CVE-2020-13671 is a vulnerability in Drupal core involving improper sanitization of extension file names, which can lead to un-restricted file uploads. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided in the available data.
CVE-2020-11978 is a remote command injection vulnerability found in an example DAG shipped with Apache Airflow. This flaw allows an attacker to execute arbitrary commands remotely via the vulnerable DAG. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.
CVE-2020-13927 is a vulnerability in Apache Airflow's Experimental API where the default configuration allowed all API requests without requiring authentication. This authentication bypass flaw could enable unauthorized users to access the API. The issue has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2021-22017 is a high-severity vulnerability in VMware vCenter Server involving improper access control due to flawed URI normalization in the rhttproxy component. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2021-36260 is a command injection vulnerability affecting the web server component of certain Hikvision security cameras. The flaw arises from insufficient input validation, allowing attackers to execute arbitrary commands on the affected device. This vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.
CVE-2020-6572 is a use-after-free vulnerability in Google Chrome Media that allows remote attackers to execute arbitrary code via a crafted HTML page. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.
CVE-2019-1458 is a high-severity privilege escalation vulnerability in the Microsoft Windows Win32k component. It arises from improper handling of objects in memory, allowing attackers to elevate privileges. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2013-3900 is a remote code execution vulnerability in Microsoft Windows affecting the WinVerifyTrust function, which improperly handles Authenticode signature verification for PE files. This flaw can allow attackers to execute arbitrary code remotely. It has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
CVE-2019-2725 is an injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware, specifically affecting the Web Services subcomponent. It has been exploited in the wild and is known to have been used in ransomware campaigns. The vulnerability is rated as high severity. No specific affected versions or patch information is provided in the available data.
CVE-2019-9670 is an XML External Entity (XXE) vulnerability in the mailboxd component of Synacor Zimbra Collaboration Suite (ZCS). This vulnerability allows improper restriction of XML external entity references, which can be exploited to access unauthorized data or cause denial of service. It has been exploited in the wild and is considered high severity.
CVE-2018-13382 is an improper authorization vulnerability in Fortinet FortiOS and FortiProxy SSL VPN web portal that allows an unauthenticated attacker to modify user passwords. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the input data.
CVE-2018-13383 is a heap buffer overflow vulnerability in Fortinet FortiOS and FortiProxy that can cause the SSL VPN web service to terminate for logged-in users. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2019-1579 is a high-severity remote code execution vulnerability in Palo Alto Networks PAN-OS affecting systems with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.
CVE-2019-10149 is a high severity vulnerability in the Exim Mail Transfer Agent (MTA) involving improper validation of recipient addresses in the deliver_message() function. This flaw can lead to remote command execution by an attacker. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
CVE-2015-7450 is a high-severity vulnerability in IBM WebSphere Application Server and Server Hypervisor Edition. It involves serialized-object interfaces that allow remote attackers to execute arbitrary commands. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2017-1000486 is a vulnerability in Primetek Primefaces that involves a weak encryption flaw, which can be exploited to achieve remote code execution. This vulnerability has been exploited in the wild, indicating active threat activity. No specific affected versions or patch information is provided.
CVE-2019-7609 is a high-severity vulnerability in Kibana's Timelion visualizer that allows arbitrary code execution. This flaw has been exploited in the wild, posing a significant risk to affected systems. No specific affected versions or patch information are provided in the available data.
CVE-2021-27860 is a high-severity vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software. It allows a remote, unauthenticated attacker to upload files to arbitrary locations on the filesystem. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
CVE-2021-43890 is a spoofing vulnerability in Microsoft Windows AppX Installer that impacts confidentiality, integrity, and availability. It has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.
CVE-2021-4102 is a use-after-free vulnerability in the Google Chromium V8 JavaScript engine that can be exploited by a remote attacker via a crafted HTML page. This vulnerability affects multiple Chromium-based web browsers such as Google Chrome, Microsoft Edge, and Opera. Exploitation can lead to heap corruption, potentially allowing arbitrary code execution or other malicious outcomes. The vulnerability has been observed exploited in the wild. No explicit patch or remediation details are provided in the available data.