Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,754 results · page 11 of 36
Feb 4, 2025Microsoft .NET Framework Information Disclosure VulnerabilityCVE-2024-29059 · Computers, phones & browsers · MicrosoftExploited
Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.
- Product
- .NET Framework
- On CISA’s list since
- Feb 4, 2025 (federal fix deadline Feb 25, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 29, 2025Apple Multiple Products Use-After-Free VulnerabilityCVE-2025-24085 · Computers, phones & browsers · AppleExploited
Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.
- Product
- Multiple Products
- On CISA’s list since
- Jan 29, 2025 (federal fix deadline Feb 19, 2025)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 24, 2025SonicWall SMA1000 Appliances Deserialization VulnerabilityCVE-2025-23006 · Network & remote access · SonicWallExploitedRansomware
SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.
- Product
- SMA1000 Appliances
- On CISA’s list since
- Jan 24, 2025 (federal fix deadline Feb 14, 2025)
- What to do
- Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 23, 2025JQuery Cross-Site Scripting (XSS) VulnerabilityCVE-2020-11023 · Other software · JQueryExploited
JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.
- Product
- JQuery
- On CISA’s list since
- Jan 23, 2025 (federal fix deadline Feb 13, 2025)
- What to do
- Attackers are using this now. Install JQuery’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 16, 2025Aviatrix Controllers OS Command Injection VulnerabilityCVE-2024-50603 · Other software · AviatrixExploited
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
- Product
- Controllers
- On CISA’s list since
- Jan 16, 2025 (federal fix deadline Feb 6, 2025)
- What to do
- Attackers are using this now. Install Aviatrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityCVE-2025-21334 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
- Product
- Windows
- On CISA’s list since
- Jan 14, 2025 (federal fix deadline Feb 4, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow VulnerabilityCVE-2025-21333 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.
- Product
- Windows
- On CISA’s list since
- Jan 14, 2025 (federal fix deadline Feb 4, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 14, 2025Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityCVE-2024-55591 · Network & remote access · FortinetExploitedRansomware
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
- Product
- FortiOS and FortiProxy
- On CISA’s list since
- Jan 14, 2025 (federal fix deadline Jan 21, 2025)
- What to do
- Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 14, 2025Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityCVE-2025-21335 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
- Product
- Windows
- On CISA’s list since
- Jan 14, 2025 (federal fix deadline Feb 4, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 13, 2025Qlik Sense HTTP Tunneling VulnerabilityCVE-2023-48365 · Other software · QlikExploitedRansomware
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
- Product
- Sense
- On CISA’s list since
- Jan 13, 2025 (federal fix deadline Feb 3, 2025)
- What to do
- Attackers are using this now. Install Qlik’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 13, 2025BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection VulnerabilityCVE-2024-12686 · Other software · BeyondTrustExploited
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
- Product
- Privileged Remote Access (PRA) and Remote Support (RS)
- On CISA’s list since
- Jan 13, 2025 (federal fix deadline Feb 3, 2025)
- What to do
- Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 8, 2025Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityCVE-2025-0282 · Network & remote access · IvantiExploitedRansomware
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
- Product
- Connect Secure, Policy Secure, and ZTA Gateways
- On CISA’s list since
- Jan 8, 2025 (federal fix deadline Jan 15, 2025)
- What to do
- Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 7, 2025Oracle WebLogic Server Unspecified VulnerabilityCVE-2020-2883 · Websites & servers · OracleExploited
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.
