Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

229 results · page 3 of 5

Sep 13, 2024Ivanti Cloud Services Appliance OS Command Injection VulnerabilityCVE-2024-8190 · Network & remote access · Ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75ExploitedHigh 7.2
Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.
Product
Cloud Services Appliance
On CISA’s list since
Sep 13, 2024 (federal fix deadline Oct 4, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com cisa.gov
Sep 10, 2024Microsoft Windows Installer Improper Privilege Management VulnerabilityCVE-2024-38014 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Sep 10, 2024 (federal fix deadline Oct 1, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com seclists.org
Aug 19, 2024Jenkins Command Line Interface (CLI) Path Traversal VulnerabilityCVE-2024-23897 · Websites & servers · Jenkins · reported by jenkinsci-cert@googlegroups.comExploitedRansomwareCritical 9.8
Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.
Product
Jenkins Command Line Interface (CLI)
On CISA’s list since
Aug 19, 2024 (federal fix deadline Sep 9, 2024)
What to do
Attackers are using this now. Install Jenkins’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jul 2, 2024Cisco NX-OS Command Injection VulnerabilityCVE-2024-20399 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedMedium 6
Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.
Product
NX-OS
On CISA’s list since
Jul 2, 2024 (federal fix deadline Jul 23, 2024)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Jun 13, 2024Microsoft Windows Error Reporting Service Improper Privilege Management VulnerabilityCVE-2024-26169 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
Product
Windows
On CISA’s list since
Jun 13, 2024 (federal fix deadline Jul 4, 2024)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jun 12, 2024PHP-CGI OS Command Injection VulnerabilityCVE-2024-4577 · Websites & servers · PHP Group · reported by security@php.netExploitedRansomwareCritical 9.8
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
Product
PHP
On CISA’s list since
Jun 12, 2024 (federal fix deadline Jul 3, 2024)
What to do
Attackers are using this now. Install PHP Group’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog openwall.com arstechnica.com
Jun 3, 2024Oracle WebLogic Server OS Command Injection VulnerabilityCVE-2017-3506 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedHigh 7.4
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.
Product
WebLogic Server
On CISA’s list since
Jun 3, 2024 (federal fix deadline Jun 24, 2024)
What to do
Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog oracle.com securityfocus.com
Apr 12, 2024Palo Alto Networks PAN-OS Command Injection VulnerabilityCVE-2024-3400 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comExploitedRansomwareCritical 10
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
Product
PAN-OS
On CISA’s list since
Apr 12, 2024 (federal fix deadline Apr 19, 2024)
What to do
Attackers are using this now. Install Palo Alto Networks’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog security.paloaltonetworks.com unit42.paloaltonetworks.com
Apr 11, 2024D-Link Multiple NAS Devices Command Injection VulnerabilityCVE-2024-3273 · Network & remote access · D-Link · reported by VulDBExploitedHigh 7.3
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.
Product
Multiple NAS Devices
On CISA’s list since
Apr 11, 2024 (federal fix deadline May 2, 2024)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com supportannouncement.us.dlink.com
Mar 25, 2024Nice Linear eMerge E3-Series OS Command Injection VulnerabilityCVE-2019-7256 · Other software · Nice · reported by MITREExploitedCritical 9.8
Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.
Product
Linear eMerge E3-Series
On CISA’s list since
Mar 25, 2024 (federal fix deadline Apr 15, 2024)
What to do
Attackers are using this now. Install Nice’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 25, 2024Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability CVE-2021-44529 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).
Product
Endpoint Manager Cloud Service Appliance (EPM CSA)
On CISA’s list since
Mar 25, 2024 (federal fix deadline Apr 15, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Mar 5, 2024Sunhillo SureLine OS Command Injection VulnerablityCVE-2021-36380 · Other software · Sunhillo · reported by MITREExploitedCritical 9.8
Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi.
Product
SureLine
On CISA’s list since
Mar 5, 2024 (federal fix deadline Mar 26, 2024)
What to do
Attackers are using this now. Install Sunhillo’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog research.nccgroup.com sunhillo.com
Jan 18, 2024Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass VulnerabilityCVE-2023-35082 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.
Product
Endpoint Manager Mobile (EPMM) and MobileIron Core
On CISA’s list since
Jan 18, 2024 (federal fix deadline Feb 8, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com forums.ivanti.com
Jan 10, 2024Ivanti Connect Secure and Policy Secure Command Injection VulnerabilityCVE-2024-21887 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedRansomwareCritical 9.1
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.
