Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,754 results · page 18 of 36
Apr 3, 2023Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityCVE-2022-27926 · Email & office · SynacorExploited
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.
- Product
- Zimbra Collaboration Suite (ZCS)
- On CISA’s list since
- Apr 3, 2023 (federal fix deadline Apr 24, 2023)
- What to do
- Attackers are using this now. Install Synacor’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 30, 2023Microsoft Internet Explorer Memory Corruption VulnerabilityCVE-2013-3163 · Computers, phones & browsers · MicrosoftExploited
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.
- Product
- Internet Explorer
- On CISA’s list since
- Mar 30, 2023 (federal fix deadline Apr 20, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 30, 2023Samba Remote Code Execution VulnerabilityCVE-2017-7494 · Other software · SambaExploitedRansomware
Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.
- Product
- Samba
- On CISA’s list since
- Mar 30, 2023 (federal fix deadline Apr 20, 2023)
- What to do
- Attackers are using this now. Install Samba’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 30, 2023Fortra Cobalt Strike User Interface Remote Code Execution VulnerabilityCVE-2022-42948 · Other software · FortraExploited
Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.
- Product
- Cobalt Strike
- On CISA’s list since
- Mar 30, 2023 (federal fix deadline Apr 20, 2023)
- What to do
- Attackers are using this now. Install Fortra’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 30, 2023Apple iOS, iPadOS, and macOS Out-of-Bounds Write VulnerabilityCVE-2021-30900 · Computers, phones & browsers · AppleExploited
Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.
- Product
- iOS, iPadOS, and macOS
- On CISA’s list since
- Mar 30, 2023 (federal fix deadline Apr 20, 2023)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 30, 2023Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityCVE-2022-38181 · Computers, phones & browsers · ArmExploited
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
- Product
- Mali Graphics Processing Unit (GPU)
- On CISA’s list since
- Mar 30, 2023 (federal fix deadline Apr 20, 2023)
- What to do
- Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 30, 2023Linux Kernel Use-After-Free VulnerabilityCVE-2023-0266 · Computers, phones & browsers · LinuxExploited
Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.
- Product
- Kernel
- On CISA’s list since
- Mar 30, 2023 (federal fix deadline Apr 20, 2023)
- What to do
- Attackers are using this now. Install Linux’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 30, 2023Google Chromium Network Service Use-After-Free VulnerabilityCVE-2022-3038 · Computers, phones & browsers · GoogleExploited
Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium Network Service
- On CISA’s list since
- Mar 30, 2023 (federal fix deadline Apr 20, 2023)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 30, 2023Arm Mali GPU Kernel Driver Unspecified VulnerabilityCVE-2022-22706 · Computers, phones & browsers · ArmExploited
Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.
- Product
- Mali Graphics Processing Unit (GPU)
- On CISA’s list since
- Mar 30, 2023 (federal fix deadline Apr 20, 2023)
- What to do
- Attackers are using this now. Install Arm’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 30, 2023Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) VulnerabilityCVE-2022-39197 · Other software · FortraExploited
Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
- Product
- Cobalt Strike
- On CISA’s list since
- Mar 30, 2023 (federal fix deadline Apr 20, 2023)
- What to do
- Attackers are using this now. Install Fortra’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 15, 2023Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityCVE-2023-26360 · Websites & servers · AdobeExploited
Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.
- Product
- ColdFusion
- On CISA’s list since
- Mar 15, 2023 (federal fix deadline Apr 5, 2023)
- What to do
- Attackers are using this now. Install Adobe’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 14, 2023Microsoft Office Outlook Privilege Escalation VulnerabilityCVE-2023-23397 · Email & office · MicrosoftExploited
Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.
