Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
374 results · page 7 of 8
Mar 3, 2022Cisco IOS Software and Cisco IOS XE Software Denial-of-Service VulnerabilityCVE-2017-6663 · Network & remote access · CiscoExploited
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in denial-of-service (DoS).
- Product
- IOS and IOS XE Software
- On CISA’s list since
- Mar 3, 2022 (federal fix deadline Mar 24, 2022)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 3, 2022Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service VulnerabilityCVE-2017-6627 · Network & remote access · CiscoExploited
A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and denial of service.
- Product
- IOS and IOS XE Software
- On CISA’s list since
- Mar 3, 2022 (federal fix deadline Mar 24, 2022)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 3, 2022Cisco IOS and IOS XE Software DHCP Remote Code Execution VulnerabilityCVE-2017-12240 · Network & remote access · CiscoExploited
The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system.
- Product
- IOS and IOS XE Software
- On CISA’s list since
- Mar 3, 2022 (federal fix deadline Mar 24, 2022)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 3, 2022Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service VulnerabilityCVE-2017-12238 · Network & remote access · CiscoExploited
A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a denial of service.
- Product
- Catalyst 6800 Series Switches
- On CISA’s list since
- Mar 3, 2022 (federal fix deadline Mar 24, 2022)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 3, 2022Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service VulnerabilityCVE-2017-12237 · Network & remote access · CiscoExploited
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service.
- Product
- IOS and IOS XE Software
- On CISA’s list since
- Mar 3, 2022 (federal fix deadline Mar 24, 2022)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 3, 2022Cisco IOS Software Common Industrial Protocol Request Denial-of-Service VulnerabilityCVE-2017-12234 · Network & remote access · CiscoExploited
There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.
- Product
- IOS software
- On CISA’s list since
- Mar 3, 2022 (federal fix deadline Mar 24, 2022)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 3, 2022Cisco IOS Software Common Industrial Protocol Request Denial-of-Service VulnerabilityCVE-2017-12233 · Network & remote access · CiscoExploited
There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.
- Product
- IOS software
- On CISA’s list since
- Mar 3, 2022 (federal fix deadline Mar 24, 2022)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 3, 2022Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service VulnerabilityCVE-2017-12232 · Network & remote access · CiscoExploited
A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service.
- Product
- IOS software
- On CISA’s list since
- Mar 3, 2022 (federal fix deadline Mar 24, 2022)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 3, 2022Cisco IOS Software Network Address Translation Denial-of-Service VulnerabilityCVE-2017-12231 · Network & remote access · CiscoExploited
A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS could allow an unauthenticated, remote attacker to cause a denial of service.
- Product
- IOS software
- On CISA’s list since
- Mar 3, 2022 (federal fix deadline Mar 24, 2022)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 3, 2022Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service VulnerabilityCVE-2017-12319 · Network & remote access · CiscoExploited
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.
- Product
- IOS XE Software
- On CISA’s list since
- Mar 3, 2022 (federal fix deadline Mar 24, 2022)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 3, 2022Cisco IOS and XE Software Internet Key Exchange Memory Leak VulnerabilityCVE-2018-0158 · Network & remote access · CiscoExploited
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.
- Product
- IOS Software and Cisco IOS XE Software
- On CISA’s list since
- Mar 3, 2022 (federal fix deadline Mar 17, 2022)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 10, 2022D-Link DIR-645 Router Remote Code Execution VulnerabilityCVE-2015-2051 · Network & remote access · D-LinkExploited
D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
- Product
- DIR-645 Router
- On CISA’s list since
- Feb 10, 2022 (federal fix deadline Aug 10, 2022)
- What to do
- Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 28, 2022SonicWall SMA 100 Appliances Stack-Based Buffer Overflow VulnerabilityCVE-2021-20038 · Network & remote access · SonicWallExploitedRansomware
SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.
