Updated daily · official sources
Vulnerabilities (CVE) being actively exploited, according to the CISA KEV catalog, with CVSS severity and exploitation probability (EPSS).
CVE-2020-14883
Severity under analysis added on 11/03/2021
Oracle · WebLogic Server
Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.
CVE-2020-14882
Severity under analysis added on 11/03/2021
Oracle · WebLogic Server
Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.
CVE-2020-14871
Severity under analysis added on 11/03/2021
Oracle · Solaris and Zettabyte File System (ZFS) · CWE-787
Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.
CVE-2020-14750
Severity under analysis added on 11/03/2021
Oracle · WebLogic Server
Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.
CVE-2020-1472
Severity under analysis Ransomware added on 11/03/2021
Microsoft · Netlogon · CWE-330
Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.
CVE-2020-1464
Severity under analysis added on 11/03/2021
Microsoft · Windows · CWE-347
Microsoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.
CVE-2020-1380
Severity under analysis added on 11/03/2021
Microsoft · Internet Explorer · CWE-787
Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.
CVE-2020-1350
Severity under analysis added on 11/03/2021
Microsoft · Windows
Microsoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.
CVE-2020-12812
Severity under analysis Ransomware added on 11/03/2021
Fortinet · FortiOS · CWE-178, CWE-287
Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.
CVE-2020-11738
Severity under analysis added on 11/03/2021
WordPress · Snap Creek Duplicator Plugin · CWE-22
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
CVE-2020-1147
Severity under analysis added on 11/03/2021
Microsoft · .NET Framework, SharePoint, Visual Studio
Microsoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.
CVE-2020-1054
Severity under analysis added on 11/03/2021
Microsoft · Win32k · CWE-787
Microsoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.
CVE-2020-1040
Severity under analysis added on 11/03/2021
Microsoft · Hyper-V RemoteFX · CWE-20
Microsoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system.
CVE-2020-1020
Severity under analysis added on 11/03/2021
Microsoft · Windows · CWE-787
Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.
CVE-2020-0986
Severity under analysis added on 11/03/2021
Microsoft · Windows · CWE-787
Microsoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.
CVE-2020-0968
Severity under analysis Ransomware added on 11/03/2021
Microsoft · Internet Explorer · CWE-787
Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.
CVE-2020-0938
Severity under analysis added on 11/03/2021
Microsoft · Windows · CWE-787
Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.
CVE-2020-0878
Severity under analysis Ransomware added on 11/03/2021
Microsoft · Edge and Internet Explorer · CWE-787
Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.
CVE-2020-0688
Severity under analysis Ransomware added on 11/03/2021
Microsoft · Exchange Server · CWE-287
Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.
CVE-2020-0683
Severity under analysis added on 11/03/2021
Microsoft · Windows
Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.
CVE-2020-0674
Severity under analysis added on 11/03/2021
Microsoft · Internet Explorer · CWE-416
Microsoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user.
CVE-2020-0646
Severity under analysis added on 11/03/2021
Microsoft · .NET Framework · CWE-91
Microsoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.
CVE-2020-0601
Severity under analysis added on 11/03/2021
Microsoft · Windows · CWE-295
Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.
CVE-2019-9978
Severity under analysis added on 11/03/2021
WordPress · Social Warfare Plugin · CWE-79
WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.
We assess versions, access and integrations of your ERP and infrastructure and prioritize the fixes.
Sources: CISA Known Exploited Vulnerabilities Catalog, NIST National Vulnerability Database and FIRST EPSS. Informational content; always follow the vendor advisory and fix.
This product uses the NVD API but is not endorsed or certified by the NVD.
Bit is an AI and can make mistakes. Do not share passwords or personal data. Conversations are not stored. Learn more