Active threat advisories and known exploited vulnerabilities.

Critical CVE-2021-42292 Microsoft · Office Added Nov 17, 2021

Microsoft Excel Security Feature Bypass

A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-27104 Accellion · FTA Added Nov 3, 2021

Accellion FTA OS Command Injection Vulnerability

Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-27102 Accellion · FTA Added Nov 3, 2021

Accellion FTA OS Command Injection Vulnerability

Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-27101 Accellion · FTA Added Nov 3, 2021

Accellion FTA SQL Injection Vulnerability

Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-27103 Accellion · FTA Added Nov 3, 2021

Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability

Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-21017 Adobe · Acrobat and Reader Added Nov 3, 2021

Adobe Acrobat and Reader Heap-based Buffer Overflow Vulnerability

Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-28550 Adobe · Acrobat and Reader Added Nov 3, 2021

Adobe Acrobat and Reader Use-After-Free Vulnerability

Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2018-4939 Adobe · ColdFusion Added Nov 3, 2021

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2018-15961 Adobe · ColdFusion Added Nov 3, 2021

Adobe ColdFusion Unrestricted File Upload Vulnerability

Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2018-4878 Adobe · Flash Player Added Nov 3, 2021

Adobe Flash Player Use-After-Free Vulnerability

Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2020-5735 Amcrest · Cameras and Network Video Recorder (NVR) Added Nov 3, 2021

Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability

Amcrest cameras and NVR contain a stack-based buffer overflow vulnerability through port 37777 that allows an unauthenticated, remote attacker to crash the device and possibly execute code.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2019-2215 Android · Android Kernel Added Nov 3, 2021

Android Kernel Use-After-Free Vulnerability

Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain "AbstractEmu."

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2020-0041 Android · Android Kernel Added Nov 3, 2021

Android Kernel Out-of-Bounds Write Vulnerability

Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain "AbstractEmu."

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2020-0069 MediaTek · Multiple Chipsets Added Nov 3, 2021

Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability

Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0041 under exploit chain "AbstractEmu."

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2017-9805 Apache · Struts Added Nov 3, 2021

Apache Struts Deserialization of Untrusted Data Vulnerability

Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-42013 Apache · HTTP Server Added Nov 3, 2021

Apache HTTP Server Path Traversal Vulnerability

Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-41773 Apache · HTTP Server Added Nov 3, 2021

Apache HTTP Server Path Traversal Vulnerability

Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2019-0211 Apache · HTTP Server Added Nov 3, 2021

Apache HTTP Server Privilege Escalation Vulnerability

Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2016-4437 Apache · Shiro Added Nov 3, 2021

Apache Shiro Code Execution Vulnerability

Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2019-17558 Apache · Solr Added Nov 3, 2021

Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability

The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2020-17530 Apache · Struts Added Nov 3, 2021

Apache Struts Remote Code Execution Vulnerability

Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2017-5638 Apache · Struts Added Nov 3, 2021

Apache Struts Remote Code Execution Vulnerability

Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2018-11776 Apache · Struts Added Nov 3, 2021

Apache Struts Remote Code Execution Vulnerability

Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2021-30858 Apple · iOS, iPadOS, and macOS Added Nov 3, 2021

Apple iOS, iPadOS, macOS Use-After-Free Vulnerability

Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed

Critical CVE-2019-6223 Apple · iOS and macOS Added Nov 3, 2021

Apple iOS and macOS Group Facetime Vulnerability

Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction.

NVD Detail ↗ CISA KEV ↗ Patch deadline passed