- Product
- WebLogic Server
- On CISA’s list since
- Jan 7, 2025 (federal fix deadline Jan 28, 2025)
- What to do
- Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 7, 2025Mitel MiCollab Path Traversal VulnerabilityCVE-2024-55550 · Email & office · MitelExploitedRansomware
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
- Product
- MiCollab
- On CISA’s list since
- Jan 7, 2025 (federal fix deadline Jan 28, 2025)
- What to do
- Attackers are using this now. Install Mitel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 7, 2025Mitel MiCollab Path Traversal VulnerabilityCVE-2024-41713 · Email & office · MitelExploitedRansomware
Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
- Product
- MiCollab
- On CISA’s list since
- Jan 7, 2025 (federal fix deadline Jan 28, 2025)
- What to do
- Attackers are using this now. Install Mitel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 30, 2024Palo Alto Networks PAN-OS Malicious DNS Packet VulnerabilityCVE-2024-3393 · Network & remote access · Palo Alto NetworksExploited
Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
- Product
- PAN-OS
- On CISA’s list since
- Dec 30, 2024 (federal fix deadline Jan 20, 2025)
- What to do
- Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 23, 2024Acclaim Systems USAHERDS Use of Hard-Coded Credentials Vulnerability CVE-2021-44207 · Other software · Acclaim SystemsExploited
Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel.
- Product
- USAHERDS
- On CISA’s list since
- Dec 23, 2024 (federal fix deadline Jan 13, 2025)
- What to do
- Attackers are using this now. Install Acclaim Systems’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 19, 2024BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability CVE-2024-12356 · Other software · BeyondTrustExploited
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
- Product
- Privileged Remote Access (PRA) and Remote Support (RS)
- On CISA’s list since
- Dec 19, 2024 (federal fix deadline Dec 27, 2024)
- What to do
- Attackers are using this now. Install BeyondTrust’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 18, 2024Reolink RLC-410W IP Camera OS Command Injection Vulnerability CVE-2021-40407 · Other software · ReolinkExploited
Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality.
- Product
- RLC-410W IP Camera
- On CISA’s list since
- Dec 18, 2024 (federal fix deadline Jan 8, 2025)
- What to do
- Attackers are using this now. Install Reolink’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 18, 2024Reolink Multiple IP Cameras OS Command Injection VulnerabilityCVE-2019-11001 · Other software · ReolinkExploited
Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root.
- Product
- Multiple IP Cameras
- On CISA’s list since
- Dec 18, 2024 (federal fix deadline Jan 8, 2025)
- What to do
- Attackers are using this now. Install Reolink’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 18, 2024NUUO NVRmini2 Devices Missing Authentication Vulnerability CVE-2022-23227 · Other software · NUUOExploited
NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users.
- Product
- NVRmini2 Devices
- On CISA’s list since
- Dec 18, 2024 (federal fix deadline Jan 8, 2025)
- What to do
- Attackers are using this now. Install NUUO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 18, 2024NUUO NVRmini Devices OS Command Injection Vulnerability CVE-2018-14933 · Other software · NUUOExploited
NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
- Product
- NVRmini Devices
- On CISA’s list since
- Dec 18, 2024 (federal fix deadline Jan 8, 2025)
- What to do
- Attackers are using this now. Install NUUO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 17, 2024Cleo Multiple Products Unauthenticated File Upload VulnerabilityCVE-2024-55956 · Other software · CleoExploitedRansomware
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.
- Product
- Multiple Products
- On CISA’s list since
- Dec 17, 2024 (federal fix deadline Jan 7, 2025)
- What to do
- Attackers are using this now. Install Cleo’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 16, 2024Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability CVE-2024-35250 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.
- Product
- Windows
- On CISA’s list since
- Dec 16, 2024 (federal fix deadline Jan 6, 2025)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 16, 2024Adobe ColdFusion Improper Access Control VulnerabilityCVE-2024-20767 · Websites & servers · AdobeExploited
Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.
- Product
- ColdFusion
- On CISA’s list since
- Dec 16, 2024 (federal fix deadline Jan 6, 2025)
- What to do
- Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 13, 2024Cleo Multiple Products Unrestricted File Upload VulnerabilityCVE-2024-50623 · Other software · CleoExploitedRansomware
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
- Product
- Multiple Products
- On CISA’s list since
- Dec 13, 2024 (federal fix deadline Jan 3, 2025)
- What to do
- Attackers are using this now. Install Cleo’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 10, 2024Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityCVE-2024-49138 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.
