Active threat advisories and known exploited vulnerabilities.

Critical CVE-2021-22991 F5 · BIG-IP Traffic Management Microkernel Added Jan 18, 2022

F5 BIG-IP Traffic Management Microkernel Buffer Overflow

The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2020-14864 Oracle · Intelligence Enterprise Edition Added Jan 18, 2022

Oracle Business Intelligence Enterprise Edition Path Transversal

Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2020-13671 Drupal · Drupal core Added Jan 18, 2022

Drupal core Un-restricted Upload of File

Improper sanitization in the extension file names is present in Drupal core.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2020-11978 Apache · Airflow Added Jan 18, 2022

Apache Airflow Command Injection

A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2020-13927 Apache · Airflow's Experimental API Added Jan 18, 2022

Apache Airflow's Experimental API Authentication Bypass

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-22017 VMware · vCenter Server Added Jan 10, 2022

VMware vCenter Server Improper Access Control

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-36260 Hikvision · Security cameras web server Added Jan 10, 2022

Hikvision Improper Input Validation

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2020-6572 Google · Chrome Media Added Jan 10, 2022

Google Chrome Media Use-After-Free Vulnerability

Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2019-1458 Microsoft · Win32k Added Jan 10, 2022

Microsoft Win32k Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2013-3900 Microsoft · WinVerifyTrust function Added Jan 10, 2022

Microsoft WinVerifyTrust function Remote Code Execution

A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2019-2725 Oracle · WebLogic Server Added Jan 10, 2022

Oracle WebLogic Server, Injection

Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2019-9670 Synacor · Zimbra Collaboration Suite (ZCS) Added Jan 10, 2022

Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2018-13382 Fortinet · FortiOS and FortiProxy Added Jan 10, 2022

Fortinet FortiOS and FortiProxy Improper Authorization

An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2018-13383 Fortinet · FortiOS and FortiProxy Added Jan 10, 2022

Fortinet FortiOS and FortiProxy Out-of-bounds Write

A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2019-1579 Palo Alto Networks · PAN-OS Added Jan 10, 2022

Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2019-10149 Exim · Mail Transfer Agent (MTA) Added Jan 10, 2022

Exim Mail Transfer Agent (MTA) Improper Input Validation

Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2015-7450 IBM · WebSphere Application Server and Server Hypervisor Edition Added Jan 10, 2022

IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2017-1000486 Primetek · Primefaces Application Added Jan 10, 2022

Primetek Primefaces Remote Code Execution Vulnerability

Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2019-7609 Elastic · Kibana Added Jan 10, 2022

Kibana Arbitrary Code Execution

Kibana contain an arbitrary code execution flaw in the Timelion visualizer.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-27860 FatPipe · WARP, IPVPN, and MPVPN software Added Jan 10, 2022

FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-43890 Microsoft · Windows Added Dec 15, 2021

Microsoft Windows AppX Installer Spoofing Vulnerability

Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-4102 Google · Chromium V8 Added Dec 15, 2021

Google Chromium V8 Use-After-Free Vulnerability

Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-44515 Zoho · Desktop Central Added Dec 10, 2021

Zoho Desktop Central Authentication Bypass Vulnerability

Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2019-13272 Linux · Kernel Added Dec 10, 2021

Linux Kernel Improper Privilege Management Vulnerability

Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-35394 Realtek · Jungle Software Development Kit (SDK) Added Dec 10, 2021

Realtek Jungle SDK Remote Code Execution Vulnerability

RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed