Exploited vulnerabilities.

Search

Vendor All vendorsMicrosoft (390)Cisco (101)Apple (95)Adobe (82)Google (75)Oracle (46)Apache (41)Ivanti (36)Fortinet (32)Linux (31)Citrix (27)D-Link (26)VMware (26)SonicWall (19)Synacor (19)Android (17)Palo Alto Networks (16)Samsung (15)Atlassian (14)SAP (14)Mozilla (13)Zyxel (13)Qualcomm (12)Trend Micro (12)QNAP (11)Roundcube (11)SolarWinds (11)Arm (9)Progress (9)Red Hat (9)Zoho (9)F5 (8)IBM (8)Juniper (8)NETGEAR (8)Mitel (7)Sophos (7)Jenkins (6)TP-Link (6)WordPress (6)

Added Any timeLast 7 daysLast 30 daysLast 90 days

Ransomware only Filter

1756 results.

CVE-2015-4068 Arcserve · Unified Data Protection (UDP)

Arcserve Unified Data Protection (UDP) Directory Traversal Vulnerability

Directory traversal vulnerability in Arcserve UDP allows remote attackers to obtain sensitive information or cause a denial of service.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-22

Fix: Apply updates per vendor instructions.

CVE-2015-3035 TP-Link · Multiple Archer Devices

TP-Link Multiple Archer Devices Directory Traversal Vulnerability

Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-22

Fix: Apply updates per vendor instructions.

CVE-2015-1427 Elastic · Elasticsearch

Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability

The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-284

Fix: Apply updates per vendor instructions.

CVE-2015-1187 D-Link and TRENDnet · Multiple Devices

D-Link and TRENDnet Multiple Devices Remote Code Execution Vulnerability

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-287

Fix: The impacted product is end-of-life and should be disconnected if still in use.

CVE-2015-0666 Cisco · Prime Data Center Network Manager (DCNM)

Cisco Prime Data Center Network Manager (DCNM) Directory Traversal Vulnerability

Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-22

Fix: Apply updates per vendor instructions.

CVE-2014-6332 Microsoft · Windows

Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability

OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-119

Fix: Apply updates per vendor instructions.

CVE-2014-6324 Microsoft · Kerberos Key Distribution Center (KDC)

Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability

The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-264

Fix: Apply updates per vendor instructions.

CVE-2014-6287 Rejetto · HTTP File Server (HFS)

Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-94

Fix: Apply updates per vendor instructions.

CVE-2014-3120 Elastic · Elasticsearch

Elasticsearch Remote Code Execution Vulnerability

Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-284

Fix: Apply updates per vendor instructions.

CVE-2014-0130 Rails · Ruby on Rails

Ruby on Rails Directory Traversal Vulnerability

Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-22

Fix: Apply updates per vendor instructions.

CVE-2013-5223 D-Link · DSL-2760U

D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-79

Fix: Apply updates per vendor instructions.

CVE-2013-4810 Hewlett Packard (HP) · ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management

HP Multiple Products Remote Code Execution Vulnerability

HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-94

Fix: Apply updates per vendor instructions.

CVE-2013-2251 Apache · Struts

Apache Struts Improper Input Validation Vulnerability

Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-20

Fix: Apply updates per vendor instructions.

CVE-2012-1823 PHP · PHP

PHP-CGI Query String Parameter Vulnerability

sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-20

Fix: Apply updates per vendor instructions.

CVE-2010-4345 Exim · Exim

Exim Privilege Escalation Vulnerability

Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-264

Fix: Apply updates per vendor instructions.

CVE-2010-4344 Exim · Exim

Exim Heap-Based Buffer Overflow Vulnerability

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-119

Fix: Apply updates per vendor instructions.

CVE-2010-3035 Cisco · IOS XR

Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-20

Fix: Apply updates per vendor instructions.

CVE-2010-2861 Adobe · ColdFusion Ransomware

Adobe ColdFusion Directory Traversal Vulnerability

A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-22

Fix: Apply updates per vendor instructions.

CVE-2009-2055 Cisco · IOS XR

Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability

Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-20

Fix: Apply updates per vendor instructions.

CVE-2009-1151 phpMyAdmin · phpMyAdmin

phpMyAdmin Remote Code Execution Vulnerability

Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-94

Fix: Apply updates per vendor instructions.

CVE-2009-0927 Adobe · Reader and Acrobat

Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow Vulnerability

Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022 · CWE-20

Fix: Apply updates per vendor instructions.

CVE-2005-2773 Hewlett Packard (HP) · OpenView Network Node Manager

HP OpenView Network Node Manager Remote Code Execution Vulnerability

HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system.

Added Mar 25, 2022 · US agencies must patch by Apr 15, 2022

Fix: Apply updates per vendor instructions.

CVE-2020-5135 SonicWall · SonicOS Ransomware

SonicWall SonicOS Buffer Overflow Vulnerability

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.

Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022 · CWE-120

Fix: Apply updates per vendor instructions.

CVE-2019-1405 Microsoft · Windows Ransomware

Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.

Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022

Fix: Apply updates per vendor instructions.

CVE-2019-1322 Microsoft · Windows Ransomware

Microsoft Windows Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022

Fix: Apply updates per vendor instructions.

CVE-2019-1315 Microsoft · Windows Ransomware

Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.

Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022 · CWE-59

Fix: Apply updates per vendor instructions.

CVE-2019-1253 Microsoft · Windows Ransomware

Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.

Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022 · CWE-59

Fix: Apply updates per vendor instructions.

CVE-2019-1132 Microsoft · Win32k

Microsoft Win32k Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.

Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022

Fix: Apply updates per vendor instructions.

CVE-2019-1129 Microsoft · Windows Ransomware

Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.

Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022 · CWE-59

Fix: Apply updates per vendor instructions.

CVE-2019-1069 Microsoft · Task Scheduler Ransomware

Microsoft Task Scheduler Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.

Added Mar 15, 2022 · US agencies must patch by Apr 5, 2022 · CWE-59

Fix: Apply updates per vendor instructions.