Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

197 results · page 4 of 4

Mar 3, 2022Siemens SIMATIC CP 1543-1 Improper Privilege Management VulnerabilityCVE-2016-8562 · Other software · Siemens · reported by MITREExploitedHigh 7.5
An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service.
Product
SIMATIC CP
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Siemens’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com siemens.com
Mar 3, 2022Microsoft Windows Improper Input Validation VulnerabilityCVE-2009-1123 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.
Product
Windows
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 24, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog osvdb.org secunia.com
Feb 22, 2022Zabbix Frontend Improper Access Control VulnerabilityCVE-2022-23134 · Other software · Zabbix · reported by security@zabbix.comExploitedLow 3.7
Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.
Product
Frontend
On CISA’s list since
Feb 22, 2022 (federal fix deadline Mar 8, 2022)
What to do
Attackers are using this now. Install Zabbix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.debian.org lists.fedoraproject.org
Feb 15, 2022Adobe Commerce and Magento Open Source Improper Input Validation VulnerabilityCVE-2022-24086 · Websites & servers · Adobe · reported by AdobeExploitedCritical 9.8
Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.
Product
Commerce and Magento Open Source
On CISA’s list since
Feb 15, 2022 (federal fix deadline Mar 1, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog helpx.adobe.com helpx.adobe.com
Feb 10, 2022Apache Struts 1 Improper Input Validation VulnerabilityCVE-2017-9791 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Product
Struts 1
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog struts.apache.org oracle.com
Feb 10, 2022Apache ActiveMQ Improper Input Validation VulnerabilityCVE-2016-3088 · Websites & servers · Apache · reported by Red HatExploitedCritical 9.8
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
Product
ActiveMQ
On CISA’s list since
Feb 10, 2022 (federal fix deadline Aug 10, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog activemq.apache.org rhn.redhat.com
Jan 28, 2022Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management VulnerabilityCVE-2020-0787 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.
Product
Windows
On CISA’s list since
Jan 28, 2022 (federal fix deadline Jul 28, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Jan 21, 2022Apache Struts 2 Improper Input Validation VulnerabilityCVE-2012-0391 · Websites & servers · Apache · reported by MITREExploitedCritical 9.8
The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.
Product
Struts 2
On CISA’s list since
Jan 21, 2022 (federal fix deadline Jul 21, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog archives.neohapsis.com secunia.com
Jan 21, 2022SolarWinds Serv-U Improper Input Validation VulnerabilityCVE-2021-35247 · Other software · SolarWinds · reported by psirt@solarwinds.comExploitedMedium 4.3
SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.
Product
Serv-U
On CISA’s list since
Jan 21, 2022 (federal fix deadline Feb 4, 2022)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog documentation.solarwinds.com solarwinds.com
Jan 18, 2022October CMS Improper AuthenticationCVE-2021-32648 · Other software · October CMS · reported by GitHubExploitedHigh 8.2
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
Product
October CMS
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install October CMS’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Jan 18, 2022VMware Server Side Request Forgery in vRealize Operations Manager APICVE-2021-21975 · Other software · VMware · reported by security@vmware.comExploitedRansomwareHigh 7.5
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
Product
vRealize Operations Manager API
On CISA’s list since
Jan 18, 2022 (federal fix deadline Feb 1, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com vmware.com
Jan 10, 2022VMware vCenter Server Improper Access ControlCVE-2021-22017 · Other software · VMware · reported by security@vmware.comExploitedMedium 5.3
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
Product
vCenter Server
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jan 24, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com vmware.com
Jan 10, 2022Hikvision Improper Input ValidationCVE-2021-36260 · Network & remote access · Hikvision · reported by hsrc@hikvision.comExploitedCritical 9.8
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
Product
Security cameras web server
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jan 24, 2022)
What to do
Attackers are using this now. Install Hikvision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 10, 2022Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity ReferenceCVE-2019-9670 · Email & office · Synacor · reported by MITREExploitedCritical 9.8
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com rapid7.com
Jan 10, 2022Fortinet FortiOS and FortiProxy Improper AuthorizationCVE-2018-13382 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.1
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
Product
FortiOS and FortiProxy
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Jan 10, 2022Exim Mail Transfer Agent (MTA) Improper Input ValidationCVE-2019-10149 · Other software · Exim · reported by Red HatExploitedCritical 9.8
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Product
Mail Transfer Agent (MTA)
On CISA’s list since
Jan 10, 2022 (federal fix deadline Jul 10, 2022)
What to do
Attackers are using this now. Install Exim’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org packetstormsecurity.com
Dec 10, 2021Zoho Desktop Central Authentication Bypass VulnerabilityCVE-2021-44515 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.
Product
Desktop Central
On CISA’s list since
Dec 10, 2021 (federal fix deadline Dec 24, 2021)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog pitstop.manageengine.com cisa.gov
Dec 10, 2021Linux Kernel Improper Privilege Management VulnerabilityCVE-2019-13272 · Computers, phones & browsers · Linux · reported by MITREExploitedHigh 7.8
Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.
