Vulnerability database

56 results · page 2 of 2

• Nov 3, 2021Google Chromium Information Disclosure VulnerabilityCVE-2021-37976 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comExploitedMedium 6.5

  Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  Product

  Chromium

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install Google’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogchromereleases.googleblog.comcrbug.com

• Nov 3, 2021Kaseya Virtual System/Server Administrator (VSA) Information Disclosure VulnerabilityCVE-2021-30116 · Other software · Kaseya · reported by MITREExploitedRansomwareCritical 10

  Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system.

  Product

  Virtual System/Server Administrator (VSA)

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install Kaseya’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogcsirt.divd.nlcsirt.divd.nl

• Nov 3, 2021Micro Focus Access Manager Information Leakage VulnerabilityCVE-2021-22506 · Other software · Micro Focus · reported by security@opentext.comExploitedHigh 7.5

  Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.

  Product

  Micro Focus Access Manager

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install Micro Focus’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogmicrofocus.commicrofocus.com

• Nov 3, 2021Microsoft Windows Kernel Information Disclosure VulnerabilityCVE-2021-31955 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 5.5

  Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process.

  Product

  Windows

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogportal.msrc.microsoft.comportal.msrc.microsoft.com

• Nov 3, 2021Microsoft Windows Server Buffer Overflow VulnerabilityCVE-2017-7269 · Websites & servers · Microsoft · reported by MITREExploitedCritical 9.8

  Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request.

  Product

  Internet Information Services (IIS)

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsecurityfocus.comsecuritytracker.com

• Nov 3, 2021VMware vCenter Server Information Disclosure VulnerabilityCVE-2020-3952 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8

  VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information.

  Product

  vCenter Server

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comvmware.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.