Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,754 results · page 14 of 36
May 1, 2024GitLab Community and Enterprise Editions Improper Access Control VulnerabilityCVE-2023-7028 · Websites & servers · GitLabExploited
GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.
- Product
- GitLab CE/EE
- On CISA’s list since
- May 1, 2024 (federal fix deadline May 22, 2024)
- What to do
- Attackers are using this now. Install GitLab’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Apr 30, 2024Microsoft SmartScreen Prompt Security Feature Bypass VulnerabilityCVE-2024-29988 · Computers, phones & browsers · MicrosoftExploited
Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.
- Product
- SmartScreen Prompt
- On CISA’s list since
- Apr 30, 2024 (federal fix deadline May 21, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Apr 24, 2024CrushFTP VFS Sandbox Escape VulnerabilityCVE-2024-4040 · Other software · CrushFTPExploited
CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).
- Product
- CrushFTP
- On CISA’s list since
- Apr 24, 2024 (federal fix deadline May 1, 2024)
- What to do
- Attackers are using this now. Install CrushFTP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Apr 24, 2024Cisco ASA and FTD Privilege Escalation VulnerabilityCVE-2024-20359 · Network & remote access · CiscoExploited
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.
- Product
- Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
- On CISA’s list since
- Apr 24, 2024 (federal fix deadline May 1, 2024)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Apr 24, 2024Cisco ASA and FTD Denial of Service VulnerabilityCVE-2024-20353 · Network & remote access · CiscoExploited
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.
- Product
- Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
- On CISA’s list since
- Apr 24, 2024 (federal fix deadline May 1, 2024)
- What to do
- Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Apr 23, 2024Microsoft Windows Print Spooler Privilege Escalation Vulnerability CVE-2022-38028 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.
- Product
- Windows
- On CISA’s list since
- Apr 23, 2024 (federal fix deadline May 14, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Apr 12, 2024Palo Alto Networks PAN-OS Command Injection VulnerabilityCVE-2024-3400 · Network & remote access · Palo Alto NetworksExploitedRansomware
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
- Product
- PAN-OS
- On CISA’s list since
- Apr 12, 2024 (federal fix deadline Apr 19, 2024)
- What to do
- Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Apr 11, 2024D-Link Multiple NAS Devices Command Injection VulnerabilityCVE-2024-3273 · Network & remote access · D-LinkExploited
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
- Product
- Multiple NAS Devices
- On CISA’s list since
- Apr 11, 2024 (federal fix deadline May 2, 2024)
- What to do
- Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Apr 11, 2024D-Link Multiple NAS Devices Use of Hard-Coded Credentials VulnerabilityCVE-2024-3272 · Network & remote access · D-LinkExploited
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.
- Product
- Multiple NAS Devices
- On CISA’s list since
- Apr 11, 2024 (federal fix deadline May 2, 2024)
- What to do
- Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Apr 4, 2024Android Pixel Privilege Escalation VulnerabilityCVE-2024-29748 · Computers, phones & browsers · AndroidExploited
Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app.
- Product
- Pixel
- On CISA’s list since
- Apr 4, 2024 (federal fix deadline Apr 25, 2024)
- What to do
- Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Apr 4, 2024Android Pixel Information Disclosure VulnerabilityCVE-2024-29745 · Computers, phones & browsers · AndroidExploited
Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.
- Product
- Pixel
- On CISA’s list since
- Apr 4, 2024 (federal fix deadline Apr 25, 2024)
- What to do
- Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 26, 2024Microsoft SharePoint Server Code Injection VulnerabilityCVE-2023-24955 · Email & office · MicrosoftExploitedRansomware
Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.
- Product
- SharePoint Server
- On CISA’s list since
- Mar 26, 2024 (federal fix deadline Apr 16, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 25, 2024Nice Linear eMerge E3-Series OS Command Injection VulnerabilityCVE-2019-7256 · Other software · NiceExploited
Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.
