Vulnerability database

59 results · page 2 of 2

• Mar 3, 2022Microsoft ATM Font Driver Privilege Escalation VulnerabilityCVE-2015-2387 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8

  ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.

  Product

  ATM Font Driver

  On CISA’s list since

  Mar 3, 2022 (federal fix deadline Mar 24, 2022)

  What to do

  Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsecurityfocus.comsecuritytracker.com

• Jan 18, 2022Drupal core Un-restricted Upload of FileCVE-2020-13671 · Websites & servers · Drupal · reported by mlhess@drupal.orgExploitedHigh 8.8

  Improper sanitization in the extension file names is present in Drupal core.

  Product

  Drupal core

  On CISA’s list since

  Jan 18, 2022 (federal fix deadline Jul 18, 2022)

  What to do

  Attackers are using this now. Install Drupal’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA cataloglists.fedoraproject.orglists.fedoraproject.org

• Dec 1, 2021Qualcomm Multiple Chipsets Improper Input Validation VulnerabilityCVE-2020-11261 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.8

  Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

  Product

  Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

  On CISA’s list since

  Dec 1, 2021 (federal fix deadline Jun 1, 2022)

  What to do

  Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogqualcomm.comqualcomm.com

• Nov 3, 2021Google Chrome for Android UI Heap Buffer Overflow VulnerabilityCVE-2020-16010 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedCritical 9.6

  Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.

  Product

  Chrome for Android UI

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com

• Nov 3, 2021Android Kernel Use-After-Free VulnerabilityCVE-2019-2215 · Computers, phones & browsers · Android · reported by security@android.comExploitedHigh 7.8

  Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain "AbstractEmu."

  Product

  Android Kernel

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com

• Nov 3, 2021Android Kernel Out-of-Bounds Write VulnerabilityCVE-2020-0041 · Computers, phones & browsers · Android · reported by security@android.comExploitedHigh 7.8

  Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain "AbstractEmu."

  Product

  Android Kernel

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsource.android.comsource.android.com

• Nov 3, 2021Multiple DrayTek Vigor Routers Web Management Page VulnerabilityCVE-2020-8515 · Network & remote access · DrayTek · reported by MITREExploitedCritical 9.8

  DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.

  Product

  Multiple Vigor Routers

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comsku11army.blogspot.com

• Nov 3, 2021Drupal Core Remote Code Execution VulnerabilityCVE-2018-7600 · Websites & servers · Drupal · reported by mlhess@drupal.orgExploitedRansomwareCritical 9.8

  Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.

  Product

  Drupal Core

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Drupal’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsecurityfocus.comsecuritytracker.com

• Nov 3, 2021Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityCVE-2021-36955 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8

  Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

  Product

  Windows

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogmsrc.microsoft.comportal.msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.