Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

1,766 results · page 27 of 36

Mar 3, 2022ChakraCore Scripting Engine Type Confusion VulnerabilityCVE-2018-8298 · Other software · ChakraCore · reported by secure@microsoft.comExploitedHigh 7.5
The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution.
Product
ChakraCore scripting engine
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install ChakraCore’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
Mar 3, 2022Cisco IOS Software Denial-of-Service VulnerabilityCVE-2018-0180 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 5.9
A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.
Product
IOS Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com tools.cisco.com
Mar 3, 2022Cisco IOS Software Denial-of-Service VulnerabilityCVE-2018-0179 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 5.9
A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.
Product
IOS Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com tools.cisco.com
Mar 3, 2022Adobe Reader and Acrobat Use-After-Free VulnerabilityCVE-2014-0496 · Email & office · Adobe · reported by AdobeExploitedHigh 8.8
Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution.
Product
Reader and Acrobat
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com securitytracker.com
Mar 3, 2022Cisco IOS, XR, and XE Software Buffer Overflow VulnerabilityCVE-2018-0175 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8
Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.
Product
IOS, XR, and XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS Software and Cisco IOS XE Software Improper Input Validation VulnerabilityCVE-2018-0174 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.6
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
Product
IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS and IOS XE Software Improper Input Validation VulnerabilityCVE-2018-0173 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.6
A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS).
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS and IOS XE Software Improper Input Validation VulnerabilityCVE-2018-0172 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.6
A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS, XR, and XE Software Buffer Overflow VulnerabilityCVE-2018-0167 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8
There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code.
Product
IOS, XR, and XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS Software Resource Management Errors VulnerabilityCVE-2018-0161 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.3
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition.
Product
IOS Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service VulnerabilityCVE-2018-0159 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.
Product
IOS Software and Cisco IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS and XE Software Internet Key Exchange Memory Leak VulnerabilityCVE-2018-0158 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.6
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.
Product
IOS Software and Cisco IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service VulnerabilityCVE-2018-0156 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition.
Product
IOS Software and Cisco IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service VulnerabilityCVE-2018-0155 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.6
A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service (DoS) condition.
Product
Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS Software Integrated Services Module for VPN Denial-of-Service VulnerabilityCVE-2018-0154 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition.
Product
IOS Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution VulnerabilityCVE-2018-0151 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Microsoft Malware Protection Engine Improper Restriction of Operations VulnerabilityCVE-2017-8540 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".
Product
Malware Protection Engine
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS Software SNMP Remote Code Execution VulnerabilityCVE-2017-6744 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 1 contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6.
Product
IOS software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Mar 3, 2022Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6743 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com securityfocus.com
Mar 3, 2022Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6740 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com securityfocus.com
Mar 3, 2022Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6739 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com securityfocus.com
Mar 3, 2022Microsoft Excel Featheader Record Memory Corruption VulnerabilityCVE-2009-3129 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.
Product
Excel
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog archives.neohapsis.com labs.idefense.com
Mar 3, 2022Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6738 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com securityfocus.com
Mar 3, 2022Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6737 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com securityfocus.com
Mar 3, 2022Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityCVE-2017-6736 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 8.8
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com securityfocus.com
Mar 3, 2022Cisco IOS Software and Cisco IOS XE Software Denial-of-Service VulnerabilityCVE-2017-6663 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in denial-of-service (DoS).
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service VulnerabilityCVE-2017-6627 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and denial of service.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service VulnerabilityCVE-2017-12319 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 5.9
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.
Product
IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com tools.cisco.com
Mar 3, 2022Cisco IOS and IOS XE Software DHCP Remote Code Execution VulnerabilityCVE-2017-12240 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service VulnerabilityCVE-2017-12238 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a denial of service.
Product
Catalyst 6800 Series Switches
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service VulnerabilityCVE-2017-12237 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service.
Product
IOS and IOS XE Software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service VulnerabilityCVE-2017-12235 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.
Product
IOS software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS Software Common Industrial Protocol Request Denial-of-Service VulnerabilityCVE-2017-12234 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.
Product
IOS software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS Software Common Industrial Protocol Request Denial-of-Service VulnerabilityCVE-2017-12233 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.
Product
IOS software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service VulnerabilityCVE-2017-12232 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6.5
A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service.
Product
IOS software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Cisco IOS Software Network Address Translation Denial-of-Service VulnerabilityCVE-2017-12231 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.5
A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS could allow an unauthenticated, remote attacker to cause a denial of service.
Product
IOS software
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Microsoft Office Remote Code Execution VulnerabilityCVE-2017-11826 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Adobe Flash Player Type Confusion VulnerabilityCVE-2017-11292 · Other software · Adobe · reported by AdobeExploitedHigh 8.8
Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution.
Product
Flash Player
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Microsoft Office Use-After-Free VulnerabilityCVE-2017-0261 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Microsoft Graphics Device Interface (GDI) Privilege Escalation VulnerabilityCVE-2017-0001 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges
Product
Graphics Device Interface (GDI)
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Siemens SIMATIC CP 1543-1 Improper Privilege Management VulnerabilityCVE-2016-8562 · Other software · Siemens · reported by MITREExploitedHigh 7.5
An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service.
Product
SIMATIC CP
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Siemens’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com siemens.com
Mar 3, 2022Adobe Flash Player Use-After-Free VulnerabilityCVE-2016-7855 · Other software · Adobe · reported by AdobeExploitedHigh 8.8
Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code.
Product
Flash Player
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog rhn.redhat.com securityfocus.com
Mar 3, 2022Microsoft Office Security Feature Bypass VulnerabilityCVE-2016-7262 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.
Product
Excel
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Microsoft Office Memory Corruption VulnerabilityCVE-2016-7193 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Linux Kernel Race Condition VulnerabilityCVE-2016-5195 · Computers, phones & browsers · Linux · reported by chrome-cve-admin@google.comExploitedHigh 7
Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.
Product
Kernel
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com git.kernel.org
Mar 3, 2022Adobe Flash Player Arbitrary Code Execution VulnerabilityCVE-2016-4117 · Other software · Adobe · reported by AdobeExploitedRansomwareCritical 9.8
An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.
Product
Flash Player
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 3, 2022Adobe Flash Player Arbitrary Code Execution VulnerabilityCVE-2016-1019 · Other software · Adobe · reported by AdobeExploitedRansomwareCritical 9.8
Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.
Product
Flash Player
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.adobe.com lists.opensuse.org
Mar 3, 2022Microsoft Windows Secondary Logon Service Privilege Escalation VulnerabilityCVE-2016-0099 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.
Product
Windows
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 3, 2022Adobe Flash Player Arbitrary Code Execution VulnerabilityCVE-2015-7645 · Other software · Adobe · reported by AdobeExploitedRansomwareHigh 7.8
Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.
Product
Flash Player
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blog.trendmicro.com lists.opensuse.org
Mar 3, 2022Microsoft Office MSCOMCTL.OCX Remote Code Execution VulnerabilityCVE-2012-1856 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.
Product
Office
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com us-cert.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.