- Product
- Linear eMerge E3-Series
- On CISA’s list since
- Mar 25, 2024 (federal fix deadline Apr 15, 2024)
- What to do
- Attackers are using this now. Install Nice’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 25, 2024Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability CVE-2021-44529 · Network & remote access · IvantiExploitedRansomware
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).
- Product
- Endpoint Manager Cloud Service Appliance (EPM CSA)
- On CISA’s list since
- Mar 25, 2024 (federal fix deadline Apr 15, 2024)
- What to do
- Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 25, 2024Fortinet FortiClient EMS SQL Injection VulnerabilityCVE-2023-48788 · Network & remote access · FortinetExploitedRansomware
Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.
- Product
- FortiClient EMS
- On CISA’s list since
- Mar 25, 2024 (federal fix deadline Apr 15, 2024)
- What to do
- Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 7, 2024JetBrains TeamCity Authentication Bypass VulnerabilityCVE-2024-27198 · Other software · JetBrainsExploitedRansomware
JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.
- Product
- TeamCity
- On CISA’s list since
- Mar 7, 2024 (federal fix deadline Mar 28, 2024)
- What to do
- Attackers are using this now. Install JetBrains’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 6, 2024Apple Multiple Products Memory Corruption VulnerabilityCVE-2024-23225 · Computers, phones & browsers · AppleExploited
Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.
- Product
- Multiple Products
- On CISA’s list since
- Mar 6, 2024 (federal fix deadline Mar 27, 2024)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 6, 2024Apple Multiple Products Memory Corruption VulnerabilityCVE-2024-23296 · Computers, phones & browsers · AppleExploited
Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.
- Product
- Multiple Products
- On CISA’s list since
- Mar 6, 2024 (federal fix deadline Mar 27, 2024)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 5, 2024Android Pixel Information Disclosure Vulnerability CVE-2023-21237 · Computers, phones & browsers · AndroidExploited
Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information.
- Product
- Pixel
- On CISA’s list since
- Mar 5, 2024 (federal fix deadline Mar 26, 2024)
- What to do
- Attackers are using this now. Install Android’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 5, 2024Sunhillo SureLine OS Command Injection VulnerablityCVE-2021-36380 · Other software · SunhilloExploited
Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi.
- Product
- SureLine
- On CISA’s list since
- Mar 5, 2024 (federal fix deadline Mar 26, 2024)
- What to do
- Attackers are using this now. Install Sunhillo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 4, 2024Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control VulnerabilityCVE-2024-21338 · Computers, phones & browsers · MicrosoftExploitedRansomware
Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.
- Product
- Windows
- On CISA’s list since
- Mar 4, 2024 (federal fix deadline Mar 25, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 29, 2024Microsoft Streaming Service Untrusted Pointer Dereference VulnerabilityCVE-2023-29360 · Computers, phones & browsers · MicrosoftExploited
Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.
- Product
- Streaming Service
- On CISA’s list since
- Feb 29, 2024 (federal fix deadline Mar 21, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 22, 2024ConnectWise ScreenConnect Authentication Bypass VulnerabilityCVE-2024-1709 · Other software · ConnectWiseExploitedRansomware
ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.
- Product
- ScreenConnect
- On CISA’s list since
- Feb 22, 2024 (federal fix deadline Feb 29, 2024)
- What to do
- Attackers are using this now. Install ConnectWise’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 15, 2024Cisco ASA and FTD Information Disclosure VulnerabilityCVE-2020-3259 · Network & remote access · CiscoExploitedRansomware
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.
- Product
- Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)
- On CISA’s list since
- Feb 15, 2024 (federal fix deadline Mar 7, 2024)
- What to do
- Attackers are using this now. Install Cisco’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 15, 2024Microsoft Exchange Server Privilege Escalation VulnerabilityCVE-2024-21410 · Email & office · MicrosoftExploited
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.
