AdvisorycriticalExploited in the wild

CISA adds Zoho, Apache, Qualcomm, Mikrotik flaws to the list of actively exploited issues

Security Affairsby @securityaffairsDec 2, 2021 · 20:17 UTC (Dec 2, 2021)1 min read3

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-37415 CVE-2021-44077 CVE-2018-14847 CVE-2021-40438 CVE-2020-11261

Tags: cve-2021-37415 cve-2021-44077 cve-2018-14847 cve-2021-40438 cve-2020-11261 advisory

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2018-14847	Directory Traversal in MikroTik RouterOS Winbox Interface (Unauthenticated File Read)	9.1	96%	KEVPoC ×7	Aug 2, 2018 KEV Dec 1, 2021
CVE-2020-11261	Local Privilege Escalation via Memory Corruption in Qualcomm Snapdragon Chipsets	7.8	2%	KEV	Jun 9, 2021 KEV Dec 1, 2021
CVE-2021-37415	Authentication Bypass in Zoho ManageEngine ServiceDesk Plus REST API	9.8	100%	KEV	Sep 1, 2021 KEV Dec 1, 2021
CVE-2021-40438	Server-Side Request Forgery (SSRF) in Apache HTTP Server mod_proxy	9.0	100%	KEVRansomware	Sep 16, 2021 KEV Dec 1, 2021
CVE-2021-44077	Unauthenticated RCE in Zoho ManageEngine ServiceDesk Plus and SupportCenter Plus	9.8	93%	KEVPoC	Nov 29, 2021 KEV Dec 1, 2021

From the original article

1 min read at securityaffairs.com

U. S. CISA urges to address vulnerabilities Qualcomm, Mikrotik, Zoho and the Apache Software Foundation software.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.