Threats tagged 'exploited-in-the-wild'

An unspecified vulnerability in Apple iOS, iPadOS, macOS, watchOS, and tvOS may allow an application to execute code with kernel privileges. This vulnerability is known to have been exploited in the wild. No specific affected versions or patch information is provided.

Arcadyan Buffalo firmware contains a path traversal vulnerability that allows unauthenticated remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers from different vendors. It has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2021-27562 is an out-of-bounds write vulnerability in Arm Trusted Firmware that allows the non-secure world to cause a system halt, overwrite secure data, or leak secure data by invoking secure functions under the non-secure processing environment handler mode. It affects Yealink Device Management servers. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

An unspecified vulnerability in the Arm Mali Graphics Processing Unit (GPU) kernel driver allows a non-privileged user to gain write access to read-only memory, escalate to root privileges, corrupt memory, and modify other processes' memory. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided.

CVE-2021-28663 is a use-after-free vulnerability in the Arm Mali Graphics Processing Unit (GPU) kernel driver. This flaw allows a non-privileged user to perform improper operations on GPU memory, potentially leading to privilege escalation to root or information disclosure. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2019-3398 is a path traversal vulnerability in Atlassian Confluence Server and Data Center affecting the downloadallattachments resource. A privileged remote attacker can exploit this flaw to write arbitrary files, potentially leading to remote code execution. This vulnerability has been exploited in the wild and is considered high severity.

CVE-2021-26084 is an Object-Graph Navigation Language (OGNL) injection vulnerability in Atlassian Confluence Server and Data Center. It allows unauthenticated attackers to execute arbitrary code on the affected systems. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. The severity of this vulnerability is high.

Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability due to a development plugin (pdkinstall) being incorrectly enabled in release builds. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the available data.

CVE-2019-3396 is a server-side template injection vulnerability in Atlassian Confluence Server and Data Center. This flaw allows attackers to perform path traversal and potentially execute remote code on the affected systems. It has been exploited in the wild and is associated with known ransomware campaigns. The vulnerability is rated as high severity due to its impact on system integrity and confidentiality.

BQE BillQuick Web Suite is affected by an SQL injection vulnerability in the username parameter that can be exploited remotely without authentication. This vulnerability may lead to remote code execution. It has been exploited in the wild and is associated with known ransomware campaigns.

CVE-2020-3452 is a high-severity vulnerability in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) that allows attackers to exploit improper input validation in HTTP request URL processing. By sending crafted HTTP requests with directory traversal sequences, attackers can read arbitrary files on the device's web services file system. This vulnerability has been exploited in the wild.

CVE-2020-3580 is a high-severity cross-site scripting (XSS) vulnerability in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) web services interface. It arises from insufficient input validation of user-supplied data, allowing attackers to execute scripts in the context of the interface or access sensitive browser information. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.

CVE-2021-1497 is a command injection vulnerability in the Cisco HyperFlex HX Installer Virtual Machine. It arises from insufficient input validation, allowing an attacker to execute arbitrary commands with root privileges on the affected device. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2021-1498 is a command injection vulnerability in Cisco HyperFlex HX Installer Virtual Machine due to insufficient input validation. This flaw allows an attacker to execute arbitrary commands on the affected device with the privileges of the tomcat8 user. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2020-3118 is a vulnerability in Cisco IOS XR software where improper validation of string input in Cisco Discovery Protocol messages can allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause the device to reload. This vulnerability has been exploited in the wild.

CVE-2020-3566 is a vulnerability in Cisco IOS XR software's Distance Vector Multicast Routing Protocol (DVMRP) where improper handling of IGMP packets can lead to memory exhaustion or immediate crash of the IGMP process. This flaw allows unauthenticated remote attackers to disrupt service by causing process crashes or resource depletion.

CVE-2020-3569 is a vulnerability in Cisco IOS XR software affecting the Distance Vector Multicast Routing Protocol (DVMRP). The flaw involves improper handling of Internet Group Management Protocol (IGMP) packets, which can be exploited by an unauthenticated remote attacker to cause the IGMP process to crash immediately or consume excessive memory leading to a crash. This vulnerability has been exploited in the wild.

Cisco IP Phones have a vulnerability in their web server due to improper input validation of HTTP requests. This flaw allows remote attackers to execute code with root privileges or cause denial-of-service conditions. The vulnerability is known to be exploited in the wild. No specific affected versions or patches are provided in the available data.

Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers have an information disclosure vulnerability due to improper access controls on URLs. This flaw allows attackers to download sensitive router configuration files or detailed diagnostic information. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

CVE-2018-0296 is a vulnerability in Cisco Adaptive Security Appliance (ASA) involving improper input validation of HTTP URLs. Successful exploitation can lead to denial-of-service (DoS) conditions or information disclosure. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.