- Product
- Office
- On CISA’s list since
- Mar 14, 2023 (federal fix deadline Apr 4, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 14, 2023Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2023-24880 · Computers, phones & browsers · MicrosoftExploitedRansomware
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
- Product
- Windows
- On CISA’s list since
- Mar 14, 2023 (federal fix deadline Apr 4, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 14, 2023Fortinet FortiOS Path Traversal VulnerabilityCVE-2022-41328 · Network & remote access · FortinetExploited
Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
- Product
- FortiOS
- On CISA’s list since
- Mar 14, 2023 (federal fix deadline Apr 4, 2023)
- What to do
- Attackers are using this now. Install Fortinet’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 10, 2023XStream Remote Code Execution VulnerabilityCVE-2021-39144 · Other software · XStreamExploited
XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.
- Product
- XStream
- On CISA’s list since
- Mar 10, 2023 (federal fix deadline Mar 31, 2023)
- What to do
- Attackers are using this now. Install XStream’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 10, 2023Plex Media Server Remote Code Execution VulnerabilityCVE-2020-5741 · Other software · PlexExploited
Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.
- Product
- Media Server
- On CISA’s list since
- Mar 10, 2023 (federal fix deadline Mar 31, 2023)
- What to do
- Attackers are using this now. Install Plex’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 7, 2023Zoho ManageEngine ADSelfService Plus Remote Code Execution VulnerabilityCVE-2022-28810 · Email & office · ZohoExploited
Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
- Product
- ManageEngine
- On CISA’s list since
- Mar 7, 2023 (federal fix deadline Mar 28, 2023)
- What to do
- Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 7, 2023Apache Spark Command Injection VulnerabilityCVE-2022-33891 · Websites & servers · ApacheExploited
Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.
- Product
- Spark
- On CISA’s list since
- Mar 7, 2023 (federal fix deadline Mar 28, 2023)
- What to do
- Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Mar 7, 2023Teclib GLPI Remote Code Execution VulnerabilityCVE-2022-35914 · Other software · TeclibExploited
Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.
- Product
- GLPI
- On CISA’s list since
- Mar 7, 2023 (federal fix deadline Mar 28, 2023)
- What to do
- Attackers are using this now. Install Teclib’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 27, 2023ZK Framework AuUploader Unspecified VulnerabilityCVE-2022-36537 · Other software · ZK FrameworkExploitedRansomware
ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.
- Product
- AuUploader
- On CISA’s list since
- Feb 27, 2023 (federal fix deadline Mar 20, 2023)
- What to do
- Attackers are using this now. Install ZK Framework’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 21, 2023IBM Aspera Faspex Code Execution VulnerabilityCVE-2022-47986 · Other software · IBMExploitedRansomware
IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.
- Product
- Aspera Faspex
- On CISA’s list since
- Feb 21, 2023 (federal fix deadline Mar 14, 2023)
- What to do
- Attackers are using this now. Install IBM’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 21, 2023Mitel MiVoice Connect Code Injection VulnerabilityCVE-2022-41223 · Email & office · MitelExploitedRansomware
The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
- Product
- MiVoice Connect
- On CISA’s list since
- Feb 21, 2023 (federal fix deadline Mar 14, 2023)
- What to do
- Attackers are using this now. Install Mitel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 21, 2023Mitel MiVoice Connect Command Injection VulnerabilityCVE-2022-40765 · Email & office · MitelExploitedRansomware
The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
- Product
- MiVoice Connect
- On CISA’s list since
- Feb 21, 2023 (federal fix deadline Mar 14, 2023)
- What to do
- Attackers are using this now. Install Mitel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 16, 2023Cacti Command Injection VulnerabilityCVE-2022-46169 · Other software · CactiExploited
Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.
