CVE-2018-8453 is a vulnerability in Microsoft Windows Win32k that allows an attacker to escalate privileges. It has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the input data.
SolarWinds Serv-U versions 15.2.5 and earlier have an improper input validation vulnerability that allows attackers to send unsanitized queries. This vulnerability has been exploited in the wild. No specific patch information is provided in the available data.
CVE-2021-32648 is an improper authentication vulnerability in affected versions of the october/system package of October CMS. An attacker can request a password reset and then use a specially crafted request to gain unauthorized access to the targeted account. This vulnerability has been exploited in the wild.
Nagios XI contains a vulnerability that allows OS command injection on the server. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.
Nagios XI contains a vulnerability identified as CVE-2021-25297 that allows OS command injection on the Nagios XI server. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.
Nagios XI contains a vulnerability identified as CVE-2021-25298 that allows OS command injection on the Nagios XI server. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.
CVE-2021-40870 is a vulnerability in Aviatrix Controller that allows unauthenticated attackers to upload files with dangerous types without restriction. This can lead to arbitrary code execution through directory traversal techniques. The vulnerability has been exploited in the wild and is considered high severity.
CVE-2021-33766 is an information disclosure vulnerability in Microsoft Exchange Server that allows an unauthenticated attacker to steal email traffic from the target system. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2021-21975 is a Server Side Request Forgery (SSRF) vulnerability in VMware vRealize Operations Manager API versions prior to 8.4. This flaw allows an attacker with network access to the API to perform SSRF attacks that can lead to theft of administrative credentials. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
CVE-2021-21315 is a command injection vulnerability in the System Information Library for Node.JS. An attacker can exploit the 'name' parameter by sending a malicious payload, resulting in remote code execution. This vulnerability has been exploited in the wild and is considered high severity.
CVE-2021-22991 is a buffer overflow vulnerability in the Traffic Management Microkernel component of F5 BIG-IP ASM Risk Engine. This flaw allows attackers to bypass URL-based access controls. The vulnerability has been exploited in the wild, indicating active threat activity. No specific affected versions or patch information is provided in the available data.
CVE-2020-14864 is a path traversal vulnerability in Oracle Business Intelligence Enterprise Edition. It allows an attacker to exploit the preview FilePath parameter in the getPreviewImage function to access arbitrary system files. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.