- Product
- Exchange Server
- On CISA’s list since
- Feb 15, 2024 (federal fix deadline Mar 7, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 13, 2024Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2024-21351 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.
- Product
- Windows
- On CISA’s list since
- Feb 13, 2024 (federal fix deadline Mar 5, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 13, 2024Microsoft Windows Internet Shortcut Files Security Feature Bypass VulnerabilityCVE-2024-21412 · Computers, phones & browsers · MicrosoftExploitedRansomware
Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.
- Product
- Windows
- On CISA’s list since
- Feb 13, 2024 (federal fix deadline Mar 5, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 12, 2024Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityCVE-2023-43770 · Websites & servers · RoundcubeExploited
Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.
- Product
- Webmail
- On CISA’s list since
- Feb 12, 2024 (federal fix deadline Mar 4, 2024)
- What to do
- Attackers are using this now. Install Roundcube’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 9, 2024Fortinet FortiOS Out-of-Bound Write VulnerabilityCVE-2024-21762 · Network & remote access · FortinetExploitedRansomware
Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.
- Product
- FortiOS
- On CISA’s list since
- Feb 9, 2024 (federal fix deadline Feb 16, 2024)
- What to do
- Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 6, 2024Google Chromium V8 Type Confusion VulnerabilityCVE-2023-4762 · Computers, phones & browsers · GoogleExploited
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium V8
- On CISA’s list since
- Feb 6, 2024 (federal fix deadline Feb 27, 2024)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 31, 2024Apple Multiple Products Memory Corruption VulnerabilityCVE-2022-48618 · Computers, phones & browsers · AppleExploited
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication.
- Product
- Multiple Products
- On CISA’s list since
- Jan 31, 2024 (federal fix deadline Feb 21, 2024)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 31, 2024Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) VulnerabilityCVE-2024-21893 · Network & remote access · IvantiExploitedRansomware
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.
- Product
- Connect Secure, Policy Secure, and Neurons
- On CISA’s list since
- Jan 31, 2024 (federal fix deadline Feb 2, 2024)
- What to do
- Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 24, 2024Atlassian Confluence Data Center and Server Template Injection VulnerabilityCVE-2023-22527 · Websites & servers · AtlassianExploitedRansomware
Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.
- Product
- Confluence Data Center and Server
- On CISA’s list since
- Jan 24, 2024 (federal fix deadline Feb 14, 2024)
- What to do
- Attackers are using this now. Install Atlassian’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 23, 2024Apple Multiple Products WebKit Type Confusion VulnerabilityCVE-2024-23222 · Computers, phones & browsers · AppleExploited
Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
- Product
- Multiple Products
- On CISA’s list since
- Jan 23, 2024 (federal fix deadline Feb 13, 2024)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 22, 2024VMware vCenter Server Out-of-Bounds Write VulnerabilityCVE-2023-34048 · Other software · VMwareExploited
VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.
- Product
- vCenter Server
- On CISA’s list since
- Jan 22, 2024 (federal fix deadline Feb 12, 2024)
- What to do
- Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 18, 2024Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass VulnerabilityCVE-2023-35082 · Network & remote access · IvantiExploitedRansomware
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.
- Product
- Endpoint Manager Mobile (EPMM) and MobileIron Core
- On CISA’s list since
- Jan 18, 2024 (federal fix deadline Feb 8, 2024)
- What to do
- Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 17, 2024Google Chromium V8 Out-of-Bounds Memory Access VulnerabilityCVE-2024-0519 · Computers, phones & browsers · GoogleExploited
Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium V8
- On CISA’s list since
- Jan 17, 2024 (federal fix deadline Feb 7, 2024)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 17, 2024Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow VulnerabilityCVE-2023-6549 · Network & remote access · CitrixExploited
Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
- Product
- NetScaler ADC and NetScaler Gateway
- On CISA’s list since
- Jan 17, 2024 (federal fix deadline Feb 7, 2024)
- What to do
- Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 17, 2024Citrix NetScaler ADC and NetScaler Gateway Code Injection VulnerabilityCVE-2023-6548 · Network & remote access · CitrixExploited
Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.
