Live feed · cooey

2022-03-25 CISA KEV

Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability HIGH

The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges.

2022-03-25 CISA KEV

Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability HIGH

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.

2022-03-25 CISA KEV

Elasticsearch Remote Code Execution Vulnerability HIGH

Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.

2022-03-25 CISA KEV

Ruby on Rails Directory Traversal Vulnerability HIGH

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.

2022-03-25 CISA KEV

D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability HIGH

A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.

2022-03-25 CISA KEV

HP Multiple Products Remote Code Execution Vulnerability HIGH

HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.

2022-03-25 CISA KEV

Apache Struts Improper Input Validation Vulnerability HIGH

Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.

2022-03-25 CISA KEV

PHP-CGI Query String Parameter Vulnerability HIGH

sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.

2022-03-25 CISA KEV

Exim Privilege Escalation Vulnerability HIGH

Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.

2022-03-25 CISA KEV

Exim Heap-Based Buffer Overflow Vulnerability HIGH

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.

2022-03-25 CISA KEV

Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability HIGH

Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

2022-03-25 CISA KEV

Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability HIGH

Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

2022-03-25 CISA KEV

phpMyAdmin Remote Code Execution Vulnerability HIGH

Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.

2022-03-25 CISA KEV

Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability HIGH

Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.

2022-03-25 CISA KEV

HP OpenView Network Node Manager Remote Code Execution Vulnerability HIGH

HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system.

2022-03-25 CISA KEV

Webmin Command Injection Vulnerability CRITICAL ◈ 2 sources · orig. NVD CVE

An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.

2022-03-25 CISA KEV

Quest KACE System Management Appliance Remote Command Execution Vulnerability CRITICAL ◈ 2 sources · orig. NVD CVE

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.

2022-03-25 CISA KEV

Adobe ColdFusion Directory Traversal Vulnerability CRITICAL ◈ 2 sources · orig. NVD CVE

A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.

2022-03-25 CISA KEV

Sitecore XP Remote Command Execution Vulnerability CRITICAL ◈ 2 sources · orig. NVD CVE

Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.

2022-03-15 CISA KEV

Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability CRITICAL

A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.

2022-03-15 CISA KEV

Microsoft Windows Transaction Manager Privilege Escalation Vulnerability CRITICAL

A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.

2022-03-15 CISA KEV

Microsoft Win32k Privilege Escalation Vulnerability CRITICAL

A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.

2022-03-15 CISA KEV

Microsoft Windows Privilege Escalation Vulnerability CRITICAL

A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

2022-03-15 CISA KEV

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability CRITICAL

A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

2022-03-15 CISA KEV

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability CRITICAL

A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

2022-03-15 CISA KEV

Microsoft Task Scheduler Privilege Escalation Vulnerability CRITICAL

A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.

2022-03-15 CISA KEV

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability CRITICAL

A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

2022-03-15 CISA KEV

Microsoft Win32k Privilege Escalation Vulnerability HIGH

A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.

2022-03-15 CISA KEV

Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability CRITICAL

A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.

2022-03-15 CISA KEV

Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability CRITICAL

A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an...

2022-03-15 CISA KEV

Microsoft Windows Privilege Escalation Vulnerability CRITICAL

A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

2022-03-15 CISA KEV

SonicWall SonicOS Buffer Overflow Vulnerability HIGH

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.

2022-03-15 CISA KEV

Microsoft Win32k Memory Corruption Vulnerability CRITICAL

The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.

2022-03-15 CISA KEV

Microsoft Windows Kernel Privilege Escalation Vulnerability CRITICAL

A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

2022-03-07 CISA KEV

Adobe ColdFusion Authentication Bypass Vulnerability HIGH

Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.

2022-03-07 CISA KEV

Adobe ColdFusion Directory Traversal Vulnerability HIGH

Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.

2022-03-07 CISA KEV

Adobe ColdFusion Information Disclosure Vulnerability HIGH

Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.

2022-03-07 CISA KEV

NETGEAR Multiple Routers Remote Code Execution Vulnerability HIGH

NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.

2022-03-07 CISA KEV

NETGEAR DGN2200 Remote Code Execution Vulnerability HIGH

NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.

2022-03-07 CISA KEV

Mozilla Firefox Use-After-Free Vulnerability HIGH ◈ 2 sources · orig. NVD CVE

Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.