Updated 25 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

36added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

139 results · page 3 of 3

Jan 10, 2022Oracle WebLogic Server, InjectionCVE-2019-2725 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedRansomwareCritical 9.8
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
Product
WebLogic Server
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com oracle.com
Jan 10, 2022IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.CVE-2015-7450 · Other software · IBM · reported by psirt@us.ibm.comExploitedCritical 9.8
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
Product
WebSphere Application Server and Server Hypervisor Edition
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install IBM’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog www-01.ibm.com www-01.ibm.com
Dec 10, 2021Red Hat JBoss Application Server Remote Code Execution VulnerabilityCVE-2017-12149 · Other software · Red Hat · reported by Red HatExploitedRansomwareCritical 9.8
The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.
Product
JBoss Application Server
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Red Hat’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com access.redhat.com
Dec 1, 2021Apache HTTP Server-Side Request Forgery (SSRF)CVE-2021-40438 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 9
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Product
Apache
On CISA’s list since
Dec 1, 2021 (federal fix deadline Dec 15, 2021)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cert-portal.siemens.com httpd.apache.org
Nov 17, 2021Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-42321 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.
Product
Exchange
On CISA’s list since
Nov 17, 2021 (federal fix deadline Dec 1, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Nov 3, 2021Microsoft Exchange Server Privilege Escalation VulnerabilityCVE-2021-34523 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 9
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
Product
Exchange Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Nov 3, 2021Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2020-17144 · Email & office · Microsoft · reported by secure@microsoft.comExploitedHigh 8.4
Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution.
Product
Exchange Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Yealink Device Management Server-Side Request Forgery (SSRF) VulnerabilityCVE-2021-27561 · Other software · Yealink · reported by MITREExploitedCritical 9.8
Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution.
Product
Device Management
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Yealink’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ssd-disclosure.com ssd-disclosure.com
Nov 3, 2021Accellion FTA Server-Side Request Forgery (SSRF) VulnerabilityCVE-2021-27103 · Other software · Accellion · reported by MITREExploitedRansomwareCritical 9.8
Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.
Product
FTA
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Accellion’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com accellion.com
Nov 3, 2021Apache HTTP Server Path Traversal VulnerabilityCVE-2021-42013 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 9.8
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.
Product
HTTP Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp packetstormsecurity.com
Nov 3, 2021Apache HTTP Server Path Traversal VulnerabilityCVE-2021-41773 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareCritical 9.8
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.
Product
HTTP Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Apache HTTP Server Privilege Escalation VulnerabilityCVE-2019-0211 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 7.8
Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.
Product
HTTP Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Nov 3, 2021Atlassian Confluence Server and Data Center Path Traversal VulnerabilityCVE-2019-3398 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedHigh 8.8
Atlassian Confluence Server and Data Center contain a path traversal vulnerability in the downloadallattachments resource that may allow a privileged, remote attacker to write files. Exploitation can lead to remote code execution.
Product
Confluence Server and Data Center
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection VulnerabilityCVE-2021-26084 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareCritical 9.8
Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.
Product
Confluence Server and Data Center
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com jira.atlassian.com
Nov 3, 2021Atlassian Confluence Server and Data Center Server-Side Template Injection VulnerabilityCVE-2019-3396 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedRansomwareCritical 9.8
Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.
Product
Confluence Server and Data Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service VulnerabilityCVE-2020-3161 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service (DoS) condition.
Product
Cisco IP Phones
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tools.cisco.com
Nov 3, 2021Citrix StoreFront Server XML External Entity (XXE) Processing VulnerabilityCVE-2019-13608 · Network & remote access · Citrix · reported by MITREExploitedRansomwareHigh 7.5
Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.
Product
StoreFront Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.citrix.com support.citrix.com
Nov 3, 2021ForgeRock Access Management (AM) Core Server Remote Code Execution VulnerabilityCVE-2021-35464 · Other software · ForgeRock · reported by MITREExploitedRansomwareCritical 9.8
ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend).
Product
Access Management (AM)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install ForgeRock’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021ImageMagick Server-Side Request Forgery (SSRF) VulnerabilityCVE-2016-3718 · Other software · ImageMagick · reported by Red HatExploitedMedium 5.5
ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.
Product
ImageMagick
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install ImageMagick’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog git.imagemagick.org lists.opensuse.org
Nov 3, 2021Kaseya Virtual System/Server Administrator (VSA) Information Disclosure VulnerabilityCVE-2021-30116 · Other software · Kaseya · reported by MITREExploitedRansomwareCritical 10
Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system.
Product
Virtual System/Server Administrator (VSA)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Kaseya’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog csirt.divd.nl csirt.divd.nl
Nov 3, 2021Microsoft Windows Server Buffer Overflow VulnerabilityCVE-2017-7269 · Websites & servers · Microsoft · reported by MITREExploitedCritical 9.8
Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request.
Product
Internet Information Services (IIS)
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Nov 3, 2021Microsoft Exchange Server Validation Key Remote Code Execution VulnerabilityCVE-2020-0688 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.
Product
Exchange Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Microsoft Windows Server Message Block (SMBv1) Remote Code Execution VulnerabilityCVE-2017-0143 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-34473 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 9.1
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.
Product
Exchange Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Nov 3, 2021Microsoft Exchange Server Security Feature Bypass VulnerabilityCVE-2021-31207 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 6.6
Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.
Product
Exchange Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Windows DNS Server Remote Code Execution VulnerabilityCVE-2020-1350 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedCritical 10
Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-26855 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 9.1
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Product
Exchange Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Nov 3, 2021Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-26858 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Product
Exchange Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-27065 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Product
Exchange Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Nov 3, 2021Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2021-26857 · Email & office · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
Product
Exchange Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Oracle WebLogic Server Deserialization of Untrusted Data VulnerabilityCVE-2015-4852 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.
Product
WebLogic Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog foxglovesecurity.com packetstormsecurity.com
Nov 3, 2021Oracle WebLogic Server Remote Code Execution VulnerabilityCVE-2020-14750 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.
Product
WebLogic Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com oracle.com
Nov 3, 2021Oracle WebLogic Server Remote Code Execution VulnerabilityCVE-2020-14882 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.
Product
WebLogic Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Oracle WebLogic Server Unspecified VulnerabilityCVE-2020-14883 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.2
Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
Product
WebLogic Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com oracle.com
Nov 3, 2021PlaySMS Server-Side Template Injection VulnerabilityCVE-2020-8644 · Other software · PlaySMS · reported by MITREExploitedCritical 9.8
PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.
Product
PlaySMS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install PlaySMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com forum.playsms.org
Nov 3, 2021VMware vCenter Server File Upload VulnerabilityCVE-2021-22005 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
Product
vCenter Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com vmware.com
Nov 3, 2021VMware vCenter Server Information Disclosure VulnerabilityCVE-2020-3952 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8
VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.
Product
vCenter Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com vmware.com
Nov 3, 2021VMware vCenter Server Remote Code Execution VulnerabilityCVE-2021-21972 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.
Product
vCenter Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021VMware vCenter Server Improper Input Validation VulnerabilityCVE-2021-21985 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.
Product
vCenter Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.