Known exploited vulnerabilities

This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. Processing…

A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001…

Attackers can take control of vulnerable F5 management systems remotely, potentially disrupting services and using them as a foothold into the network

An outdated Access Manager system can leak sensitive setup details to outsiders, giving attackers information they can use to plan further attacks

An outdated browser can be taken over if a user opens a specially made malicious web page. CVE-2021-21193 is rated high (CVSS 8.8), affects chromium on…

A malicious website or link can take over an outdated browser session and let an attacker run harmful software on the user’s computer

A malicious document could let an attacker take control of a vulnerable computer if it is opened, so affected software should be updated promptly

A malicious web page or document can take over older Windows systems that still use Internet Explorer technology, potentially leading to data theft or…

An outdated browser could be taken over when someone visits a malicious web page, putting data and the device at risk

Attackers can break into vulnerable email servers from the internet, steal sensitive mail, and use the server as a foothold for wider attacks including…

Attackers can use vulnerable email servers to break in, steal sensitive messages and credentials, and use the server as a launch point for broader attacks…

Attackers can abuse vulnerable Microsoft Exchange email servers to break in, steal mail and credentials, and potentially deploy ransomware

An unpatched email server could let attackers take control of it, steal mail and credentials, and potentially use it to spread ransomware

Windows Win32k Elevation of Privilege Vulnerability. CVE-2021-1732 is rated high (CVSS 7.8), is listed in CISA KEV and is classified as CWE-787.

An attacker who can reach the VMware management server may be able to take it over and use it to control or disrupt the organization’s virtual servers

A vulnerable file-transfer appliance can let attackers run commands, steal transferred files, and disrupt operations, so affected systems should be upgraded or…

A vulnerable file-transfer server could let attackers steal sensitive shared files and use them for extortion. CVE-2021-27103 is rated critical (CVSS 9.8), is…

Attackers can break into vulnerable Accellion file transfer systems over the internet and steal or alter sensitive files without needing a password

Attackers can break into vulnerable Accellion file-transfer servers remotely and steal or manipulate sensitive shared files, creating a serious extortion and…

Opening a malicious PDF in an outdated Adobe PDF reader can let an attacker take control of the user’s computer

Outdated McAfee protection software can let someone who already gets onto a computer take full control of it and weaken its defenses

A vulnerable reporting server can be remotely taken over by attackers, putting operational data and connected systems at risk

Attackers can break into vulnerable remote-access VPN systems from the internet and steal login or session information that may let them enter the…

D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution

An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve…

Microsoft Defender Remote Code Execution Vulnerability. CVE-2021-1647 is rated high (CVSS 7.8), is listed in CISA KEV and is classified as CWE-20.

A problem in the web browser could let attackers take over a computer if someone visits a specially made website

A bug in the browser's security barriers let attackers who tricked someone into visiting a bad webpage break out and potentially take over the whole computer

A hole in a network monitoring product lets outsiders take it over without any login, potentially giving them broad access to an organization's systems

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found…

A flaw in Exchange email servers lets attackers with certain access run their own code remotely, potentially stealing emails or taking over the system

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9…

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9…

A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High…

A flaw in Windows allows users with basic access to take full control of the computer. CVE-2020-17087 is rated high (CVSS 7.8), is listed in CISA KEV and is…

A flaw in older versions of Chrome on Android phones could let an attacker who already broke into the browser take over the whole device

A malicious website can crash or take over an outdated web browser by feeding it a bad font file, so every computer still running that old browser or font…

Attackers can seize control of important business servers over the internet without any login, risking theft of data and disruption of operations

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using…

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software…

A problem in the management screen of certain Oracle server software lets people who already have high-level access take over the entire system when they…

A flaw in popular web server software lets outsiders take full control remotely without any login. CVE-2020-14882 is rated critical (CVSS 9.8) and is listed in…

A serious flaw in the login checking system of certain server software lets remote attackers take full control of the machine without any login credentials

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free…

NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. CVE-2020-26919 is rated critical (CVSS 9.8) and is…

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an…

Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote…

A flaw in older Microsoft web browsers could let attackers take control of a computer if a user visits a malicious website, potentially allowing ransomware or…

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an…

Attackers who already have a small foothold on a computer can trick the security software into turning itself off long enough to take complete control of the…