US CISA added 17 flaws to its Known Exploited Vulnerabilities Catalog
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2006-1547 | Denial-of-Service in Apache Struts 1 ActionForm (pre-1.2.9) | — | 55% | KEV | — KEV |
| CVE-2012-0391 | Unauthenticated RCE in Apache Struts 2 via ExceptionDelegator | — | 76% | KEV | — KEV |
| CVE-2018-8453 | Win32k Elevation of Privilege Flaw in Windows 7-10 and Windows Server (CVE-2018-8453) | 7.8 | 70% | KEVRansomwarePoC ×2 | KEV |
| CVE-2020-11978 | Authenticated Command Injection via Example DAGs in Apache Airflow (<=1.10.10) | 8.8 | 99% | KEVPoC ×2 | KEV |
| CVE-2020-13671 | Unrestricted File Upload via Filename Sanitization Flaw in Drupal Core | 8.8 | 36% | KEV | KEV |
| CVE-2020-13927 | Authentication Bypass in Apache Airflow's Experimental API | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2020-14864 | Unauthenticated Path Traversal in Oracle Business Intelligence Enterprise Edition | 7.5 | 97% | KEV | KEV |
| CVE-2021-21315 | Command Injection in systeminformation npm Package (CVE-2021-21315) | 7.8 | 91% | KEV | KEV |
| CVE-2021-21975 | SSRF in VMware vRealize Operations Manager API Enables Admin Credential Theft | 7.5 | 78% | KEVRansomwarePoC | KEV |
| CVE-2021-22991 | Buffer Overflow in F5 BIG-IP Traffic Management Microkernel (TMM) | 9.8 | 62% | KEV | KEV |
CVE-2021-25298+2 related CVEs | Authenticated OS Command Injection in Nagios XI 5.7.5 Cloud-VM Config Wizard | 8.8 | 74% | KEVPoC ×4 | KEV |
| CVE-2021-32648 | Authentication Bypass in October CMS Password Reset Enables Account Takeover | 9.1 | 90% | KEV | KEV |
| CVE-2021-33766 | Unauthenticated Information Disclosure (ProxyToken) in Microsoft Exchange Server | 7.3 | 98% | KEV | KEV |
| CVE-2021-35247 | Actively Exploited Input Validation Flaw in SolarWinds Serv-U LDAP Login | 5.3 | 3% | KEV | KEV |
| CVE-2021-40870 | Unauthenticated File-Upload RCE via Path Traversal in Aviatrix Controller 6.x | 9.8 | 93% | KEVPoC ×2 | KEV |
From the original article
2 min read at securityaffairs.com
US CISA added seventeen new actively exploited vulnerabilities to the ‘Known Exploited Vulnerabilities Catalog’. The ‘ Known Exploited Vulnerabilities Catalog ‘ is a list of known vulnerabilities that threat actors have abused in attacks and that are required to be addressed by Federal Civilian Executive Branch (FCEB) agencies.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.