Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

229 results · page 5 of 5

Nov 3, 2021rConfig OS Command Injection VulnerabilityCVE-2020-10221 · Other software · rConfig · reported by MITREExploitedHigh 8.8
rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter.
Product
rConfig
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install rConfig’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com cwe.mitre.org
Nov 3, 2021SAP Customer Relationship Management (CRM) Path Traversal VulnerabilityCVE-2018-2380 · Network & remote access · SAP · reported by cna@sap.comExploitedRansomwareMedium 6.6
SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
Product
Customer Relationship Management (CRM)
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install SAP’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com blogs.sap.com
Nov 3, 2021SAP Solution Manager Missing Authentication for Critical Function VulnerabilityCVE-2020-6207 · Network & remote access · SAP · reported by cna@sap.comExploitedCritical 9.8
SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.
Product
Solution Manager
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install SAP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021SIMalliance Toolbox Browser Command Injection VulnerabilityCVE-2019-16256 · Other software · SIMalliance · reported by MITREExploitedCritical 9.8
SIMalliance Toolbox Browser contains an command injection vulnerability that could allow remote attackers to retrieve location and IMEI information or execute a range of other attacks by modifying the attack message.
Product
Toolbox Browser
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install SIMalliance’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog adaptivemobile.com adaptivemobile.com
Nov 3, 2021SolarWinds Virtualization Manager Privilege Escalation VulnerabilityCVE-2016-3643 · Other software · SolarWinds · reported by MITREExploitedHigh 7.8
SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.
Product
Virtualization Manager
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install SolarWinds’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com seclists.org
Nov 3, 2021SonicWall Email Security Improper Privilege Management VulnerabilityCVE-2021-20021 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comExploitedRansomwareCritical 9.8
SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.
Product
SonicWall Email Security
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install SonicWall’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog psirt.global.sonicwall.com psirt.global.sonicwall.com
Nov 3, 2021Microsoft Open Management Infrastructure (OMI) Privilege Escalation VulnerabilityCVE-2021-38645 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.
Product
Open Management Infrastructure (OMI)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com portal.msrc.microsoft.com
Nov 3, 2021Symantec Messaging Gateway Remote Code Execution VulnerabilityCVE-2017-6327 · Other software · Symantec · reported by secure@symantec.comExploitedHigh 8.8
Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions.
Product
Symantec Messaging Gateway
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Symantec’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog seclists.org securityfocus.com
Nov 3, 2021Multiple VMware Products Command Injection VulnerabilityCVE-2020-4006 · Other software · VMware · reported by security@vmware.comExploitedCritical 9.1
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.
Product
Multiple Products
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install VMware’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog vmware.com kb.cert.org
Nov 3, 2021Tenda AC7, AC9, and AC10 Routers Command Injection VulnerabilityCVE-2018-14558 · Network & remote access · Tenda · reported by MITREExploitedCritical 9.8
Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.
Product
AC7, AC9, and AC10 Routers
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Tenda’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com github.com
Nov 3, 2021WordPress File Manager Plugin Remote Code Execution VulnerabilityCVE-2020-25213 · WordPress plugins & themes · reported by MITREExploitedCritical 10
WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
Product
File Manager Plugin
Fixed in
6.9
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021Yealink Device Management Server-Side Request Forgery (SSRF) VulnerabilityCVE-2021-27561 · Other software · Yealink · reported by MITREExploitedCritical 9.8
Yealink Device Management contains a server-side request forgery (SSRF) vulnerability that allows for unauthenticated remote code execution.
Product
Device Management
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Yealink’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog ssd-disclosure.com ssd-disclosure.com
Nov 3, 2021Zoho ManageEngine ADSelfService Plus Authentication Bypass VulnerabilityCVE-2021-40539 · Email & office · Zoho · reported by MITREExploitedRansomwareCritical 9.8
Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.
Product
ManageEngine
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Zoho’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com manageengine.com
Nov 3, 2021Zoho ManageEngine Desktop Central File Upload VulnerabilityCVE-2020-10189 · Email & office · Zoho · reported by MITREExploitedCritical 9.8
Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.
Product
ManageEngine
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com cwe.mitre.org
Nov 3, 2021Zoho ManageEngine ServiceDesk Plus (SDP) File Upload VulnerabilityCVE-2019-8394 · Email & office · Zoho · reported by MITREExploitedMedium 6.5
Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.