Product
Connect Secure and Policy Secure
On CISA’s list since
Jan 10, 2024 (federal fix deadline Jan 22, 2024)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com forums.ivanti.com
Jan 8, 2024D-Link DSL-2750B Devices Command Injection VulnerabilityCVE-2016-20017 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.
Product
DSL-2750B Devices
On CISA’s list since
Jan 8, 2024 (federal fix deadline Jan 29, 2024)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org supportannouncement.us.dlink.com
Dec 21, 2023FXC AE1021, AE1021PE OS Command Injection VulnerabilityCVE-2023-49897 · Other software · FXC · reported by vultures@jpcert.or.jpExploitedHigh 8.8
FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.
Product
AE1021, AE1021PE
On CISA’s list since
Dec 21, 2023 (federal fix deadline Jan 11, 2024)
What to do
Attackers are using this now. Install FXC’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog jvn.jp akamai.com
Dec 21, 2023QNAP VioStor NVR OS Command Injection VulnerabilityCVE-2023-47565 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedHigh 8
QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.
Product
VioStor NVR
On CISA’s list since
Dec 21, 2023 (federal fix deadline Jan 11, 2024)
What to do
Attackers are using this now. Install QNAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
Nov 16, 2023Sophos Web Appliance Command Injection VulnerabilityCVE-2023-1671 · Network & remote access · Sophos · reported by security-alert@sophos.comExploitedCritical 9.8
Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.
Product
Web Appliance
On CISA’s list since
Nov 16, 2023 (federal fix deadline Dec 7, 2023)
What to do
Attackers are using this now. Install Sophos’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com sophos.com
Nov 14, 2023Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation VulnerabilityCVE-2023-36033 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Nov 14, 2023 (federal fix deadline Dec 5, 2023)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Oct 23, 2023Cisco IOS XE Web UI Command Injection VulnerabilityCVE-2023-20273 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedHigh 7.2
Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.
Product
Cisco IOS XE Web UI
On CISA’s list since
Oct 23, 2023 (federal fix deadline Oct 27, 2023)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog sec.cloudapps.cisco.com sec.cloudapps.cisco.com
Sep 18, 2023Zyxel EMG2926 Routers Command Injection VulnerabilityCVE-2017-6884 · Network & remote access · Zyxel · reported by MITREExploitedRansomwareHigh 8.8
Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
Product
EMG2926 Routers
On CISA’s list since
Sep 18, 2023 (federal fix deadline Oct 9, 2023)
What to do
Attackers are using this now. Install Zyxel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog exploit-db.com exploit-db.com
Sep 6, 2023Apache RocketMQ Command Execution VulnerabilityCVE-2023-33246 · Websites & servers · Apache · reported by security@apache.orgExploitedCritical 9.8
Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.
Product
RocketMQ
On CISA’s list since
Sep 6, 2023 (federal fix deadline Sep 27, 2023)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com openwall.com
Aug 7, 2023Zyxel P660HN-T1A Routers Command Injection VulnerabilityCVE-2017-18368 · Network & remote access · Zyxel · reported by MITREExploitedCritical 9.8
Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.
Product
P660HN-T1A Routers
On CISA’s list since
Aug 7, 2023 (federal fix deadline Aug 28, 2023)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com raw.githubusercontent.com
Jul 31, 2023Ivanti Endpoint Manager Mobile (EPMM) Path Traversal VulnerabilityCVE-2023-35081 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedHigh 7.2
Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).
Product
Endpoint Manager Mobile (EPMM)
On CISA’s list since
Jul 31, 2023 (federal fix deadline Aug 21, 2023)
What to do
Attackers are using this now. Install Ivanti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com forums.ivanti.com
Jul 25, 2023Ivanti Endpoint Manager Mobile Authentication Bypass VulnerabilityCVE-2023-35078 · Network & remote access · Ivanti · reported by support@hackerone.comExploitedRansomwareCritical 9.8
Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.
Product
Endpoint Manager Mobile (EPMM)
On CISA’s list since
Jul 25, 2023 (federal fix deadline Aug 15, 2023)
What to do
Attackers are using this now. Install Ivanti’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog forums.ivanti.com forums.ivanti.com
Jul 13, 2023SolarView Compact Command Injection VulnerabilityCVE-2022-29303 · Other software · SolarView · reported by MITREExploitedCritical 9.8
SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.