Product
Kernel
On CISA’s list since
Dec 10, 2021 (federal fix deadline Jun 10, 2022)
What to do
Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Dec 10, 2021Realtek Jungle SDK Remote Code Execution VulnerabilityCVE-2021-35394 · Network & remote access · Realtek · reported by MITREExploitedCritical 9.8
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
Product
Jungle Software Development Kit (SDK)
On CISA’s list since
Dec 10, 2021 (federal fix deadline Dec 24, 2021)
What to do
Attackers are using this now. Install Realtek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog iot-inspector.com realtek.com
Dec 1, 2021Qualcomm Multiple Chipsets Improper Input Validation VulnerabilityCVE-2020-11261 · Computers, phones & browsers · Qualcomm · reported by product-security@qualcomm.comExploitedHigh 7.8
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
On CISA’s list since
Dec 1, 2021 (federal fix deadline Jun 1, 2022)
What to do
Attackers are using this now. Install Qualcomm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qualcomm.com qualcomm.com
Nov 3, 2021Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation VulnerabilityCVE-2021-33739 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.4
Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass VulnerabilityCVE-2020-8193 · Network & remote access · Citrix · reported by support@hackerone.comExploitedMedium 6.5
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCVE-2020-8195 · Network & remote access · Citrix · reported by support@hackerone.comExploitedMedium 6.5
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCVE-2020-8196 · Network & remote access · Citrix · reported by support@hackerone.comExploitedMedium 4.3
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com support.citrix.com
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution VulnerabilityCVE-2019-19781 · Network & remote access · Citrix · reported by MITREExploitedRansomwareCritical 9.8
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.
Product
Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Docker Desktop Community Edition Privilege Escalation VulnerabilityCVE-2019-15752 · Other software · Docker · reported by MITREExploitedHigh 7.8
Docker Desktop Community Edition contains a vulnerability that may allow local users to escalate privileges by placing a trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\.
Product
Desktop Community Edition
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Docker’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com lists.apache.org
Nov 3, 2021EyesOfNetwork Improper Privilege Management VulnerabilityCVE-2020-8655 · Other software · EyesOfNetwork · reported by MITREExploitedHigh 7.8
EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7.
Product
EyesOfNetwork
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install EyesOfNetwork’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Fortinet FortiOS SSL VPN Improper Authentication VulnerabilityCVE-2020-12812 · Network & remote access · Fortinet · reported by psirt@fortinet.comExploitedRansomwareCritical 9.8
Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
Product
FortiOS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com fortiguard.com
Nov 3, 2021Google Chromium Intents Improper Input Validation VulnerabilityCVE-2021-38000 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedMedium 6.1
Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium Intents
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog chromereleases.googleblog.com crbug.com
Nov 3, 2021Google Chromium V8 Improper Input Validation VulnerabilityCVE-2021-21220 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedHigh 8.8
Google Chromium V8 Engine contains an improper input validation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Product
Chromium V8
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021McAfee Total Protection (MTP) Improper Privilege Management VulnerabilityCVE-2021-23874 · Other software · McAfee · reported by trellixpsirt@trellix.comExploitedHigh 8.2
McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense.
Product
McAfee Total Protection (MTP)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install McAfee’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog service.mcafee.com service.mcafee.com
Nov 3, 2021Micro Focus Operation Bridge Report (OBR) Remote Code Execution VulnerabilityCVE-2021-22502 · Other software · Micro Focus · reported by security@opentext.comExploitedCritical 9.8
Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution.
Product
Operation Bridge Reporter (OBR)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Micro Focus’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com softwaresupport.softwaregrp.com
Nov 3, 2021Microsoft Open Management Infrastructure (OMI) Remote Code Execution VulnerabilityCVE-2021-38647 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 9.8
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.
Product
Open Management Infrastructure (OMI)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Nov 3, 2021Microsoft Open Management Infrastructure (OMI) Privilege Escalation VulnerabilityCVE-2021-38645 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.
Product
Open Management Infrastructure (OMI)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Open Management Infrastructure (OMI) Privilege Escalation VulnerabilityCVE-2021-38649 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
Product
Open Management Infrastructure (OMI)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Microsoft Remote Desktop Services Remote Code Execution VulnerabilityCVE-2019-0708 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 9.8
Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.
Product
Remote Desktop Services
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Microsoft Open Management Infrastructure (OMI) Privilege Escalation VulnerabilityCVE-2021-38648 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
Product
Open Management Infrastructure (OMI)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Nov 3, 2021SonicWall Email Security Improper Privilege Management VulnerabilityCVE-2021-20021 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.
Product
SonicWall Email Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Nov 3, 2021Sophos SFOS SQL Injection VulnerabilityCVE-2020-12271 · Network & remote access · Sophos · reported by MITREExploitedRansomwareCritical 9.8
Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).
Product
SFOS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Sophos’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.sophos.com cwe.mitre.org
Nov 3, 2021TeamViewer Desktop Bypass Remote Login VulnerabilityCVE-2019-18988 · Other software · TeamViewer · reported by MITREExploitedHigh 7
TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system).
Product
Desktop
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install TeamViewer’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.teamviewer.com community.teamviewer.com
Nov 3, 2021Trend Micro Multiple Products Improper Access Control VulnerabilityCVE-2020-24557 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.8
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.
Product
Apex One, OfficeScan, and Worry-Free Business Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021Trend Micro Multiple Products Improper Input Validation VulnerabilityCVE-2021-36742 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.8
Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.
Product
Apex One, Apex One as a Service, and Worry-Free Business Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021Trend Micro Multiple Products Improper Input Validation VulnerabilityCVE-2021-36741 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 8.8
Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.
Product
Apex One, Apex One as a Service, and Worry-Free Business Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog success.trendmicro.com success.trendmicro.com
Nov 3, 2021VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow VulnerabilityCVE-2019-5544 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.
Product
VMware ESXi and Horizon DaaS
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com
Nov 3, 2021VMware ESXi OpenSLP Use-After-Free VulnerabilityCVE-2020-3992 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.
Product
ESXi
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com zerodayinitiative.com
Nov 3, 2021VMware vCenter Server Improper Input Validation VulnerabilityCVE-2021-21985 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8
VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.
Product
vCenter Server
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Zoho ManageEngine Desktop Central File Upload VulnerabilityCVE-2020-10189 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.
Product
ManageEngine
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com cwe.mitre.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.