Vulnerabilitycritical
Have you patched these top 10 routinely exploited vulnerabilities?
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) | — | 100% | KEVRansomware | — KEV |
| CVE-2015-1641 | Memory Corruption RCE in Microsoft Office via Malicious RTF Files | — | 97% | KEV | — KEV |
| CVE-2017-0143 | Remote Code Execution in Microsoft Windows SMBv1 (EternalBlue family) | 8.8 | 93% | KEVRansomwarePoC ×5 | KEV |
| CVE-2017-0199 | Remote Code Execution in Microsoft Office and WordPad via crafted document files | 7.8 | 99% | KEVRansomwarePoC ×6 | KEV |
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
| CVE-2017-5638 | Unauthenticated RCE in Apache Struts Jakarta Multipart parser | 9.8 | 100% | KEVRansomwarePoC ×10 | KEV |
| CVE-2017-8759 | Remote Code Execution in Microsoft .NET Framework via Malicious Documents (CWE-94) | 7.8 | 89% | KEVPoC ×2 | KEV |
| CVE-2018-4878 | Use-After-Free RCE in Adobe Flash Player before 28.0.0.161 | 7.8 | 90% | KEVRansomwarePoC ×2 | KEV |
| CVE-2018-7600 | Unauthenticated Remote Code Execution in Drupal Core (Drupalgeddon 2) | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2019-0604 | RCE in Microsoft SharePoint via Application Package Markup Validation Flaw | 9.8 | 100% | KEVRansomware | KEV |
| CVE-2019-11510 | Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2019-19781 | Unauthenticated path traversal RCE in Citrix ADC, Gateway, and SD-WAN WANOP | 9.8 | 100% | KEVRansomware | KEV |
From the original article
2 min read at helpnetsecurity.com
The US Cybersecurity and Infrastructure Security Agency ( CISA ) is urging organizations to patch a slew of old and new software vulnerabilities that are routinely exploited by foreign cyber actors and cyber criminals. “Foreign cyber actors continue to exploit publicly known—and often dated—software vulnerabilities against broad target sets, including public and private sector organizations.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.