Product
Compact
On CISA’s list since
Jul 13, 2023 (federal fix deadline Aug 3, 2023)
What to do
Attackers are using this now. Install SolarView’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com drive.google.com
Jun 29, 2023D-Link DIR-859 Router Command Execution VulnerabilityCVE-2019-17621 · Network & remote access · D-Link · reported by MITREExploitedCritical 9.8
D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.
Product
DIR-859 Router
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com medium.com
Jun 29, 2023D-Link DWL-2600AP Access Point Command Injection VulnerabilityCVE-2019-20500 · Network & remote access · D-Link · reported by MITREExploitedHigh 7.8
D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.
Product
DWL-2600AP Access Point
On CISA’s list since
Jun 29, 2023 (federal fix deadline Jul 20, 2023)
What to do
Attackers are using this now. Install D-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog supportannouncement.us.dlink.com exploit-db.com
Jun 23, 2023Zyxel Multiple NAS Devices Command Injection VulnerabilityCVE-2023-27992 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedCritical 9.8
Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
Product
Multiple Network-Attached Storage (NAS) Devices
On CISA’s list since
Jun 23, 2023 (federal fix deadline Jul 14, 2023)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog zyxel.com zyxel.com
Jun 22, 2023Vmware Aria Operations for Networks Command Injection VulnerabilityCVE-2023-20887 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.8
VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.
Product
Aria Operations for Networks
On CISA’s list since
Jun 22, 2023 (federal fix deadline Jul 13, 2023)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com vmware.com
May 31, 2023Zyxel Multiple Firewalls OS Command Injection VulnerabilityCVE-2023-28771 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedCritical 9.8
Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.
Product
Multiple Firewalls
On CISA’s list since
May 31, 2023 (federal fix deadline Jun 21, 2023)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com zyxel.com
May 1, 2023TP-Link Archer AX-21 Command Injection VulnerabilityCVE-2023-1389 · Network & remote access · TP-Link · reported by vulnreport@tenable.comExploitedHigh 8.8
TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.
Product
Archer AX21
On CISA’s list since
May 1, 2023 (federal fix deadline May 22, 2023)
What to do
Attackers are using this now. Install TP-Link’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tenable.com
Apr 7, 2023Veritas Backup Exec Agent Command Execution VulnerabilityCVE-2021-27878 · Other software · Veritas · reported by MITREExploitedRansomwareHigh 8.8
Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.
Product
Backup Exec Agent
On CISA’s list since
Apr 7, 2023 (federal fix deadline Apr 28, 2023)
What to do
Attackers are using this now. Install Veritas’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com veritas.com
Mar 7, 2023Zoho ManageEngine ADSelfService Plus Remote Code Execution VulnerabilityCVE-2022-28810 · Email & office · Zoho · reported by MITREExploitedMedium 6.8
Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
Product
ManageEngine
On CISA’s list since
Mar 7, 2023 (federal fix deadline Mar 28, 2023)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com github.com
Mar 7, 2023Apache Spark Command Injection VulnerabilityCVE-2022-33891 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 8.8
Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.
Product
Spark
On CISA’s list since
Mar 7, 2023 (federal fix deadline Mar 28, 2023)
What to do
Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com openwall.com
Feb 21, 2023Mitel MiVoice Connect Command Injection VulnerabilityCVE-2022-40765 · Email & office · Mitel · reported by MITREExploitedRansomwareMedium 6.8
The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
Product
MiVoice Connect
On CISA’s list since
Feb 21, 2023 (federal fix deadline Mar 14, 2023)
What to do
Attackers are using this now. Install Mitel’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog mitel.com mitel.com
Feb 16, 2023Cacti Command Injection VulnerabilityCVE-2022-46169 · Other software · Cacti · reported by GitHubExploitedCritical 9.8
Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.