- Product
- SMA 100 Appliances
- On CISA’s list since
- Jan 28, 2022 (federal fix deadline Feb 11, 2022)
- What to do
- Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 18, 2022F5 BIG-IP Traffic Management Microkernel Buffer OverflowCVE-2021-22991 · Network & remote access · F5Exploited
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
- Product
- BIG-IP Traffic Management Microkernel
- On CISA’s list since
- Jan 18, 2022 (federal fix deadline Feb 1, 2022)
- What to do
- Attackers are using this now. Install F5’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 10, 2022Fortinet FortiOS and FortiProxy Improper AuthorizationCVE-2018-13382 · Network & remote access · FortinetExploitedRansomware
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
- Product
- FortiOS and FortiProxy
- On CISA’s list since
- Jan 10, 2022 (federal fix deadline Jul 10, 2022)
- What to do
- Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 10, 2022Fortinet FortiOS and FortiProxy Out-of-bounds WriteCVE-2018-13383 · Network & remote access · FortinetExploitedRansomware
A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
- Product
- FortiOS and FortiProxy
- On CISA’s list since
- Jan 10, 2022 (federal fix deadline Jul 10, 2022)
- What to do
- Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 10, 2022Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityCVE-2019-1579 · Network & remote access · Palo Alto NetworksExploitedRansomware
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
- Product
- PAN-OS
- On CISA’s list since
- Jan 10, 2022 (federal fix deadline Jul 10, 2022)
- What to do
- Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 10, 2022Hikvision Improper Input ValidationCVE-2021-36260 · Network & remote access · HikvisionExploited
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
- Product
- Security cameras web server
- On CISA’s list since
- Jan 10, 2022 (federal fix deadline Jan 24, 2022)
- What to do
- Attackers are using this now. Install Hikvision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 10, 2021Realtek Jungle SDK Remote Code Execution VulnerabilityCVE-2021-35394 · Network & remote access · RealtekExploited
RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.
- Product
- Jungle Software Development Kit (SDK)
- On CISA’s list since
- Dec 10, 2021 (federal fix deadline Dec 24, 2021)
- What to do
- Attackers are using this now. Install Realtek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 10, 2021Fortinet FortiOS Arbitrary File DownloadCVE-2021-44168 · Network & remote access · FortinetExploited
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
- Product
- FortiOS
- On CISA’s list since
- Dec 10, 2021 (federal fix deadline Dec 24, 2021)
- What to do
- Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 1, 2021MikroTik Router OS Directory Traversal VulnerabilityCVE-2018-14847 · Network & remote access · MikroTikExploited
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
- Product
- RouterOS
- On CISA’s list since
- Dec 1, 2021 (federal fix deadline Jun 1, 2022)
- What to do
- Attackers are using this now. Install MikroTik’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021SAP NetWeaver Directory Traversal VulnerabilityCVE-2016-3976 · Network & remote access · SAPExploited
SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.
- Product
- NetWeaver
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021SAP Solution Manager Missing Authentication for Critical Function VulnerabilityCVE-2020-6207 · Network & remote access · SAPExploited
SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.
- Product
- Solution Manager
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021SAP NetWeaver Missing Authentication for Critical Function VulnerabilityCVE-2020-6287 · Network & remote access · SAPExploited
SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.
- Product
- NetWeaver
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021SAP NetWeaver XML External Entity (XXE) VulnerabilityCVE-2016-9563 · Network & remote access · SAPExploited
SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.
- Product
- NetWeaver
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021SAP NetWeaver Remote Code Execution VulnerabilityCVE-2010-5326 · Network & remote access · SAPExploited
SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.
- Product
- NetWeaver
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021SAP Customer Relationship Management (CRM) Path Traversal VulnerabilityCVE-2018-2380 · Network & remote access · SAPExploitedRansomware
SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
- Product
- Customer Relationship Management (CRM)
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install SAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Realtek AP-Router SDK Buffer Overflow VulnerabilityCVE-2021-35395 · Network & remote access · RealtekExploited
Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS).
- Product
- AP-Router SDK
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline Nov 17, 2021)
- What to do
- Attackers are using this now. Install Realtek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Ivanti Pulse Connect Secure and Policy Secure Command Injection VulnerabilityCVE-2019-11539 · Network & remote access · IvantiExploitedRansomware
Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.