- Product
- Cacti
- On CISA’s list since
- Feb 16, 2023 (federal fix deadline Mar 9, 2023)
- What to do
- Attackers are using this now. Install Cacti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 14, 2023Microsoft Office Publisher Security Feature Bypass VulnerabilityCVE-2023-21715 · Email & office · MicrosoftExploited
Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
- Product
- Office
- On CISA’s list since
- Feb 14, 2023 (federal fix deadline Mar 7, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 14, 2023Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityCVE-2023-23376 · Computers, phones & browsers · MicrosoftExploitedRansomware
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
- Product
- Windows
- On CISA’s list since
- Feb 14, 2023 (federal fix deadline Mar 7, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 14, 2023Apple Multiple Products WebKit Type Confusion VulnerabilityCVE-2023-23529 · Computers, phones & browsers · AppleExploited
Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
- Product
- Multiple Products
- On CISA’s list since
- Feb 14, 2023 (federal fix deadline Mar 7, 2023)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 14, 2023Microsoft Windows Graphic Component Privilege Escalation VulnerabilityCVE-2023-21823 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.
- Product
- Windows
- On CISA’s list since
- Feb 14, 2023 (federal fix deadline Mar 7, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 10, 2023Intel Ethernet Diagnostics Driver for Windows Denial-of-Service VulnerabilityCVE-2015-2291 · Other software · IntelExploitedRansomware
Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).
- Product
- Ethernet Diagnostics Driver for Windows
- On CISA’s list since
- Feb 10, 2023 (federal fix deadline Mar 3, 2023)
- What to do
- Attackers are using this now. Install Intel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 10, 2023TerraMaster OS Remote Command Execution VulnerabilityCVE-2022-24990 · Other software · TerraMasterExploitedRansomware
TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
- Product
- TerraMaster OS
- On CISA’s list since
- Feb 10, 2023 (federal fix deadline Mar 3, 2023)
- What to do
- Attackers are using this now. Install TerraMaster’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 10, 2023Fortra GoAnywhere MFT Remote Code Execution VulnerabilityCVE-2023-0669 · Other software · FortraExploitedRansomware
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
- Product
- GoAnywhere MFT
- On CISA’s list since
- Feb 10, 2023 (federal fix deadline Mar 3, 2023)
- What to do
- Attackers are using this now. Install Fortra’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 2, 2023Oracle E-Business Suite Unspecified VulnerabilityCVE-2022-21587 · Other software · OracleExploitedRansomware
Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
- Product
- E-Business Suite
- On CISA’s list since
- Feb 2, 2023 (federal fix deadline Feb 23, 2023)
- What to do
- Attackers are using this now. Install Oracle’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Feb 2, 2023Multiple SugarCRM Products Remote Code Execution VulnerabilityCVE-2023-22952 · Other software · SugarCRMExploited
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
- Product
- Multiple Products
- On CISA’s list since
- Feb 2, 2023 (federal fix deadline Feb 23, 2023)
- What to do
- Attackers are using this now. Install SugarCRM’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 26, 2023Telerik UI for ASP.NET AJAX Insecure Direct Object Reference VulnerabilityCVE-2017-11357 · Other software · TelerikExploitedRansomware
Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
- Product
- User Interface (UI) for ASP.NET AJAX
- On CISA’s list since
- Jan 26, 2023 (federal fix deadline Feb 16, 2023)
- What to do
- Attackers are using this now. Install Telerik’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 23, 2023Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityCVE-2022-47966 · Email & office · ZohoExploitedRansomware
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
- Product
- ManageEngine
- On CISA’s list since
- Jan 23, 2023 (federal fix deadline Feb 13, 2023)
- What to do
- Attackers are using this now. Install Zoho’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 17, 2023CWP Control Web Panel OS Command Injection VulnerabilityCVE-2022-44877 · Other software · CWPExploited
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
- Product
- Control Web Panel
- On CISA’s list since
- Jan 17, 2023 (federal fix deadline Feb 7, 2023)
- What to do
- Attackers are using this now. Install CWP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 10, 2023Microsoft Exchange Server Privilege Escalation VulnerabilityCVE-2022-41080 · Email & office · MicrosoftExploitedRansomware
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
- Product
- Exchange Server
- On CISA’s list since
- Jan 10, 2023 (federal fix deadline Jan 31, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Jan 10, 2023Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation VulnerabilityCVE-2023-21674 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.