- Product
- Windows
- On CISA’s list since
- Dec 10, 2024 (federal fix deadline Dec 31, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 4, 2024CyberPanel Incorrect Default Permissions VulnerabilityCVE-2024-51378 · Other software · CyberPersonsExploitedRansomware
CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.
- Product
- CyberPanel
- On CISA’s list since
- Dec 4, 2024 (federal fix deadline Dec 25, 2024)
- What to do
- Attackers are using this now. Install CyberPersons’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 3, 2024Zyxel Multiple Firewalls Path Traversal VulnerabilityCVE-2024-11667 · Network & remote access · ZyxelExploitedRansomware
Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
- Product
- Multiple Firewalls
- On CISA’s list since
- Dec 3, 2024 (federal fix deadline Dec 24, 2024)
- What to do
- Attackers are using this now. Install Zyxel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 3, 2024ProjectSend Improper Authentication VulnerabilityCVE-2024-11680 · Other software · ProjectSendExploited
ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
- Product
- ProjectSend
- On CISA’s list since
- Dec 3, 2024 (federal fix deadline Dec 24, 2024)
- What to do
- Attackers are using this now. Install ProjectSend’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 3, 2024North Grid Proself Improper Restriction of XML External Entity (XXE) Reference VulnerabilityCVE-2023-45727 · Other software · North GridExploited
North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack.
- Product
- Proself
- On CISA’s list since
- Dec 3, 2024 (federal fix deadline Dec 24, 2024)
- What to do
- Attackers are using this now. Install North Grid’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 25, 2024Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function VulnerabilityCVE-2023-28461 · Network & remote access · Array Networks ExploitedRansomware
Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.
- Product
- AG/vxAG ArrayOS
- On CISA’s list since
- Nov 25, 2024 (federal fix deadline Dec 16, 2024)
- What to do
- Attackers are using this now. Install Array Networks ’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 21, 2024Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization VulnerabilityCVE-2024-21287 · Other software · OracleExploited
Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.
- Product
- Agile Product Lifecycle Management (PLM)
- On CISA’s list since
- Nov 21, 2024 (federal fix deadline Dec 12, 2024)
- What to do
- Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 21, 2024Apple Multiple Products Cross-Site Scripting (XSS) VulnerabilityCVE-2024-44309 · Computers, phones & browsers · AppleExploited
Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack.
- Product
- Multiple Products
- On CISA’s list since
- Nov 21, 2024 (federal fix deadline Dec 12, 2024)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 21, 2024Apple Multiple Products Code Execution VulnerabilityCVE-2024-44308 · Computers, phones & browsers · AppleExploited
Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution.
- Product
- Multiple Products
- On CISA’s list since
- Nov 21, 2024 (federal fix deadline Dec 12, 2024)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 20, 2024VMware vCenter Server Privilege Escalation VulnerabilityCVE-2024-38813 · Other software · VMwareExploited
VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet.
- Product
- vCenter Server
- On CISA’s list since
- Nov 20, 2024 (federal fix deadline Dec 11, 2024)
- What to do
- Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 20, 2024VMware vCenter Server Heap-Based Buffer Overflow VulnerabilityCVE-2024-38812 · Other software · VMwareExploited
VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet.
- Product
- vCenter Server
- On CISA’s list since
- Nov 20, 2024 (federal fix deadline Dec 11, 2024)
- What to do
- Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 18, 2024Palo Alto Networks PAN-OS Management Interface OS Command Injection VulnerabilityCVE-2024-9474 · Network & remote access · Palo Alto NetworksExploitedRansomware
Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
- Product
- PAN-OS
- On CISA’s list since
- Nov 18, 2024 (federal fix deadline Dec 9, 2024)
- What to do
- Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 18, 2024Palo Alto Networks PAN-OS Management Interface Authentication Bypass VulnerabilityCVE-2024-0012 · Network & remote access · Palo Alto NetworksExploitedRansomware
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
- Product
- PAN-OS
- On CISA’s list since
- Nov 18, 2024 (federal fix deadline Dec 9, 2024)
- What to do
- Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 18, 2024Progress Kemp LoadMaster OS Command Injection VulnerabilityCVE-2024-1212 · Other software · ProgressExploited
Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.
