Updated daily · official sources
Vulnerabilities (CVE) being actively exploited, according to the CISA KEV catalog, with CVSS severity and exploitation probability (EPSS).
CVE-2018-2380
Severity under analysis Ransomware added on 11/03/2021
SAP · Customer Relationship Management (CRM) · CWE-22
SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
CVE-2018-20062
Severity under analysis added on 11/03/2021
ThinkPHP · noneCms · CWE-20
ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.
CVE-2018-18325
Severity under analysis added on 11/03/2021
DotNetNuke (DNN) · DotNetNuke (DNN) · CWE-326
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811.
CVE-2018-15961
Severity under analysis added on 11/03/2021
Adobe · ColdFusion · CWE-434
Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.
CVE-2018-15811
Severity under analysis added on 11/03/2021
DotNetNuke (DNN) · DotNetNuke (DNN) · CWE-326
DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters.
CVE-2018-14558
Severity under analysis added on 11/03/2021
Tenda · AC7, AC9, and AC10 Routers · CWE-78
Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.
CVE-2018-13379
Severity under analysis Ransomware added on 11/03/2021
Fortinet · FortiOS · CWE-22
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
CVE-2018-11776
Severity under analysis added on 11/03/2021
Apache · Struts · CWE-20
Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace. Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.
CVE-2018-0802
Severity under analysis Ransomware added on 11/03/2021
Microsoft · Office · CWE-787
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.
CVE-2018-0798
Severity under analysis added on 11/03/2021
Microsoft · Office · CWE-787
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.
CVE-2018-0296
Severity under analysis added on 11/03/2021
Cisco · Adaptive Security Appliance (ASA) · CWE-20
Cisco Adaptive Security Appliance (ASA) contains an improper input validation vulnerability with HTTP URLs. Exploitation could allow an attacker to cause a denial-of-service (DoS) condition or information disclosure.
CVE-2018-0171
Severity under analysis added on 11/03/2021
Cisco · IOS and IOS XE · CWE-20
Cisco IOS and IOS XE Software improperly validates packet data, allowing an unauthenticated, remote attacker to trigger a reload of an affected device, cause a denial-of-service (DoS) condition, or perform code execution on the affected device.
CVE-2017-9822
Severity under analysis Ransomware added on 11/03/2021
DotNetNuke (DNN) · DotNetNuke (DNN) · CWE-20
DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.
CVE-2017-9805
Severity under analysis added on 11/03/2021
Apache · Struts · CWE-502
Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.
CVE-2017-9248
Severity under analysis added on 11/03/2021
Progress · ASP.NET AJAX and Sitefinity · CWE-522
Progress Telerik UI for ASP.NET AJAX and Sitefinity have a cryptographic weakness in Telerik.Web.UI.dll that can be exploited to disclose encryption keys (Telerik.Web.UI.DialogParametersEncryptionKey and/or the MachineKey), perform cross-site-scripting (XSS) attacks, compromise the ASP.NET ViewState, and/or upload and download files.
CVE-2017-8759
Severity under analysis added on 11/03/2021
Microsoft · .NET Framework · CWE-20
Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.
CVE-2017-7269
Severity under analysis added on 11/03/2021
Microsoft · Internet Information Services (IIS) · CWE-119
Microsoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If:
CVE-2017-6327
Severity under analysis added on 11/03/2021
Symantec · Symantec Messaging Gateway · CWE-20
Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions.
CVE-2017-5638
Severity under analysis Ransomware added on 11/03/2021
Apache · Struts · CWE-20
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
CVE-2017-16651
Severity under analysis added on 11/03/2021
Roundcube · Roundcube Webmail · CWE-552
Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
CVE-2017-11882
Severity under analysis Ransomware added on 11/03/2021
Microsoft · Office · CWE-119
Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.
CVE-2017-11774
Severity under analysis added on 11/03/2021
Microsoft · Office · CWE-119
Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.
CVE-2017-0199
Severity under analysis Ransomware added on 11/03/2021
Microsoft · Office and WordPad
Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.
CVE-2017-0143
Severity under analysis Ransomware added on 11/03/2021
Microsoft · Windows · CWE-20
Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.
We assess versions, access and integrations of your ERP and infrastructure and prioritize the fixes.
Sources: CISA Known Exploited Vulnerabilities Catalog, NIST National Vulnerability Database and FIRST EPSS. Informational content; always follow the vendor advisory and fix.
This product uses the NVD API but is not endorsed or certified by the NVD.
Bit is an AI and can make mistakes. Do not share passwords or personal data. Conversations are not stored. Learn more