- Product
- Windows
- On CISA’s list since
- Jan 10, 2023 (federal fix deadline Jan 31, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 29, 2022TIBCO JasperReports Server Information Disclosure VulnerabilityCVE-2018-5430 · Other software · TIBCOExploited
TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
- Product
- JasperReports
- On CISA’s list since
- Dec 29, 2022 (federal fix deadline Jan 19, 2023)
- What to do
- Attackers are using this now. Install TIBCO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 29, 2022TIBCO JasperReports Library Directory Traversal VulnerabilityCVE-2018-18809 · Other software · TIBCOExploited
TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
- Product
- JasperReports
- On CISA’s list since
- Dec 29, 2022 (federal fix deadline Jan 19, 2023)
- What to do
- Attackers are using this now. Install TIBCO’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 14, 2022Apple iOS Type Confusion VulnerabilityCVE-2022-42856 · Computers, phones & browsers · AppleExploited
Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
- Product
- iOS
- On CISA’s list since
- Dec 14, 2022 (federal fix deadline Jan 4, 2023)
- What to do
- Attackers are using this now. Install Apple’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 13, 2022Microsoft Defender SmartScreen Security Feature Bypass VulnerabilityCVE-2022-44698 · Computers, phones & browsers · MicrosoftExploitedRansomware
Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
- Product
- Defender
- On CISA’s list since
- Dec 13, 2022 (federal fix deadline Jan 3, 2023)
- What to do
- Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 13, 2022Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass VulnerabilityCVE-2022-27518 · Network & remote access · CitrixExploited
Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
- Product
- Application Delivery Controller (ADC) and Gateway
- On CISA’s list since
- Dec 13, 2022 (federal fix deadline Jan 3, 2023)
- What to do
- Attackers are using this now. Install Citrix’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 13, 2022Veeam Backup & Replication Remote Code Execution VulnerabilityCVE-2022-26500 · Other software · VeeamExploitedRansomware
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
- Product
- Backup & Replication
- On CISA’s list since
- Dec 13, 2022 (federal fix deadline Jan 3, 2023)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 13, 2022Veeam Backup & Replication Remote Code Execution VulnerabilityCVE-2022-26501 · Other software · VeeamExploitedRansomware
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
- Product
- Backup & Replication
- On CISA’s list since
- Dec 13, 2022 (federal fix deadline Jan 3, 2023)
- What to do
- Attackers are using this now. Install Veeam’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 13, 2022Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityCVE-2022-42475 · Network & remote access · FortinetExploitedRansomware
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
- Product
- FortiOS
- On CISA’s list since
- Dec 13, 2022 (federal fix deadline Jan 3, 2023)
- What to do
- Attackers are using this now. Install Fortinet’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Dec 5, 2022Google Chromium V8 Type Confusion VulnerabilityCVE-2022-4262 · Computers, phones & browsers · GoogleExploited
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium V8
- On CISA’s list since
- Dec 5, 2022 (federal fix deadline Dec 26, 2022)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 28, 2022Oracle Fusion Middleware Unspecified VulnerabilityCVE-2021-35587 · Other software · OracleExploited
Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.
- Product
- Fusion Middleware
- On CISA’s list since
- Nov 28, 2022 (federal fix deadline Dec 19, 2022)
- What to do
- Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 28, 2022Google Chromium GPU Heap Buffer Overflow VulnerabilityCVE-2022-4135 · Computers, phones & browsers · GoogleExploited
Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Product
- Chromium GPU
- On CISA’s list since
- Nov 28, 2022 (federal fix deadline Dec 19, 2022)
- What to do
- Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Nov 14, 2022Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityCVE-2022-41049 · Computers, phones & browsers · MicrosoftExploited
Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
- Product
- Windows
- On CISA’s list since
- Nov 14, 2022 (federal fix deadline Dec 9, 2022)
- What to do
- Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.