Threat feed

• CVE-2017-0213CriticalCVSS7.3EPSS 84.3%KEVRansomware

  Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2021-26085CriticalCVSS5.3EPSS 99.9%KEVRansomware

  Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2016-7201CriticalCVSS8.8EPSS 80.0%KEV

  The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2013-1690CriticalCVSS8.8EPSS 69.0%KEV

  Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2017-0037CriticalCVSS8.1EPSS 80.4%KEV

  Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2013-2729CriticalCVSS9.8EPSS 66.6%KEV

  Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2013-2551CriticalCVSS8.8EPSS 73.9%KEVRansomware

  Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2016-0151CriticalCVSS7.8EPSS 62.9%KEVRansomware

  The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

  KEV added: 2022-03-28Official (NVD) →
• CVE-2015-2419CriticalCVSS8.8EPSS 53.1%KEV

  JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corruption Vulnerability."

  KEV added: 2022-03-28Official (NVD) →
• CVE-2021-20028CriticalCVSS9.8EPSS 30.1%KEVRansomware

  Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier

  KEV added: 2022-03-28Official (NVD) →
• CVE-2012-2539CriticalCVSS7.8EPSS 53.0%KEV

  Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "Word RTF 'listoverridecount' Remote Code Execution Vulnerability."

  KEV added: 2022-03-28Official (NVD) →
• CVE-2015-1770CriticalCVSS8.8EPSS 35.0%KEV

  Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability."

  KEV added: 2022-03-28Official (NVD) →
• CVE-2022-1096CriticalCVSS8.8EPSS 24.7%KEV

  Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2013-3660CriticalCVSS7.8EPSS 39.3%KEV

  The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."

  KEV added: 2022-03-28Official (NVD) →
• CVE-2016-0040CriticalCVSS7.8EPSS 24.3%KEV

  The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."

  KEV added: 2022-03-28Official (NVD) →
• CVE-2017-0059CriticalCVSS4.3EPSS 62.0%KEV

  Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0008 and CVE-2017-0009.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2011-2005CriticalCVSS7.8EPSS 31.8%KEV

  afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."

  KEV added: 2022-03-28Official (NVD) →
• CVE-2018-8440CriticalCVSS7.8EPSS 18.5%KEVRansomware

  An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2021-34486CriticalCVSS7.8EPSS 9.3%KEV

  Windows Event Tracing Elevation of Privilege Vulnerability

  KEV added: 2022-03-28Official (NVD) →
• CVE-2010-4398CriticalCVSS7.8EPSS 8.7%KEV

  Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."

  KEV added: 2022-03-28Official (NVD) →
• CVE-2019-7483CriticalCVSS7.5EPSS 4.0%KEV

  In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2021-38646CriticalCVSS7.8EPSS 8.0%KEVRansomware

  Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

  KEV added: 2022-03-28Official (NVD) →
• CVE-2012-2034CriticalCVSS7.5EPSS 7.7%KEV

  Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2018-8406CriticalCVSS7.8EPSS 3.4%KEVRansomware

  An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8405.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2018-8405CriticalCVSS7.8EPSS 3.4%KEVRansomware

  An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2012-0518CriticalCVSS4.7EPSS 4.7%KEV

  Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.

  KEV added: 2022-03-28Official (NVD) →
• CVE-2013-2251CriticalCVSS9.8EPSS 100.0%KEV

  Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.

  KEV added: 2022-03-25Official (NVD) →
• CVE-2012-1823CriticalCVSS9.8EPSS 100.0%KEV

  sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

  KEV added: 2022-03-25Official (NVD) →
• CVE-2019-11043CriticalCVSS9.8EPSS 99.7%KEVRansomware

  In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

  KEV added: 2022-03-25Official (NVD) →
• CVE-2017-3881CriticalCVSS9.8EPSS 99.0%KEV

  A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.

  KEV added: 2022-03-25Official (NVD) →
• CVE-2019-12989CriticalCVSS9.8EPSS 94.9%KEV

  Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

  KEV added: 2022-03-25Official (NVD) →
• CVE-2019-16920CriticalCVSS9.8EPSS 100.0%KEV

  Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later, it was independently found that these are also affected: DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835, and DIR-825.

  KEV added: 2022-03-25Official (NVD) →
• CVE-2020-9054CriticalCVSS9.8EPSS 100.0%KEV

  Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2

  KEV added: 2022-03-25Official (NVD) →
• CVE-2015-1427CriticalCVSS9.8EPSS 99.9%KEV

  The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

  KEV added: 2022-03-25Official (NVD) →
• CVE-2019-15107CriticalCVSS9.8EPSS 99.7%KEVRansomware

  An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

  KEV added: 2022-03-25Official (NVD) →
• CVE-2010-2861CriticalCVSS9.8EPSS 99.7%KEVRansomware

  Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.

  KEV added: 2022-03-25Official (NVD) →
• CVE-2020-1956CriticalCVSS8.8EPSS 97.3%KEV

  Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

  KEV added: 2022-03-25Official (NVD) →
• CVE-2014-6287CriticalCVSS9.8EPSS 99.3%KEV

  The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

  KEV added: 2022-03-25Official (NVD) →
• CVE-2020-7247CriticalCVSS9.8EPSS 99.0%KEV

  smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

  KEV added: 2022-03-25Official (NVD) →
• CVE-2016-1555CriticalCVSS9.8EPSS 98.3%KEV

  (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

  KEV added: 2022-03-25Official (NVD) →

Priority = KEV (actively exploited) + EPSS (probability of exploitation in 30 days) + CVSS (severity). A defensive feed — no exploit code or PoC. Each CVE links to the official source (NVD).