Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

567new WordPress flaws this week

391,397entries in the database

663 results · page 10 of 14

Mar 28, 2022Adobe Reader and Acrobat Arbitrary Integer Overflow VulnerabilityCVE-2013-2729 · Email & office · Adobe · reported by AdobeExploitedCritical 9.8
Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.
Product
Reader and Acrobat
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org rhn.redhat.com
Mar 28, 2022Mozilla Firefox and Thunderbird Denial-of-Service VulnerabilityCVE-2013-1690 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgExploitedHigh 8.8
Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.
Product
Firefox and Thunderbird
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Mozilla’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 28, 2022Oracle Java SE Sandbox Bypass VulnerabilityCVE-2012-5076 · Other software · Oracle · reported by secalert_us@oracle.comExploitedCritical 9.8
The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.
Product
Java SE
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 18, 2022)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org rhn.redhat.com
Mar 28, 2022Microsoft Windows Kernel Stack-Based Buffer Overflow VulnerabilityCVE-2010-4398 · Computers, phones & browsers · Microsoft · reported by MITREExploitedHigh 7.8
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.
Product
Windows
On CISA’s list since
Mar 28, 2022 (federal fix deadline Apr 21, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog isc.sans.edu nakedsecurity.sophos.com
Mar 25, 2022Citrix Multiple Products Remote Code Execution VulnerabilityCVE-2017-6316 · Network & remote access · Citrix · reported by MITREExploitedCritical 9.8
A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.
Product
NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow VulnerabilityCVE-2009-0927 · Email & office · Adobe · reported by MITREExploitedHigh 8.8
Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.
Product
Reader and Acrobat
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog lists.opensuse.org lists.opensuse.org
Mar 25, 2022Microsoft Windows Print Spooler Privilege Escalation VulnerabilityCVE-2022-21999 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.
Product
Windows
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Mar 25, 2022NETGEAR DGN2200 Devices OS Command Injection VulnerabilityCVE-2017-6334 · Network & remote access · NETGEAR · reported by MITREExploitedHigh 8.8
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands
Product
DGN2200 Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Mar 25, 2022LG N1A1 NAS Remote Command Execution VulnerabilityCVE-2018-14839 · Other software · LG · reported by MITREExploitedCritical 9.8
LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability.
Product
N1A1 NAS
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install LG’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog medium.com medium.com
Mar 25, 2022VMware SD-WAN Edge by VeloCloud Command Injection VulnerabilityCVE-2018-6961 · Other software · VMware · reported by security@vmware.comExploitedHigh 8.1
VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution.
Product
SD-WAN Edge
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022WatchGuard Firebox and XTM Appliances Arbitrary Code ExecutionCVE-2022-26318 · Network & remote access · WatchGuard · reported by MITREExploitedCritical 9.8
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.
Product
Firebox and XTM Appliances
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install WatchGuard’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog watchguard.com watchguard.com
Mar 25, 2022Sitecore XP Remote Command Execution VulnerabilityCVE-2021-42237 · Other software · Sitecore · reported by MITREExploitedRansomwareCritical 9.8
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
Product
XP
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Sitecore’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com blog.assetnote.io
Mar 25, 2022D-Link DIR-610 Devices Remote Command ExecutionCVE-2020-9377 · Network & remote access · D-Link · reported by MITREExploitedHigh 8.8
D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.
Product
DIR-610 Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog gist.github.com supportannouncement.us.dlink.com
Mar 25, 2022Zyxel Multiple NAS Devices OS Command Injection VulnerabilityCVE-2020-9054 · Network & remote access · Zyxel · reported by cret@cert.orgExploitedCritical 9.8
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.
Product
Multiple Network-Attached Storage (NAS) Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog cwe.mitre.org kb.cert.org
Mar 25, 2022Apache Kylin OS Command Injection VulnerabilityCVE-2020-1956 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.8
Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
Product
Kylin
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com community.sonarsource.com
Mar 25, 2022D-Link Multiple Routers Command Injection VulnerabilityCVE-2019-16920 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.
Product
Multiple Routers
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog fortiguard.com medium.com
Mar 25, 2022Webmin Command Injection VulnerabilityCVE-2019-15107 · Other software · Webmin · reported by MITREExploitedRansomwareCritical 9.8
An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.
Product
Webmin
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Webmin’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022Citrix SD-WAN and NetScaler Command Injection VulnerabilityCVE-2019-12991 · Network & remote access · Citrix · reported by MITREExploitedHigh 8.8
Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.
Product
SD-WAN and NetScaler
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Mar 25, 2022Citrix SD-WAN and NetScaler SQL Injection VulnerabilityCVE-2019-12989 · Network & remote access · Citrix · reported by MITREExploitedCritical 9.8
Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.
Product
SD-WAN and NetScaler
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com securityfocus.com
Mar 25, 2022Microsoft Windows Shell Remote Code Execution VulnerabilityCVE-2018-8414 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.
Product
Windows
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 25, 2022VMware Tanzu Spring Data Commons Property Binder VulnerabilityCVE-2018-1273 · Other software · VMware Tanzu · reported by security_alert@emc.comExploitedRansomwareCritical 9.8
Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.
Product
Spring Data Commons
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install VMware Tanzu’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mail-archives.apache.org pivotal.io
Mar 25, 2022Quest KACE System Management Appliance Remote Command Execution VulnerabilityCVE-2018-11138 · Other software · Quest · reported by MITREExploitedRansomwareCritical 9.8
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.
Product
KACE System Management Appliance
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Quest’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog coresecurity.com exploit-db.com