- Product
- NetScaler ADC and NetScaler Gateway
- On CISA’s list since
- Jan 17, 2024 (federal fix deadline Jan 24, 2024)
- What to do
- Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 16, 2024Laravel Deserialization of Untrusted Data VulnerabilityCVE-2018-15133 · Other software · LaravelExploited
Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).
- Product
- Laravel Framework
- On CISA’s list since
- Jan 16, 2024 (federal fix deadline Feb 6, 2024)
- What to do
- Attackers are using this now. Install Laravel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 10, 2024Microsoft SharePoint Server Privilege Escalation VulnerabilityCVE-2023-29357 · Email & office · MicrosoftExploitedRansomware
Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.
- Product
- SharePoint Server
- On CISA’s list since
- Jan 10, 2024 (federal fix deadline Jan 31, 2024)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 10, 2024Ivanti Connect Secure and Policy Secure Authentication Bypass VulnerabilityCVE-2023-46805 · Network & remote access · IvantiExploitedRansomware
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.
- Product
- Connect Secure and Policy Secure
- On CISA’s list since
- Jan 10, 2024 (federal fix deadline Jan 22, 2024)
- What to do
- Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 10, 2024Ivanti Connect Secure and Policy Secure Command Injection VulnerabilityCVE-2024-21887 · Network & remote access · IvantiExploitedRansomware
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.
- Product
- Connect Secure and Policy Secure
- On CISA’s list since
- Jan 10, 2024 (federal fix deadline Jan 22, 2024)
- What to do
- Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 8, 2024Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityCVE-2023-38203 · Websites & servers · AdobeExploitedRansomware
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
- Product
- ColdFusion
- On CISA’s list since
- Jan 8, 2024 (federal fix deadline Jan 29, 2024)
- What to do
- Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 8, 2024Joomla! Improper Access Control VulnerabilityCVE-2023-23752 · Websites & servers · Joomla!Exploited
Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.
- Product
- Joomla!
- On CISA’s list since
- Jan 8, 2024 (federal fix deadline Jan 29, 2024)
- What to do
- Attackers are using this now. Install Joomla!’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 8, 2024D-Link DSL-2750B Devices Command Injection VulnerabilityCVE-2016-20017 · Network & remote access · D-LinkExploited
D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.
- Product
- DSL-2750B Devices
- On CISA’s list since
- Jan 8, 2024 (federal fix deadline Jan 29, 2024)
- What to do
- Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 8, 2024Apache Superset Insecure Default Initialization of Resource VulnerabilityCVE-2023-27524 · Websites & servers · ApacheExploited
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.
- Product
- Superset
- On CISA’s list since
- Jan 8, 2024 (federal fix deadline Jan 29, 2024)
- What to do
- Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 8, 2024Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityCVE-2023-29300 · Websites & servers · AdobeExploitedRansomware
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.
- Product
- ColdFusion
- On CISA’s list since
- Jan 8, 2024 (federal fix deadline Jan 29, 2024)
- What to do
- Attackers are using this now. Install Adobe’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 8, 2024Apple Multiple Products Code Execution VulnerabilityCVE-2023-41990 · Computers, phones & browsers · AppleExploited
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file.
- Product
- Multiple Products
- On CISA’s list since
- Jan 8, 2024 (federal fix deadline Jan 29, 2024)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 2, 2024Spreadsheet::ParseExcel Remote Code Execution VulnerabilityCVE-2023-7101 · Other software · Spreadsheet::ParseExcelExploited
Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
- Product
- Spreadsheet::ParseExcel
- On CISA’s list since
- Jan 2, 2024 (federal fix deadline Jan 23, 2024)
- What to do
- Attackers are using this now. Install Spreadsheet::ParseExcel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.