Vulnerability database

407 results · page 9 of 9

• Nov 3, 2021Trend Micro Multiple Products Improper Input Validation VulnerabilityCVE-2021-36742 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 7.8

  Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.

  Product

  Apex One, Apex One as a Service, and Worry-Free Business Security

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsuccess.trendmicro.comsuccess.trendmicro.com

• Nov 3, 2021Trend Micro Multiple Products Improper Input Validation VulnerabilityCVE-2021-36741 · Other software · Trend Micro · reported by security@trendmicro.comExploitedHigh 8.8

  Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.

  Product

  Apex One, Apex One as a Service, and Worry-Free Business Security

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline Nov 17, 2021)

  What to do

  Attackers are using this now. Install Trend Micro’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogsuccess.trendmicro.comsuccess.trendmicro.com

• Nov 3, 2021TVT NVMS-1000 Directory Traversal VulnerabilityCVE-2019-20085 · Other software · TVT · reported by MITREExploitedHigh 7.5

  TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests.

  Product

  NVMS-1000

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install TVT’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comexploit-db.com

• Nov 3, 2021VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow VulnerabilityCVE-2019-5544 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8

  VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.

  Product

  VMware ESXi and Horizon DaaS

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogopenwall.comopenwall.com

• Nov 3, 2021VMware ESXi OpenSLP Use-After-Free VulnerabilityCVE-2020-3992 · Other software · VMware · reported by security@vmware.comExploitedRansomwareCritical 9.8

  VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.

  Product

  ESXi

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install VMware’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogvmware.comzerodayinitiative.com

• Nov 3, 2021WordPress Social Warfare Plugin Cross-Site Scripting (XSS) VulnerabilityCVE-2019-9978 · WordPress plugins & themes · reported by MITREExploitedMedium 6.1

  WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.

  Product

  Social Warfare Plugin

  Fixed in

  3.5.3

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com

• Nov 3, 2021Zyxel Multiple Products Use of Hard-Coded Credentials VulnerabilityCVE-2020-29583 · Network & remote access · Zyxel · reported by MITREExploitedCritical 9.8

  Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password.

  Product

  Multiple Products

  On CISA’s list since

  Nov 3, 2021 (federal fix deadline May 3, 2022)

  What to do

  Attackers are using this now. Install Zyxel’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

  Full record and what to do →NVD recordCISA catalogftp.zyxel.combusinessforum.zyxel.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.