Threats tagged 'exploited-in-the-wild'

Zoho Desktop Central contains an authentication bypass vulnerability (CVE-2021-44515) that allows an attacker to execute arbitrary code on the Desktop Central MSP server. This vulnerability has been exploited in the wild, indicating active attacks. No specific affected versions or patch information is provided in the available data.

CVE-2019-13272 is a Linux kernel vulnerability in the ptrace subsystem that improperly manages privileges, allowing local users to escalate their privileges to root. This vulnerability has been exploited in the wild. It affects the Linux kernel but no specific affected versions are provided in the available data.

Realtek Jungle SDK contains multiple memory corruption vulnerabilities that allow remote code execution by attackers. These vulnerabilities have been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2019-7238 is an incorrect access control vulnerability in Sonatype Nexus Repository Manager versions prior to 3.15.0. This flaw allows remote attackers to execute code on the affected system. The vulnerability has been exploited in the wild, indicating active threat usage. No explicit patch links or vendor advisory details are provided in the input data.

Apache Solr's optional DataImportHandler module contains a code injection vulnerability identified as CVE-2019-0193. This vulnerability allows an attacker to inject and execute arbitrary code via the DataImportHandler. It has been observed to be exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2021-44168 is a vulnerability in Fortinet FortiOS where the 'execute restore src-vis' command allows arbitrary file download without integrity checking. This flaw enables attackers to download files from the system arbitrarily. The vulnerability has been exploited in the wild and is considered high severity.

Embedthis GoAhead versions before 3.6.5 contain a remote code execution vulnerability when CGI is enabled and a CGI program is dynamically linked. This vulnerability allows attackers to execute arbitrary code remotely. It has been exploited in the wild. No specific affected versions are listed beyond the indication that versions before 3.6.5 are vulnerable.

CVE-2017-12149 is a high-severity remote code execution vulnerability in Red Hat JBoss Application Server, specifically in versions shipped with Red Hat Enterprise Application Platform 5.2. It allows attackers to execute arbitrary code by sending crafted serialized data. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.

CVE-2010-1871 is a remote code execution vulnerability in JBoss Seam 2 as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux. The vulnerability arises when the Java Security Manager is not properly configured, allowing attackers to execute arbitrary code remotely. It has been exploited in the wild. No specific affected versions or patch information is provided.

Fuel CMS version 1.4.7 contains a SQL Injection vulnerability via the 'col' parameter in the /pages/items, /permissions/items, or /navigation/items endpoints. This flaw allows attackers to inject malicious SQL commands, potentially leading to unauthorized data access or manipulation. The vulnerability has been exploited in the wild. No specific patch or remediation information is provided.

Pi-hole Web version 4.3.2 (AdminLTE) contains a remote code execution vulnerability that allows privileged dashboard users to execute arbitrary code via a crafted DHCP static lease. This vulnerability has been exploited in the wild.

mongo-express versions before 0.54.0 contain a remote code execution vulnerability via endpoints that use the toBSON method. This vulnerability allows attackers to execute arbitrary code remotely. It has been exploited in the wild, indicating active threat usage. The severity is high due to the potential impact of remote code execution.

CVE-2021-44228 is a critical remote code execution vulnerability in Apache Log4j2. It arises because JNDI features in Log4j2 do not properly protect against attacker-controlled JNDI endpoints, enabling attackers to execute arbitrary code remotely. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.

CVE-2020-11261 is a high-severity vulnerability affecting multiple Qualcomm Snapdragon chipsets. It involves improper input validation that can lead to memory corruption when a user application requests an excessively large memory allocation. The affected Snapdragon platforms include Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, Mobile, Voice & Music, and Wearables. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Zoho ManageEngine ServiceDesk Plus versions before 11302 contain an authentication bypass vulnerability that allows certain REST-API URLs to be accessed without authentication. This flaw enables unauthorized users to potentially interact with the service desk application without proper credentials. The vulnerability has been exploited in the wild, indicating active use by attackers. No explicit patch information is provided in the input data.

CVE-2021-40438 is a Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server's mod_proxy module. A crafted request URI path can cause mod_proxy to forward the request to an origin server chosen by the remote user. This affects Apache HTTP Server versions 2.4.48 and earlier. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.

CVE-2021-44077 is a high-severity vulnerability in Zoho ManageEngine ServiceDesk Plus and SupportCenter Plus that allows unauthenticated remote code execution. It affects versions of ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014. The vulnerability has been exploited in the wild. No explicit patch information is provided in the input data.

CVE-2018-14847 is a critical directory traversal vulnerability in MikroTik RouterOS through version 6.42. It allows unauthenticated remote attackers to read arbitrary files and authenticated attackers to write arbitrary files via the WinBox interface. This vulnerability has been exploited in the wild and carries a high impact on confidentiality and integrity.

CVE-2021-22204 is a high-severity remote code execution vulnerability in ExifTool affecting versions 7.44 and later. The flaw arises from improper neutralization of user data in the DjVu file format, enabling arbitrary code execution when parsing a crafted malicious image. This vulnerability has been exploited in the wild.

CVE-2021-40449 is a high-severity privilege escalation vulnerability in Microsoft Windows Win32k component. It allows an authenticated user to escalate privileges. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided.