Threats tagged 'cisa-kev'

CVE-2023-42793 is a critical authentication bypass vulnerability in JetBrains TeamCity that enables remote code execution on the TeamCity Server. It has a CVSS score of 9.8, indicating a high severity with network attack vector, no privileges or user interaction required, and full confidentiality, integrity, and availability impact. This vulnerability is known to be exploited in the wild and has been associated with ransomware campaigns. No specific affected versions or patch information is provided in the available data.

A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2018-14667 is a high severity expression language injection vulnerability in the Red Hat JBoss RichFaces Framework. It affects the UserResource resource, allowing a remote, unauthenticated attacker to execute malicious code by exploiting a chain of Java serialized objects. This vulnerability has been observed in the wild.

A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of integrity or confidentiality, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on SRX Series: * 21.2 versions prior to 21.2R3-S8; * 21.4 versions prior to 21.4R3-S6; * 22.1 versions prior to 22.1R3-S5; * 22.2 versions prior to 22.2R3-S3; * 22.3 versions prior to 22.3R3-S2; * 22.4 versions prior to 22,4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S2, 23.2R2.

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.

CVE-2023-28434 is a security feature bypass vulnerability in MinIO that allows attackers with specific permissions to bypass bucket name checks and place objects into arbitrary buckets, enabling privilege escalation. Exploitation requires credentials with arn:aws:s3:::* permission and enabled Console API access. This vulnerability has been exploited in the wild.

A use-after-free vulnerability exists in Samsung mobile devices with selected Exynos chipsets. This flaw allows malicious actors to perform unauthorized memory writes and potentially execute arbitrary code on affected devices. The vulnerability has been exploited in the wild. No specific affected software versions or patches have been provided in the available data.

CVE-2014-8361 is a high-severity vulnerability in the Realtek SDK's miniigd SOAP service caused by improper input validation. This flaw allows remote attackers to execute arbitrary code by sending a specially crafted NewInternalClient request. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

Zyxel EMG2926 routers have a command injection vulnerability in the diagnostic nslookup function. This flaw allows attackers to execute arbitrary commands on the device by manipulating parameters such as ping_ip in the diagnostic URI. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

CVE-2021-3129 is a high-severity vulnerability in Laravel Ignition that allows unauthenticated remote attackers to execute arbitrary code by exploiting insecure file upload handling. The flaw arises from improper use of file_get_contents() and file_put_contents() functions, enabling malicious file uploads. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.

Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Microsoft Word Information Disclosure Vulnerability