Threat database

Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.

CVE-2025-26633 is a high-severity vulnerability in Microsoft Windows Management Console (MMC) that allows a local unauthorized attacker to bypass a security feature. The vulnerability involves improper neutralization, leading to potential full compromise of confidentiality, integrity, and availability. It has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an authenticated, remote attacker to gain root-level privileges and access unauthorized data.

CVE-2022-43939 is an authorization bypass vulnerability in Hitachi Vantara Pentaho Business Analytics (BA) Server caused by the use of non-canonical URL paths in authorization decisions. This flaw allows attackers to bypass authorization controls. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2022-43769 is a special element injection vulnerability in Hitachi Vantara Pentaho Business Analytics (BA) Server. It allows attackers to inject Spring templates into properties files, leading to arbitrary command execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CyberoamOS (CROS) contains a SQL injection vulnerability in its WebAdmin interface that allows unauthenticated remote attackers to execute arbitrary SQL commands. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. The vulnerability is classified as high severity due to its potential impact on system integrity and confidentiality.

Microsoft Outlook contains a critical improper input validation vulnerability that enables remote code execution. This flaw allows attackers to bypass the Office Protected View security feature, causing documents to open directly in editing mode instead of protected mode. The vulnerability has been exploited in the wild, posing a significant risk to users. No specific affected versions or patch information is provided in the available data.

A vulnerability in 7-Zip allows remote attackers to bypass the Mark-of-the-Web security feature, enabling execution of arbitrary code with the current user's privileges. This flaw has been exploited in the wild and is rated as high severity.

Sophos XG Firewall has a buffer overflow vulnerability in its HTTP/S bookmark feature that enables remote code execution. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided.

CVE-2022-23748 is a process control vulnerability in the Dante Discovery application, specifically in the mDNSResponder.exe component. This flaw allows a local attacker to perform a DLL sideloading attack, enabling arbitrary code execution. The vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information are provided.

Microsoft .NET Framework has an information disclosure vulnerability identified as CVE-2024-29059. This flaw exposes the ObjRef URI to attackers, which can lead to remote code execution. The vulnerability has a high severity score of 7.5 and is known to be exploited in the wild. No specific affected versions or patch information are provided in the available data.

CVE-2018-9276 is an OS command injection vulnerability in Paessler PRTG Network Monitor that allows attackers with administrative privileges to execute arbitrary operating system commands via the PRTG System Administrator web console. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

Paessler PRTG Network Monitor has a local file inclusion vulnerability (CVE-2018-19410) that enables a remote, unauthenticated attacker to create users with read-write privileges, including administrator access. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

JQuery contains a persistent cross-site scripting (XSS) vulnerability that allows execution of untrusted code in the user's browser when maliciously formed input enclosed in HTML tags is processed by JQuery's DOM manipulators. This vulnerability has been exploited in the wild and is considered high severity.

CVE-2025-0282 is a critical stack-based buffer overflow vulnerability in Ivanti Connect Secure, Policy Secure, and ZTA Gateways. This flaw allows unauthenticated remote attackers to execute arbitrary code remotely. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. The CVSS 3.1 base score is 9.0, reflecting high complexity and severe impact on confidentiality, integrity, and availability.

CVE-2020-2883 is an unspecified vulnerability in Oracle WebLogic Server that can be exploited by unauthenticated attackers with network access via IIOP or T3 protocols. The vulnerability is known to be exploited in the wild. Oracle has released security patches addressing this and other vulnerabilities in their April 2020 Critical Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.

Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that can enable an attacker to achieve remote code execution on the affected system. Exploitation requires obtaining the MachineKey through another vulnerability or channel. This vulnerability is known to be exploited in the wild and is classified as high severity.

Multiple Reolink IP camera models have an authenticated OS command injection vulnerability that allows an admin user to execute arbitrary commands as root via the 'TestEmail' feature. This vulnerability affects models including RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W. Exploitation requires authentication but can lead to full system compromise. The vulnerability is known to be exploited in the wild.

NUUO NVRmini2 devices have a missing authentication vulnerability that permits unauthenticated attackers to upload encrypted TAR archives. This flaw can be exploited to add arbitrary users to the device, potentially compromising device security. The vulnerability is classified as high severity and has been exploited in the wild. No specific affected versions or patch information is provided.

NUUO NVRmini devices have an OS command injection vulnerability identified as CVE-2018-14933. This flaw allows remote attackers to execute arbitrary commands on the device by injecting shell metacharacters into the uploaddir parameter of the writeuploaddir command. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.