Vulnerability database

156 results · page 4 of 4

• Nov 3, 2021McAfee Total Protection (MTP) Improper Privilege Management VulnerabilityCVE-2021-23874 · Other software · McAfee · reported by trellixpsirt@trellix.comExploitedHigh 8.2

  McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense.

  Product

  McAfee Total Protection (MTP)

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install McAfee’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogservice.mcafee.comservice.mcafee.com

• Nov 3, 2021SonicWall Email Security Improper Privilege Management VulnerabilityCVE-2021-20021 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8

  SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.

  Product

  SonicWall Email Security

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpsirt.global.sonicwall.compsirt.global.sonicwall.com

• Nov 3, 2021Trend Micro Multiple Products Improper Access Control VulnerabilityCVE-2020-24557 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.8

  Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.

  Product

  Apex One, OfficeScan, and Worry-Free Business Security

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsuccess.trendmicro.comsuccess.trendmicro.com

• Nov 3, 2021Trend Micro Multiple Products Improper Input Validation VulnerabilityCVE-2021-36742 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.8

  Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.

  Product

  Apex One, Apex One as a Service, and Worry-Free Business Security

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsuccess.trendmicro.comsuccess.trendmicro.com

• Nov 3, 2021Trend Micro Multiple Products Improper Input Validation VulnerabilityCVE-2021-36741 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 8.8

  Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.

  Product

  Apex One, Apex One as a Service, and Worry-Free Business Security

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsuccess.trendmicro.comsuccess.trendmicro.com

• Nov 3, 2021VMware vCenter Server Improper Input Validation VulnerabilityCVE-2021-21985 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8

  VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.

  Product

  vCenter Server

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.