- Product
- Kemp LoadMaster
- On CISA’s list since
- Nov 18, 2024 (federal fix deadline Dec 9, 2024)
- What to do
- Attackers are using this now. Install Progress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 14, 2024Palo Alto Networks Expedition SQL Injection VulnerabilityCVE-2024-9465 · Network & remote access · Palo Alto NetworksExploited
Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
- Product
- Expedition
- On CISA’s list since
- Nov 14, 2024 (federal fix deadline Dec 5, 2024)
- What to do
- Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 14, 2024Palo Alto Networks Expedition OS Command Injection VulnerabilityCVE-2024-9463 · Network & remote access · Palo Alto NetworksExploited
Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
- Product
- Expedition
- On CISA’s list since
- Nov 14, 2024 (federal fix deadline Dec 5, 2024)
- What to do
- Attackers are using this now. Install Palo Alto Networks’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 12, 2024Metabase GeoJSON API Local File Inclusion VulnerabilityCVE-2021-41277 · Other software · MetabaseExploited
Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data.
- Product
- Metabase
- On CISA’s list since
- Nov 12, 2024 (federal fix deadline Dec 3, 2024)
- What to do
- Attackers are using this now. Install Metabase’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 12, 2024Atlassian Jira Server and Data Center Path Traversal VulnerabilityCVE-2021-26086 · Websites & servers · AtlassianExploited
Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint.
- Product
- Jira Server and Data Center
- On CISA’s list since
- Nov 12, 2024 (federal fix deadline Dec 3, 2024)
- What to do
- Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 12, 2024Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) VulnerabilityCVE-2014-2120 · Network & remote access · CiscoExploited
Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter.
- Product
- Adaptive Security Appliance (ASA)
- On CISA’s list since
- Nov 12, 2024 (federal fix deadline Dec 3, 2024)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 12, 2024Microsoft Windows NTLMv2 Hash Disclosure Spoofing VulnerabilityCVE-2024-43451 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.
- Product
- Windows
- On CISA’s list since
- Nov 12, 2024 (federal fix deadline Dec 3, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 12, 2024Microsoft Windows Task Scheduler Privilege Escalation VulnerabilityCVE-2024-49039 · Computers, phones & browsers · MicrosoftExploitedRansomware
Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.
- Product
- Windows
- On CISA’s list since
- Nov 12, 2024 (federal fix deadline Dec 3, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 7, 2024Nostromo nhttpd Directory Traversal VulnerabilityCVE-2019-16278 · Other software · NostromoExploited
Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution.
- Product
- nhttpd
- On CISA’s list since
- Nov 7, 2024 (federal fix deadline Nov 28, 2024)
- What to do
- Attackers are using this now. Install Nostromo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 7, 2024CyberPanel Incorrect Default Permissions VulnerabilityCVE-2024-51567 · Other software · CyberPersonsExploitedRansomware
CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.
- Product
- CyberPanel
- On CISA’s list since
- Nov 7, 2024 (federal fix deadline Nov 28, 2024)
- What to do
- Attackers are using this now. Install CyberPersons’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 7, 2024Android Framework Privilege Escalation VulnerabilityCVE-2024-43093 · Computers, phones & browsers · AndroidExploited
Android Framework contains an unspecified vulnerability that allows for privilege escalation.
- Product
- Framework
- On CISA’s list since
- Nov 7, 2024 (federal fix deadline Nov 28, 2024)
- What to do
- Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.