Mar 25, 2022Cisco IOS and IOS XE Remote Code Execution VulnerabilityCVE-2017-3881 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.
Product
IOS and IOS XE
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securityfocus.com
Mar 25, 2022Apache Tomcat on Windows Remote Code Execution VulnerabilityCVE-2017-12615 · Websites & servers · Apache · reported by security@apache.orgExploitedRansomwareHigh 8.1
When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Product
Tomcat
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Apache’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog breaktoprotect.blogspot.com securityfocus.com
Mar 25, 2022Microsoft Windows SMB Remote Code Execution VulnerabilityCVE-2017-0146 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 8.8
The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution.
Product
Windows
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022NETGEAR Multiple WAP Devices Command Injection VulnerabilityCVE-2016-1555 · Network & remote access · NETGEAR · reported by cret@cert.orgExploitedCritical 9.8
Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.
Product
Wireless Access Point (WAP) Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install NETGEAR’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Mar 25, 2022D-Link DCS-930L Devices OS Command Injection VulnerabilityCVE-2016-11021 · Network & remote access · D-Link · reported by MITREExploitedHigh 7.2
setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.
Product
DCS-930L Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog exploit-db.com exploit-db.com
Mar 25, 2022D-Link and TRENDnet Multiple Devices Remote Code Execution VulnerabilityCVE-2015-1187 · Network & remote access · D-Link and TRENDnet · reported by MITREExploitedCritical 9.8
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.
Product
Multiple Devices
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install D-Link and TRENDnet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution VulnerabilityCVE-2014-6332 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.8
OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.
Product
Windows
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2022HP Multiple Products Remote Code Execution VulnerabilityCVE-2013-4810 · Other software · Hewlett Packard (HP) · reported by hp-security-alert@hp.comExploitedCritical 9.8
HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.
Product
ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management
On CISA’s list since
Mar 25, 2022 (federal fix deadline Apr 15, 2022)
What to do
Attackers are using this now. Install Hewlett Packard (HP)’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog h20565.www2.hp.com marc.info
Mar 15, 2022Microsoft Windows Transaction Manager Privilege Escalation VulnerabilityCVE-2017-0101 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 15, 2022Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation VulnerabilityCVE-2019-1405 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Mar 15, 2022Microsoft Windows Privilege Escalation VulnerabilityCVE-2019-1322 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Mar 15, 2022Microsoft Windows Error Reporting Manager Privilege Escalation VulnerabilityCVE-2019-1315 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Mar 15, 2022Microsoft Windows AppX Deployment Server Privilege Escalation VulnerabilityCVE-2019-1253 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com portal.msrc.microsoft.com
Mar 15, 2022Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation VulnerabilityCVE-2019-1129 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
Mar 15, 2022Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation VulnerabilityCVE-2019-1064 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Mar 15, 2022Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation VulnerabilityCVE-2019-0841 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 15, 2022Microsoft Windows Privilege Escalation VulnerabilityCVE-2019-0543 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com portal.msrc.microsoft.com
Mar 15, 2022Microsoft Windows Kernel Privilege Escalation VulnerabilityCVE-2016-3309 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.
Product
Windows
On CISA’s list since
Mar 15, 2022 (federal fix deadline Apr 5, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com securitytracker.com
Mar 7, 2022Atlassian Jira Server and Data Center Server-Side Template Injection VulnerabilityCVE-2019-11581 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedCritical 9.8
Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.
Product
Jira Server and Data Center
On CISA’s list since
Mar 7, 2022 (federal fix deadline Sep 7, 2022)
What to do
Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jira.atlassian.com jira.atlassian.com
Mar 7, 2022VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) VulnerabilityCVE-2021-21973 · Other software · VMware · reported by security@vmware.comExploitedMedium 5.3
VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.
Product
vCenter Server and Cloud Foundation
On CISA’s list since
Mar 7, 2022 (federal fix deadline Mar 21, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com vmware.com
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20708 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com zerodayinitiative.com
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20703 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com zerodayinitiative.com
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20701 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com zerodayinitiative.com
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20700 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog tools.cisco.com tools.cisco.com
Mar 3, 2022Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityCVE-2022-20699 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 10
A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).
Product
Small Business RV160, RV260, RV340, and RV345 Series Routers
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tools.cisco.com
Mar 3, 2022Microsoft Windows Installer Privilege Escalation VulnerabilityCVE-2021-41379 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareMedium 5.5
Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Mar 3, 2022Treck TCP/IP stack Out-of-Bounds Read VulnerabilityCVE-2020-11899 · Other software · Treck TCP/IP stack · reported by MITREExploitedMedium 5.4
The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability.
Product
IPv6
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Treck TCP/IP stack’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog arubanetworks.com cwe.mitre.org
Mar 3, 2022Exim Out-of-bounds Write VulnerabilityCVE-2019-16928 · Other software · Exim · reported by MITREExploitedCritical 9.8
Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.
Product
Exim Internet Mailer
On CISA’s list since
Mar 3, 2022 (federal fix deadline Mar 17, 2022)
What to do
Attackers are using this now. Install Exim’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com openwall.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.