- Product
- Pulse Connect Secure and Pulse Policy Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Ivanti Pulse Connect Secure Command Injection VulnerabilityCVE-2021-22899 · Network & remote access · IvantiExploited
Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles.
- Product
- Pulse Connect Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Ivanti Pulse Connect Secure Code Execution VulnerabilityCVE-2020-8260 · Network & remote access · IvantiExploited
Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.
- Product
- Pulse Connect Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow VulnerabilityCVE-2021-22894 · Network & remote access · IvantiExploited
Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room.
- Product
- Pulse Connect Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Ivanti Pulse Connect Secure Unrestricted File Upload VulnerabilityCVE-2021-22900 · Network & remote access · IvantiExploited
Ivanti Pulse Connect Secure contains an unrestricted file upload vulnerability that allows an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
- Product
- Pulse Connect Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Ivanti Pulse Connect Secure Code Execution VulnerabilityCVE-2020-8243 · Network & remote access · IvantiExploited
Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution.
- Product
- Pulse Connect Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Netgear JGS516PE Devices Missing Function Level Access Control VulnerabilityCVE-2020-26919 · Network & remote access · NETGEARExploited
Netgear JGS516PE devices contain a missing function level access control vulnerability.
- Product
- JGS516PE Devices
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Ivanti MobileIron Multiple Products Remote Code Execution VulnerabilityCVE-2020-15505 · Network & remote access · IvantiExploited
Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution.
- Product
- MobileIron Multiple Products
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Ivanti Pulse Connect Secure Use-After-Free VulnerabilityCVE-2021-22893 · Network & remote access · IvantiExploitedRansomware
Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.
- Product
- Pulse Connect Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCVE-2020-8196 · Network & remote access · CitrixExploited
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
- Product
- Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Fortinet FortiOS SSL VPN Path Traversal VulnerabilityCVE-2018-13379 · Network & remote access · FortinetExploitedRansomware
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
- Product
- FortiOS
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution VulnerabilityCVE-2021-22986 · Network & remote access · F5ExploitedRansomware
F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.
- Product
- BIG-IP and BIG-IQ Centralized Management
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline Nov 17, 2021)
- What to do
- Attackers are using this now. Install F5’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Zyxel Multiple Products Use of Hard-Coded Credentials VulnerabilityCVE-2020-29583 · Network & remote access · ZyxelExploited
Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.
- Product
- Multiple Products
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Ivanti Pulse Connect Secure Arbitrary File Read VulnerabilityCVE-2019-11510 · Network & remote access · IvantiExploitedRansomware
Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.
- Product
- Pulse Connect Secure
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution VulnerabilityCVE-2020-5902 · Network & remote access · F5ExploitedRansomware
F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.
- Product
- BIG-IP
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install F5’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Fortinet FortiOS SSL VPN Improper Authentication VulnerabilityCVE-2020-12812 · Network & remote access · FortinetExploitedRansomware
Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
- Product
- FortiOS
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass VulnerabilityCVE-2020-8193 · Network & remote access · CitrixExploited
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.
- Product
- Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Multiple DrayTek Vigor Routers Web Management Page VulnerabilityCVE-2020-8515 · Network & remote access · DrayTekExploited
DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
- Product
- Multiple Vigor Routers
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021D-Link DNS-320 Device Command Injection VulnerabilityCVE-2020-25506 · Network & remote access · D-LinkExploited
D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.
- Product
- DNS-320 Device
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021D-Link DIR-825 R1 Devices Buffer Overflow VulnerabilityCVE-2020-29557 · Network & remote access · D-LinkExploited
D-Link DIR-825 R1 devices contain a buffer overflow vulnerability in the web interface that may allow for remote code execution.
- Product
- DIR-825 R1 Devices
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Citrix Workspace Application and Receiver for Windows Remote Code Execution VulnerabilityCVE-2019-11634 · Network & remote access · CitrixExploitedRansomware
Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.
- Product
- Workspace Application and Receiver for Windows
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 3, 2021Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution VulnerabilityCVE-2019-19781 · Network & remote access · CitrixExploitedRansomware
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.
- Product
- Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Citrix’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.