Threats tagged 'exploited-in-the-wild'

1,164 threats

Threats tagged 'exploited-in-the-wild'
Severity	CVSS	Signals	Threat	Source	Published
Critical	9.8	KEVEPSS 99%	CVE-2021-20038SMA 100 Appliances · SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability Critical9.8KEVEPSS 99%2022-01-28CISA KEVCVE-2021-20038 SonicWall SMA 100 Appliances are affected by an unauthenticated stack-based buffer overflow vulnerability (CVE-2021-20038) that can lead to remote code execution. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data. KEVEPSS 99%Vulnerability SonicWall #exploited-in-the-wild	CISA KEV	2022-01-28
Critical	9.8	KEVEPSS 84%	CVE-2020-5722UCM6200 · Grandstream Networks UCM6200 Series SQL Injection Vulnerability Critical9.8KEVEPSS 84%2022-01-28CISA KEVCVE-2020-5722 The Grandstream UCM6200 series devices are vulnerable to an unauthenticated remote SQL injection via crafted HTTP requests. Successful exploitation can lead to code execution with root privileges on the affected device. This vulnerability has been exploited in the wild. KEVEPSS 84%Vulnerability Grandstream #exploited-in-the-wild	CISA KEV	2022-01-28
High	7.8	KEVEPSS 42%	CVE-2020-0787Windows · Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability High7.8KEVEPSS 42%2022-01-28CISA KEVCVE-2020-0787 CVE-2020-0787 is a privilege elevation vulnerability in Microsoft Windows Background Intelligent Transfer Service (BITS) caused by improper handling of symbolic links. Exploitation allows an attacker to execute arbitrary code with system-level privileges. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions are stated in the provided data. KEVEPSS 42%Vulnerability Microsoft #exploited-in-the-wild	CISA KEV	2022-01-28
Critical	9.8	KEVEPSS 92%	CVE-2017-5689Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability · Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability Critical9.8KEVEPSS 92%2022-01-28CISA KEVCVE-2017-5689 CVE-2017-5689 is a privilege escalation vulnerability affecting Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability. This vulnerability allows attackers to elevate their privileges on affected systems. It has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data. KEVEPSS 92%Vulnerability Intel #exploited-in-the-wild	CISA KEV	2022-01-28
Critical	9.8	KEVEPSS 99%	CVE-2014-6271Bourne-Again Shell (Bash) · GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Critical9.8KEVEPSS 99%2022-01-28CISA KEVCVE-2014-6271 CVE-2014-6271 is a high-severity vulnerability in GNU Bash up to version 4.3 that allows remote attackers to execute arbitrary code. This occurs because Bash improperly processes trailing strings after function definitions in environment variable values. The vulnerability has been exploited in the wild. KEVEPSS 99%Vulnerability GNU #exploited-in-the-wild	CISA KEV	2022-01-28
Critical	9.8	KEVEPSS 99%	CVE-2014-7169Bourne-Again Shell (Bash) · GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Critical9.8KEVEPSS 99%2022-01-28CISA KEVCVE-2014-7169 CVE-2014-7169 is a high-severity vulnerability in GNU Bash versions through 4.3 that allows remote attackers to execute arbitrary code by exploiting the way Bash processes trailing strings after function definitions in environment variable values. This vulnerability is a follow-up fix to CVE-2014-6271 and has been exploited in the wild. KEVEPSS 99%Vulnerability GNU #exploited-in-the-wild	CISA KEV	2022-01-28
High	7.5	KEVEPSS 54%	CVE-2006-1547Struts 1 · Apache Struts 1 ActionForm Denial-of-Service Vulnerability High7.5KEVEPSS 54%2022-01-21CISA KEVCVE-2006-1547 Apache Struts 1 versions before 1.2.9 that use BeanUtils 1.7 contain a vulnerability in ActionForm that allows denial-of-service (DoS) attacks. This vulnerability has been exploited in the wild. No explicit patch information is provided in the input data. KEVEPSS 54%Vulnerability Apache #exploited-in-the-wild	CISA KEV	2022-01-21
Critical	9.8	KEVEPSS 75%	CVE-2012-0391Struts 2 · Apache Struts 2 Improper Input Validation Vulnerability Critical9.8KEVEPSS 75%2022-01-21CISA KEVCVE-2012-0391 CVE-2012-0391 is a high severity vulnerability in Apache Struts 2 prior to version 2.2.3.1. It involves improper input validation in the ExceptionDelegator component, which can be exploited remotely to execute arbitrary code. This vulnerability has been exploited in the wild. KEVEPSS 75%Vulnerability Apache #exploited-in-the-wild	CISA KEV	2022-01-21
High	7.8	KEVEPSS 70%	CVE-2018-8453Win32k · Microsoft Win32k Privilege Escalation Vulnerability High7.8KEVEPSS 70%2022-01-21CISA KEVCVE-2018-8453 CVE-2018-8453 is a vulnerability in Microsoft Windows Win32k that allows an attacker to escalate privileges. It has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the input data. KEVEPSS 70%Vulnerability Microsoft #exploited-in-the-wild	CISA KEV	2022-01-21
Medium	4.3	KEVEPSS 3.5%	CVE-2021-35247Serv-U · SolarWinds Serv-U Improper Input Validation Vulnerability Medium4.3KEVEPSS 3.5%2022-01-21CISA KEVCVE-2021-35247 SolarWinds Serv-U versions 15.2.5 and earlier have an improper input validation vulnerability that allows attackers to send unsanitized queries. This vulnerability has been exploited in the wild. No specific patch information is provided in the available data. KEVEPSS 3.5%Vulnerability SolarWinds #exploited-in-the-wild	CISA KEV	2022-01-21
