Exploit / PoCcriticalExploited in the wild

CISA adds 15 new flaws to its Known Exploited Vulnerabilities Catalog

Security Affairsby @securityaffairsFeb 16, 2022 · 09:58 UTC (Feb 16, 2022)2 min read3 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-36934 CVE-2020-0796 CVE-2018-1000861 CVE-2017-9791 CVE-2017-8464 CVE-2017-10271 CVE-2017-0263 CVE-2017-0262 CVE-2017-0145 CVE-2017-0144 CVE-2016-3088 CVE-2015-2051 CVE-2015-1635 CVE-2015-1130 CVE-2014-4404

Tags: cve-2021-36934 cve-2020-0796 cve-2018-1000861 cve-2017-9791 cve-2017-8464 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2014-4404	Heap-Based Buffer Overflow in Apple IOHIDFamily (OS X, iOS, Apple TV)	—	49%	KEV	— KEV Feb 10, 2022
CVE-2015-1130	Local Authentication Bypass in Apple OS X Admin Framework (XPC)	—	10%	KEV	— KEV Feb 10, 2022
CVE-2015-1635	Unauthenticated Remote Code Execution in Microsoft HTTP.sys (MS15-034)	—	100%	KEV	— KEV Feb 10, 2022
CVE-2015-2051	Remote Command Execution via HNAP GetDeviceSettings in D-Link DIR-645 Router	—	97%	KEV	— KEV Feb 10, 2022
CVE-2016-3088	Unauthenticated Arbitrary File Upload Leading to RCE in Apache ActiveMQ Fileserver	9.8	99%	KEVPoC	Jun 1, 2016 KEV Feb 10, 2022
CVE-2017-0144 +1 related CVE CVE-2017-0145	Remote Code Execution in Microsoft SMBv1 (EternalBlue) affecting Windows and Siemens devices	8.8	99%	KEVRansomwarePoC ×6	Mar 17, 2017 KEV Feb 10, 2022
CVE-2017-0262	Memory Corruption RCE in Microsoft Office 2010, 2013, and 2016	7.8	81%	KEV	May 12, 2017 KEV Feb 10, 2022
CVE-2017-0263	Win32k Use-After-Free Local Privilege Escalation in Windows 7 through Server 2016	7.8	10%	KEVPoC ×2	May 12, 2017 KEV Feb 10, 2022
CVE-2017-10271	Unauthenticated Remote Code Execution in Oracle WebLogic Server	7.5	100%	KEVRansomwarePoC ×3	Oct 19, 2017 KEV Feb 10, 2022
CVE-2017-8464	Remote Code Execution in Microsoft Windows Shell via crafted .LNK shortcuts	8.8	90%	KEVPoC ×2	Jun 15, 2017 KEV Feb 10, 2022
CVE-2017-9791	Unauthenticated RCE via Improper Input Validation in Apache Struts 1 Plugin	9.8	99%	KEV	Jul 10, 2017 KEV Feb 10, 2022
CVE-2018-1000861	Unauthenticated RCE in Jenkins Stapler Web Framework via Crafted URLs	9.8	98%	KEV	Dec 10, 2018 KEV Feb 10, 2022
CVE-2020-0796	Unauthenticated RCE in Microsoft SMBv3 (SMBGhost)	10.0	100%	KEVRansomwarePoC ×2	Mar 12, 2020 KEV Feb 10, 2022
CVE-2021-36934	Local Privilege Escalation (SeriousSAM/HiveNightmare) in Microsoft Windows 10	7.8	67%	KEV	Jul 22, 2021 KEV Feb 10, 2022

From the original article

2 min read at securityaffairs.com

The U. S. CISA has added to the catalog of vulnerabilities another 15 security vulnerabilities actively exploited in the wild.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.