Threats Tagged 'exploited-in-the-wild'

CVE-2016-3427 is an unspecified vulnerability in Oracle Java SE and JRockit related to Java Management Extensions (JMX). It allows remote attackers to impact confidentiality, integrity, and availability. The vulnerability can be exploited via sandboxed Java Web Start applications, sandboxed Java applets, or by supplying data to APIs in the affected component without using sandboxed Java applications. Oracle has released patches addressing this and other vulnerabilities in their April 2016 Critical Patch Update. Exploits have been observed in the wild, emphasizing the importance of applying available fixes.

Apache Tomcat contains a remote code execution vulnerability related to the JmxRemoteLifecycleListener component. This vulnerability arises when the listener is used and an attacker can access Java Management Extension (JMX) ports. The issue stems from the listener not being updated to align with Oracle's fixes for a related vulnerability (CVE-2016-3427) affecting credential types. Exploitation of this vulnerability has been observed in the wild.

CVE-2021-45046 is a high severity vulnerability in Apache Log4j2 involving deserialization of untrusted data. It arises from an incomplete fix of the earlier CVE-2021-44228 vulnerability. The flaw allows remote code execution through the Thread Context Lookup Pattern in certain non-default configurations. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

CVE-2023-28432 is an information disclosure vulnerability in MinIO cluster deployments where the system returns all environment variables. This can expose sensitive configuration and secret data. The vulnerability is known to be exploited in the wild. No specific affected versions or patch information are provided.

CVE-2017-6742 is a high-severity vulnerability in the SNMP subsystem of Cisco IOS and IOS XE software. It allows an authenticated remote attacker to execute arbitrary code or cause the affected system to reload. This vulnerability has been exploited in the wild. No explicit affected versions or patch information is provided in the input data.

CVE-2019-8526 is a use-after-free vulnerability in Apple macOS that can lead to privilege escalation. This vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information are provided in the available data.

CVE-2021-27876 is a high-severity file access vulnerability in the Veritas Backup Exec Agent. It allows attackers to craft specific input parameters in a data management protocol command to access files on the Backup Exec Agent machine. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.

CVE-2021-27877 is an improper authentication vulnerability in the Veritas Backup Exec Agent. It allows unauthorized attackers to gain access to the Backup Exec Agent by exploiting weaknesses in the SHA authentication scheme. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the available data.

CVE-2021-27878 is a command execution vulnerability in the Veritas Backup Exec Agent. It allows an attacker to execute arbitrary commands on the Backup Exec Agent machine by leveraging a data management protocol command. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. The vulnerability is rated as high severity due to its potential impact on system control.

CVE-2019-1388 is a privilege escalation vulnerability in the Microsoft Windows Certificate Dialog that allows attackers to execute processes with elevated privileges. It has been exploited in the wild and is known to have been used in ransomware campaigns. The vulnerability affects Microsoft Windows but specific affected versions are not provided. The severity is assessed as high due to the potential impact of privilege escalation.

CVE-2022-27926 is a high-severity cross-site scripting (XSS) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). The vulnerability arises because an endpoint URL accepts parameters without proper sanitization, allowing malicious scripts to be injected. This flaw has been exploited in the wild. No specific affected versions or patch information is provided.

Microsoft Internet Explorer has a memory corruption vulnerability (CVE-2013-3163) that can be exploited by remote attackers through crafted websites to execute arbitrary code or cause a denial of service. This vulnerability has been observed in the wild and is considered high severity.

CVE-2017-7494 is a remote code execution vulnerability in Samba that allows a malicious client to upload a shared library to a writable share and trigger the server to load and execute it. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. It poses a high risk due to the ability to execute arbitrary code remotely on affected systems.

CVE-2022-42948 is a high-severity remote code execution vulnerability in the Fortra Cobalt Strike User Interface. The flaw is rooted in Java Swing components and allows remote attackers to execute arbitrary code. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

CVE-2022-39197 is a high-severity cross-site scripting (XSS) vulnerability in Fortra Cobalt Strike's Teamserver component. It allows an attacker to set a malformed username in the Beacon configuration, enabling remote code execution. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

CVE-2021-30900 is an out-of-bounds write vulnerability in Apple GPU drivers affecting iOS, iPadOS, and macOS. This flaw may allow a malicious application to execute code with kernel privileges. The vulnerability has been exploited in the wild. Vendor advisories linked are unavailable, and no patch information is confirmed from the provided data.

CVE-2022-38181 is a use-after-free vulnerability in the Arm Mali GPU Kernel Driver. This flaw may allow a non-privileged user to gain root privileges or disclose sensitive information. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-3038 is a use-after-free vulnerability in the Google Chromium Network Service that allows remote attackers to potentially cause heap corruption by crafting a malicious HTML page. This vulnerability affects multiple Chromium-based web browsers such as Google Chrome, Microsoft Edge, and Opera. It has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-22706 is a high-severity vulnerability in the Arm Mali GPU Kernel Driver that allows a non-privileged user to gain write access to read-only memory pages. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

CVE-2022-41328 is a path traversal vulnerability in Fortinet FortiOS that allows a local privileged attacker to read and write arbitrary files using crafted CLI commands. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.