Product
Cacti
On CISA’s list since
Feb 16, 2023 (federal fix deadline Mar 9, 2023)
What to do
Attackers are using this now. Install Cacti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Feb 10, 2023TerraMaster OS Remote Command Execution VulnerabilityCVE-2022-24990 · Other software · TerraMaster · reported by MITREExploitedRansomwareHigh 7.5
TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
Product
TerraMaster OS
On CISA’s list since
Feb 10, 2023 (federal fix deadline Mar 3, 2023)
What to do
Attackers are using this now. Install TerraMaster’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com forum.terra-master.com
Jan 23, 2023Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityCVE-2022-47966 · Email & office · Zoho · reported by MITREExploitedRansomwareCritical 9.8
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
Product
ManageEngine
On CISA’s list since
Jan 23, 2023 (federal fix deadline Feb 13, 2023)
What to do
Attackers are using this now. Install Zoho’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Jan 17, 2023CWP Control Web Panel OS Command Injection VulnerabilityCVE-2022-44877 · Other software · CWP · reported by MITREExploitedCritical 9.8
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
Product
Control Web Panel
On CISA’s list since
Jan 17, 2023 (federal fix deadline Feb 7, 2023)
What to do
Attackers are using this now. Install CWP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Sep 30, 2022Atlassian Bitbucket Server and Data Center Command Injection VulnerabilityCVE-2022-36804 · Websites & servers · Atlassian · reported by security@atlassian.comExploitedHigh 8.8
Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.
Product
Bitbucket Server and Data Center
On CISA’s list since
Sep 30, 2022 (federal fix deadline Oct 21, 2022)
What to do
Attackers are using this now. Install Atlassian’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Sep 22, 2022Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityCVE-2022-35405 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.
Product
ManageEngine
On CISA’s list since
Sep 22, 2022 (federal fix deadline Oct 13, 2022)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com manageengine.com
Sep 8, 2022D-Link Multiple Routers OS Command Injection VulnerabilityCVE-2018-6530 · Network & remote access · D-Link · reported by MITREExploitedRansomwareCritical 9.8
Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.
Product
Multiple Routers
On CISA’s list since
Sep 8, 2022 (federal fix deadline Sep 29, 2022)
What to do
Attackers are using this now. Install D-Link’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ftp2.dlink.com ftp2.dlink.com
Aug 4, 2022Synacor Zimbra Collaboration Suite (ZCS) Command Injection VulnerabilityCVE-2022-27924 · Email & office · Synacor · reported by MITREExploitedRansomwareHigh 7.5
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.
Product
Zimbra Collaboration Suite (ZCS)
On CISA’s list since
Aug 4, 2022 (federal fix deadline Aug 25, 2022)
What to do
Attackers are using this now. Install Synacor’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog wiki.zimbra.com wiki.zimbra.com
May 25, 2022Microsoft Windows Mount Manager Privilege Escalation VulnerabilityCVE-2015-1769 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedMedium 6.6
A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links.
Product
Windows
On CISA’s list since
May 25, 2022 (federal fix deadline Jun 15, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog blogs.technet.com securitytracker.com
May 24, 2022QNAP NAS File Station Command Injection VulnerabilityCVE-2018-19949 · Network & remote access · QNAP · reported by security@qnapsecurity.com.twExploitedRansomwareCritical 9.8
A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
Product
Network Attached Storage (NAS)
On CISA’s list since
May 24, 2022 (federal fix deadline Jun 14, 2022)
What to do
Attackers are using this now. Install QNAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog qnap.com qnap.com
May 23, 2022Microsoft Update Notification Manager Privilege Escalation VulnerabilityCVE-2020-0638 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8
Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.
Product
Update Notification Manager
On CISA’s list since
May 23, 2022 (federal fix deadline Jun 13, 2022)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com
May 16, 2022Zyxel Multiple Firewalls OS Command Injection VulnerabilityCVE-2022-30525 · Network & remote access · Zyxel · reported by security@zyxel.com.twExploitedCritical 9.8
A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Product
Multiple Firewalls
On CISA’s list since
May 16, 2022 (federal fix deadline Jun 6, 2022)
What to do
Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Apr 15, 2022Ubiquiti AirOS Command Injection VulnerabilityCVE-2010-5330 · Network & remote access · Ubiquiti · reported by MITREExploitedCritical 9.8
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
Product
AirOS
On CISA’s list since
Apr 15, 2022 (federal fix deadline May 6, 2022)
What to do
Attackers are using this now. Install Ubiquiti’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog community.ubnt.com exploit-db.com
Apr 15, 2022Crestron Multiple Products Command Injection VulnerabilityCVE-2019-3929 · Other software · Crestron · reported by vulnreport@tenable.comExploitedCritical 9.8
Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
Product
Multiple Products
On CISA’s list since
Apr 15, 2022 (federal fix deadline May 6, 2022)
What to do
Attackers are using this now. Install Crestron’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.