Product
ManageEngine
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install Zoho’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog securityfocus.com exploit-db.com
Nov 3, 2021Accellion FTA OS Command Injection VulnerabilityCVE-2021-27102 · Other software · Accellion · reported by MITREExploitedRansomwareHigh 7.8
Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.
Product
FTA
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Accellion’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog github.com accellion.com
Nov 3, 2021Cisco HyperFlex HX Data Platform Command Injection VulnerabilityCVE-2021-1498 · Network & remote access · Cisco · reported by psirt@cisco.comExploitedCritical 9.8
Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user.
Product
HyperFlex HX
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Cisco’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com tools.cisco.com
Nov 3, 2021Multiple DrayTek Vigor Routers Web Management Page VulnerabilityCVE-2020-8515 · Network & remote access · DrayTek · reported by MITREExploitedCritical 9.8
DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
Product
Multiple Vigor Routers
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install DrayTek’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com sku11army.blogspot.com
Nov 3, 2021EyesOfNetwork Improper Privilege Management VulnerabilityCVE-2020-8655 · Other software · EyesOfNetwork · reported by MITREExploitedHigh 7.8
EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7.
Product
EyesOfNetwork
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install EyesOfNetwork’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution VulnerabilityCVE-2020-5902 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedRansomwareCritical 9.8
F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.
Product
BIG-IP
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install F5’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution VulnerabilityCVE-2021-22986 · Network & remote access · F5 · reported by f5sirt@f5.comExploitedRansomwareCritical 9.8
F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.
Product
BIG-IP and BIG-IQ Centralized Management
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install F5’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021ForgeRock Access Management (AM) Core Server Remote Code Execution VulnerabilityCVE-2021-35464 · Other software · ForgeRock · reported by MITREExploitedRansomwareCritical 9.8
ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend).
Product
Access Management (AM)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install ForgeRock’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog packetstormsecurity.com packetstormsecurity.com
Nov 3, 2021IBM Data Risk Manager Directory Traversal VulnerabilityCVE-2020-4430 · Other software · IBM · reported by psirt@us.ibm.comExploitedMedium 4.3
IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker to traverse directories and send a specially crafted URL request to download arbitrary files from the system.
Product
Data Risk Manager
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install IBM’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog exchange.xforce.ibmcloud.com ibm.com
Nov 3, 2021IBM Data Risk Manager Security Bypass VulnerabilityCVE-2020-4427 · Other software · IBM · reported by psirt@us.ibm.comExploitedCritical 9.8
IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system.
Product
Data Risk Manager
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install IBM’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog exchange.xforce.ibmcloud.com ibm.com
Nov 3, 2021IBM Data Risk Manager Remote Code Execution VulnerabilityCVE-2020-4428 · Other software · IBM · reported by psirt@us.ibm.comExploitedCritical 9.1
IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�
Product
Data Risk Manager
On CISA’s list since
Nov 3, 2021 (federal fix deadline May 3, 2022)
What to do
Attackers are using this now. Install IBM’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog exchange.xforce.ibmcloud.com ibm.com
Nov 3, 2021McAfee Total Protection (MTP) Improper Privilege Management VulnerabilityCVE-2021-23874 · Other software · McAfee · reported by trellixpsirt@trellix.comExploitedHigh 8.2
McAfee Total Protection (MTP) contains an improper privilege management vulnerability that allows a local user to gain elevated privileges and execute code, bypassing MTP self-defense.
Product
McAfee Total Protection (MTP)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install McAfee’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog service.mcafee.com service.mcafee.com
Nov 3, 2021Micro Focus Access Manager Information Leakage VulnerabilityCVE-2021-22506 · Other software · Micro Focus · reported by security@opentext.comExploitedHigh 7.5
Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used.
Product
Micro Focus Access Manager
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Micro Focus’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog microfocus.com microfocus.com
Nov 3, 2021Microsoft Open Management Infrastructure (OMI) Remote Code Execution VulnerabilityCVE-2021-38647 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareCritical 9.8
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.
Product
Open Management Infrastructure (OMI)
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com packetstormsecurity.com
Nov 3, 2021Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation VulnerabilityCVE-2021-33739 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 8.4
Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.
Product
Windows
On CISA’s list since
Nov 3, 2021 (federal fix deadline Nov 17, 2021)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog portal.msrc.microsoft.com portal.msrc.microsoft.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.