Threats tagged 'exploited-in-the-wild'

CVE-2019-13608 is an XML External Entity (XXE) processing vulnerability in Citrix StoreFront Server. This flaw allows an unauthenticated attacker to potentially retrieve sensitive information from the affected system. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

CVE-2020-8193 is an authorization bypass vulnerability affecting Citrix ADC, Gateway, and multiple Citrix SD-WAN WANOP appliance models. This flaw allows unauthenticated attackers with access to the NetScaler IP (NSIP) to access certain URL endpoints without proper authorization. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.

CVE-2020-8195 is an information disclosure vulnerability affecting Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models. The vulnerability allows unauthorized access to sensitive information. It has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2020-8196 is an information disclosure vulnerability affecting Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models. The vulnerability allows unauthorized access to sensitive information. It has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

CVE-2019-19781 is a high-severity vulnerability affecting Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models. It allows an unauthenticated attacker to execute arbitrary code on vulnerable devices. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information are provided in the input data.

CVE-2019-11634 is a remote code execution vulnerability in Citrix Workspace Application and Receiver for Windows. It arises because local drive access preferences are not properly enforced, allowing unauthorized access to client local drives. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. The severity is high due to the potential for remote code execution on affected systems.

D-Link DIR-825 R1 devices have a buffer overflow vulnerability in their web interface that can be exploited remotely to execute arbitrary code. This vulnerability is known to be exploited in the wild and is considered high severity. No specific affected versions or patches are detailed in the provided information.

DotNetNuke (DNN) suffers from a vulnerability due to the use of weak encryption algorithms to protect input parameters. This inadequate encryption strength can potentially be exploited to compromise the confidentiality or integrity of data handled by the application. The vulnerability is known to be exploited in the wild, indicating active threat activity targeting affected systems.

DotNetNuke (DNN) suffers from an inadequate encryption strength vulnerability due to the use of a weak encryption algorithm to protect input parameters. This issue is a follow-up to an incomplete patch for a previous vulnerability (CVE-2018-15811). The vulnerability has been exploited in the wild, indicating active threat usage.

DotNetNuke (DNN) has a remote code execution vulnerability due to unsafe cookie deserialization. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided.

Docker Desktop Community Edition contains a local privilege escalation vulnerability where an attacker can place a malicious docker-credential-wincred.exe file in a specific directory to escalate privileges.

Multiple DrayTek Vigor routers, including models Vigor3900, Vigor2960, and Vigor300B, have a vulnerability in their web management interface that allows remote code execution. This vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided.

CVE-2018-7600 is a remote code execution vulnerability in Drupal Core that allows attackers to exploit multiple attack vectors to fully compromise affected Drupal sites. It has been exploited in the wild and is known to have been used in ransomware campaigns. The vulnerability is considered high severity due to the potential for complete site takeover.

CVE-2021-22205 is a remote code execution vulnerability affecting GitLab Community and Enterprise Editions. The flaw arises from improper validation of image files uploaded through GitLab Workhorse, which uses ExifTool to process image file extensions. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

CVE-2018-6789 is a high-severity buffer overflow vulnerability in the Exim mail transfer agent's base64d function within the SMTP listener. This flaw may allow remote code execution. It has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

EyesOfNetwork contains a vulnerability due to the use of hard-coded credentials, specifically the same default API key. This flaw allows attackers to calculate or guess the admin access token, potentially leading to unauthorized administrative access. The vulnerability has been exploited in the wild.

EyesOfNetwork contains an improper privilege management vulnerability that allows a user to execute commands as root by leveraging a crafted Nmap Scripting Engine (NSE) script targeting nmap7. This vulnerability has been exploited in the wild and is classified as high severity.

CVE-2020-5902 is a remote code execution vulnerability in the F5 BIG-IP Traffic Management User Interface (TMUI). It affects undisclosed pages within the TMUI and has been exploited in the wild, including use in ransomware campaigns. The vulnerability is classified as high severity.

CVE-2021-22986 is a remote code execution vulnerability in the iControl REST interface of F5 BIG-IP and BIG-IQ Centralized Management. It allows unauthenticated attackers with network access to execute system commands, manipulate files, and disable services. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the input data.

CVE-2021-35464 is a remote code execution vulnerability in ForgeRock Access Management (AM) Core Server. An attacker can exploit this by sending a specially crafted HTTP request to one of three specific endpoints, allowing code execution with the privileges of the current user. The vendor advises against running ForgeRock AM as the root user to reduce risk. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.