High	8.2	KEVEPSS 90%	CVE-2021-32648October CMS · October CMS Improper Authentication High8.2KEVEPSS 90%2022-01-18CISA KEVCVE-2021-32648 CVE-2021-32648 is an improper authentication vulnerability in affected versions of the october/system package of October CMS. An attacker can request a password reset and then use a specially crafted request to gain unauthorized access to the targeted account. This vulnerability has been exploited in the wild. KEVEPSS 90%Vulnerability #exploited-in-the-wild	CISA KEV	2022-01-18
High	8.8	KEVEPSS 71%	CVE-2021-25296Nagios XI · Nagios XI OS Command Injection High8.8KEVEPSS 71%2022-01-18CISA KEVCVE-2021-25296 Nagios XI contains a vulnerability that allows OS command injection on the server. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data. KEVEPSS 71%Vulnerability Nagios #exploited-in-the-wild	CISA KEV	2022-01-18
High	8.8	KEVEPSS 56%	CVE-2021-25297Nagios XI · Nagios XI OS Command Injection High8.8KEVEPSS 56%2022-01-18CISA KEVCVE-2021-25297 Nagios XI contains a vulnerability identified as CVE-2021-25297 that allows OS command injection on the Nagios XI server. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data. KEVEPSS 56%Vulnerability Nagios #exploited-in-the-wild	CISA KEV	2022-01-18
High	8.8	KEVEPSS 73%	CVE-2021-25298Nagios XI · Nagios XI OS Command Injection High8.8KEVEPSS 73%2022-01-18CISA KEVCVE-2021-25298 Nagios XI contains a vulnerability identified as CVE-2021-25298 that allows OS command injection on the Nagios XI server. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data. KEVEPSS 73%Vulnerability Nagios #exploited-in-the-wild	CISA KEV	2022-01-18
Critical	9.8	KEVEPSS 93%	CVE-2021-40870Aviatrix Controller · Aviatrix Controller Unrestricted Upload of File Critical9.8KEVEPSS 93%2022-01-18CISA KEVCVE-2021-40870 CVE-2021-40870 is a vulnerability in Aviatrix Controller that allows unauthenticated attackers to upload files with dangerous types without restriction. This can lead to arbitrary code execution through directory traversal techniques. The vulnerability has been exploited in the wild and is considered high severity. KEVEPSS 93%Vulnerability Aviatrix #exploited-in-the-wild	CISA KEV	2022-01-18
High	7.3	KEVEPSS 98%	CVE-2021-33766Exchange Server · Microsoft Exchange Server Information Disclosure High7.3KEVEPSS 98%2022-01-18CISA KEVCVE-2021-33766 CVE-2021-33766 is an information disclosure vulnerability in Microsoft Exchange Server that allows an unauthenticated attacker to steal email traffic from the target system. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data. KEVEPSS 98%Vulnerability Microsoft #exploited-in-the-wild	CISA KEV	2022-01-18
Critical	9.8	KEVEPSS 78%	CVE-2021-21975vRealize Operations Manager API · VMware Server Side Request Forgery Critical9.8KEVEPSS 78%2022-01-18CISA KEVCVE-2021-21975 CVE-2021-21975 is a Server Side Request Forgery (SSRF) vulnerability in VMware vRealize Operations Manager API versions prior to 8.4. This flaw allows an attacker with network access to the API to perform SSRF attacks that can lead to theft of administrative credentials. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. KEVEPSS 78%Vulnerability VMware #exploited-in-the-wild	CISA KEV	2022-01-18
High	7.1	KEVEPSS 90%	CVE-2021-21315System Information Library for Node.JS · System Information Library for Node.JS Command Injection High7.1KEVEPSS 90%2022-01-18CISA KEVCVE-2021-21315 CVE-2021-21315 is a command injection vulnerability in the System Information Library for Node.JS. An attacker can exploit the 'name' parameter by sending a malicious payload, resulting in remote code execution. This vulnerability has been exploited in the wild and is considered high severity. KEVEPSS 90%Vulnerability Npm package #exploited-in-the-wild	CISA KEV	2022-01-18
Critical	9.8	KEVEPSS 61%	CVE-2021-22991BIG-IP Traffic Management Microkernel · F5 BIG-IP Traffic Management Microkernel Buffer Overflow Critical9.8KEVEPSS 61%2022-01-18CISA KEVCVE-2021-22991 CVE-2021-22991 is a buffer overflow vulnerability in the Traffic Management Microkernel component of F5 BIG-IP ASM Risk Engine. This flaw allows attackers to bypass URL-based access controls. The vulnerability has been exploited in the wild, indicating active threat activity. No specific affected versions or patch information is provided in the available data. KEVEPSS 61%Vulnerability F5 #exploited-in-the-wild	CISA KEV	2022-01-18
High	7.5	KEVEPSS 97%	CVE-2020-14864Intelligence Enterprise Edition · Oracle Business Intelligence Enterprise Edition Path Transversal High7.5KEVEPSS 97%2022-01-18CISA KEVCVE-2020-14864 CVE-2020-14864 is a path traversal vulnerability in Oracle Business Intelligence Enterprise Edition. It allows an attacker to exploit the preview FilePath parameter in the getPreviewImage function to access arbitrary system files. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided. KEVEPSS 97%Vulnerability Oracle #exploited-in-the-wild	CISA KEV	2022-01-18

Showing 821–840 of 1,164 results