{"meta":{"title":"KEV entries with known ransomware use","description":"Every KEV entry whose knownRansomwareCampaignUse is Known, newest first.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":361},"data":[{"cveID":"CVE-2026-59310","vendorProject":"Broadcom","product":"VMware vCenter","vulnerabilityName":"Broadcom VMware vCenter Path Traversal Vulnerability","dateAdded":"2026-08-18","dueDate":"2026-08-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59310","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-59310/"},{"cveID":"CVE-2026-63077","vendorProject":"JetBrains","product":"TeamCity","vulnerabilityName":"JetBrains TeamCity Deserialization of Untrusted Data Vulnerability","dateAdded":"2026-08-05","dueDate":"2026-08-08","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/; https://www.jetbrains.com/privacy-security/issues-fixed/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63077","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-63077/"},{"cveID":"CVE-2026-20316","vendorProject":"Cisco","product":"Secure Firewall Management Center (FMC)","vulnerabilityName":"Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability","dateAdded":"2026-07-29","dueDate":"2026-08-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-259"],"shortDescription":"Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-static-cred-BET3Cjh ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20316","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-20316/"},{"cveID":"CVE-2026-15410","vendorProject":"SonicWall","product":"SMA1000 Appliances","vulnerabilityName":"SonicWall SMA1000 Appliances Code Injection Vulnerability","dateAdded":"2026-07-14","dueDate":"2026-07-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15410","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-15410/"},{"cveID":"CVE-2026-15409","vendorProject":"SonicWall","product":"SMA1000 Appliances","vulnerabilityName":"SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability","dateAdded":"2026-07-14","dueDate":"2026-07-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0008 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-15409","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-15409/"},{"cveID":"CVE-2026-45659","vendorProject":"Microsoft","product":"SharePoint Server","vulnerabilityName":"Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability","dateAdded":"2026-07-01","dueDate":"2026-07-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45659 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-45659","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-45659/"},{"cveID":"CVE-2026-12569","vendorProject":"PTC","product":"Windchill and FlexPLM","vulnerabilityName":"PTC Windchill and FlexPLM Improper Input Validation Vulnerability","dateAdded":"2026-06-25","dueDate":"2026-06-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-502"],"shortDescription":"PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://www.ptc.com/en/support/article/CS473270 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-12569","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-12569/"},{"cveID":"CVE-2026-35273","vendorProject":"Oracle","product":" PeopleSoft Enterprise PeopleTools","vulnerabilityName":"Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability","dateAdded":"2026-06-12","dueDate":"2026-06-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://www.oracle.com/security-alerts/alert-cve-2026-35273.html ; https://support.oracle.com/signin/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-35273","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-35273"},{"cveID":"CVE-2026-50751","vendorProject":"Check Point","product":"Security Gateway","vulnerabilityName":"Check Point Security Gateway Improper Authentication Vulnerability","dateAdded":"2026-06-08","dueDate":"2026-06-11","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/ ; https://support.checkpoint.com/results/sk/sk185033?_gl=1*1wqeqhc*_gcl_au*MTI1MzE5MjI2LjE3ODA5MzQ1NTM. ; https://nvd.nist.gov/vuln/detail/CVE-2026-50751","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-50751"},{"cveID":"CVE-2026-0257","vendorProject":"Palo Alto Networks","product":"PAN-OS","vulnerabilityName":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","dateAdded":"2026-05-29","dueDate":"2026-06-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-565"],"shortDescription":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://security.paloaltonetworks.com/CVE-2026-0257 ; https://nvd.nist.gov/vuln/detail/CVE-2026-0257","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-0257"},{"cveID":"CVE-2026-48027","vendorProject":"Nx","product":"Nx Console","vulnerabilityName":"Nx Console Embedded Malicious Code Vulnerability","dateAdded":"2026-05-27","dueDate":"2026-06-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-506"],"shortDescription":"Nx Console contains an embedded malicious code vulnerability that allowed a malicious version of Nx Console to be published. The compromised extension fetched an obfuscated payload that could harvested credentials from multiple sources on disk and in memory.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w ; https://nvd.nist.gov/vuln/detail/CVE-2026-48027","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-48027"},{"cveID":"CVE-2026-45321","vendorProject":"TanStack","product":"TanStack","vulnerabilityName":"TanStack Unspecified Vulnerability","dateAdded":"2026-05-27","dueDate":"2026-06-10","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx ; https://nvd.nist.gov/vuln/detail/CVE-2026-45321","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-45321"},{"cveID":"CVE-2026-41940","vendorProject":"WebPros","product":"cPanel & WHM and WP2 (WordPress Squared)","vulnerabilityName":"WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability","dateAdded":"2026-04-30","dueDate":"2026-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026 ; https://docs.cpanel.net/release-notes/release-notes/ ; https://docs.wpsquared.com/changelogs/versions/changelog/#13617 ; https://nvd.nist.gov/vuln/detail/CVE-2026-41940\"","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-41940"},{"cveID":"CVE-2024-1708","vendorProject":"ConnectWise","product":"ScreenConnect","vulnerabilityName":"ConnectWise ScreenConnect Path Traversal Vulnerability","dateAdded":"2026-04-28","dueDate":"2026-05-12","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1708","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2024-1708"},{"cveID":"CVE-2024-57728","vendorProject":"SimpleHelp ","product":"SimpleHelp","vulnerabilityName":"SimpleHelp Path Traversal Vulnerability","dateAdded":"2026-04-24","dueDate":"2026-05-08","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier ; https://nvd.nist.gov/vuln/detail/CVE-2024-57728","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2024-57728"},{"cveID":"CVE-2024-57726","vendorProject":"SimpleHelp ","product":"SimpleHelp","vulnerabilityName":"SimpleHelp Missing Authorization Vulnerability","dateAdded":"2026-04-24","dueDate":"2026-05-08","knownRansomwareCampaignUse":"Known","cwes":["CWE-862"],"shortDescription":"SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier ; https://nvd.nist.gov/vuln/detail/CVE-2024-57726","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2024-57726"},{"cveID":"CVE-2026-33825","vendorProject":"Microsoft","product":"Defender","vulnerabilityName":"Microsoft Defender Insufficient Granularity of Access Control Vulnerability","dateAdded":"2026-04-22","dueDate":"2026-05-06","knownRansomwareCampaignUse":"Known","cwes":["CWE-1220"],"shortDescription":"Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33825","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-33825"},{"cveID":"CVE-2024-27199","vendorProject":"JetBrains","product":"TeamCity","vulnerabilityName":"JetBrains TeamCity Relative Path Traversal Vulnerability","dateAdded":"2026-04-20","dueDate":"2026-05-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-23"],"shortDescription":"JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.jetbrains.com/privacy-security/issues-fixed/ ; https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-27199","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2024-27199"},{"cveID":"CVE-2023-27351","vendorProject":"PaperCut","product":"NG/MF","vulnerabilityName":"PaperCut NG/MF Improper Authentication Vulnerability","dateAdded":"2026-04-20","dueDate":"2026-05-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219 ; https://nvd.nist.gov/vuln/detail/CVE-2023-27351","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2023-27351"},{"cveID":"CVE-2025-60710","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Link Following Vulnerability","dateAdded":"2026-04-13","dueDate":"2026-04-27","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"Microsoft Windows contains a link following vulnerability that allows for privilege escalation","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2025-60710"},{"cveID":"CVE-2023-21529","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability","dateAdded":"2026-04-13","dueDate":"2026-04-27","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2023-21529"},{"cveID":"CVE-2026-20131","vendorProject":"Cisco","product":"Secure Firewall Management Center (FMC)","vulnerabilityName":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability","dateAdded":"2026-03-19","dueDate":"2026-03-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management interface that could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh ; https://nvd.nist.gov/vuln/detail/CVE-2026-20131","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-20131"},{"cveID":"CVE-2025-26399","vendorProject":"SolarWinds","product":"Web Help Desk","vulnerabilityName":"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability","dateAdded":"2026-03-09","dueDate":"2026-03-12","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399 ; https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm ; https://nvd.nist.gov/vuln/detail/CVE-2025-26399","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2025-26399"},{"cveID":"CVE-2026-1731","vendorProject":"BeyondTrust","product":"Remote Support (RS) and Privileged Remote Access (PRA)","vulnerabilityName":"BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability","dateAdded":"2026-02-13","dueDate":"2026-02-16","knownRansomwareCampaignUse":"Known","cwes":["CWE-78"],"shortDescription":"BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no authentication or user interaction and may lead to system compromise, including unauthorized access, data exfiltration, and service disruption.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please adhere to the vendor's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible BeyondTrust products affected by this vulnerability. For more information please: see: https://www.beyondtrust.com/trust-center/security-advisories/bt26-02 ; https://nvd.nist.gov/vuln/detail/CVE-2026-1731","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-1731"},{"cveID":"CVE-2026-24423","vendorProject":"SmarterTools","product":"SmarterMail","vulnerabilityName":"SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability","dateAdded":"2026-02-05","dueDate":"2026-02-26","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution. ","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.smartertools.com/smartermail/release-notes/current ; https://www.cve.org/CVERecord?id=CVE-2026-24423 ; https://nvd.nist.gov/vuln/detail/CVE-2026-24423","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-24423"},{"cveID":"CVE-2026-23760","vendorProject":"SmarterTools","product":"SmarterMail","vulnerabilityName":"SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability","dateAdded":"2026-01-26","dueDate":"2026-02-16","knownRansomwareCampaignUse":"Known","cwes":["CWE-288"],"shortDescription":"SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. This could allow an unauthenticated attacker to supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.smartertools.com/smartermail/release-notes/current ; https://nvd.nist.gov/vuln/detail/CVE-2026-23760","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-23760"},{"cveID":"CVE-2025-52691","vendorProject":"SmarterTools","product":"SmarterMail","vulnerabilityName":"SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability","dateAdded":"2026-01-26","dueDate":"2026-02-16","knownRansomwareCampaignUse":"Known","cwes":["CWE-434"],"shortDescription":"SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.smartertools.com/smartermail/release-notes/current ; https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-52691","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2025-52691"},{"cveID":"CVE-2025-14733","vendorProject":"WatchGuard","product":"Firebox","vulnerabilityName":"WatchGuard Firebox Out of Bounds Write Vulnerability","dateAdded":"2025-12-19","dueDate":"2025-12-26","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Check for signs of potential compromise on all internet accessible instances after applying mitigations. For more information please see: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00027 ; https://nvd.nist.gov/vuln/detail/CVE-2025-14733","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-14733"},{"cveID":"CVE-2025-55182","vendorProject":"Meta","product":"React Server Components","vulnerabilityName":"Meta React Server Components Remote Code Execution Vulnerability","dateAdded":"2025-12-05","dueDate":"2025-12-12","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with CVE-2025- 55182.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Check for signs of potential compromise on all internet accessible REACT instances after applying mitigations. For more information, please see: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components ; https://github.com/vercel-labs/fix-react2shell-next?tab=readme-ov-file ; https://nvd.nist.gov/vuln/detail/CVE-2025-55182","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-55182"},{"cveID":"CVE-2025-61884","vendorProject":"Oracle","product":"E-Business Suite","vulnerabilityName":"Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability","dateAdded":"2025-10-20","dueDate":"2025-11-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.oracle.com/security-alerts/alert-cve-2025-61884.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61884","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-61884"},{"cveID":"CVE-2025-61882","vendorProject":"Oracle","product":"E-Business Suite","vulnerabilityName":"Oracle E-Business Suite Unspecified Vulnerability","dateAdded":"2025-10-06","dueDate":"2025-10-27","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.oracle.com/security-alerts/alert-cve-2025-61882.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61882","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-61882"},{"cveID":"CVE-2021-43226","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2025-10-06","dueDate":"2025-10-27","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43226 ; https://nvd.nist.gov/vuln/detail/CVE-2021-43226","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2021-43226"},{"cveID":"CVE-2025-10035","vendorProject":"Fortra","product":"GoAnywhere MFT","vulnerabilityName":"Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability","dateAdded":"2025-09-29","dueDate":"2025-10-20","knownRansomwareCampaignUse":"Known","cwes":["CWE-502","CWE-77"],"shortDescription":"Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.fortra.com/security/advisories/product-security/fi-2025-012 ; https://nvd.nist.gov/vuln/detail/CVE-2025-10035","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-10035"},{"cveID":"CVE-2025-8088","vendorProject":"RARLAB","product":"WinRAR","vulnerabilityName":"RARLAB WinRAR Path Traversal Vulnerability","dateAdded":"2025-08-12","dueDate":"2025-09-02","knownRansomwareCampaignUse":"Known","cwes":["CWE-35"],"shortDescription":"RARLAB WinRAR contains a path traversal vulnerability affecting the Windows version of WinRAR. This vulnerability could allow an attacker to execute arbitrary code by crafting malicious archive files.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5 ; https://nvd.nist.gov/vuln/detail/CVE-2025-8088","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-8088"},{"cveID":"CVE-2025-49706","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Improper Authentication Vulnerability","dateAdded":"2025-07-22","dueDate":"2025-07-23","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.","requiredAction":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770 ; https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49706 ; https://nvd.nist.gov/vuln/detail/CVE-2025-49706","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-49706"},{"cveID":"CVE-2025-49704","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Code Injection Vulnerability","dateAdded":"2025-07-22","dueDate":"2025-07-23","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.","requiredAction":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770; https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704 ; https://nvd.nist.gov/vuln/detail/CVE-2025-49704","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-49704"},{"cveID":"CVE-2025-53770","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability","dateAdded":"2025-07-20","dueDate":"2025-07-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.","requiredAction":"Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770; https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ ; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53770 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53770","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-53770"},{"cveID":"CVE-2025-5777","vendorProject":"Citrix","product":"NetScaler ADC and Gateway","vulnerabilityName":"Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability","dateAdded":"2025-07-10","dueDate":"2025-07-11","knownRansomwareCampaignUse":"Known","cwes":["CWE-125"],"shortDescription":"Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 ; https://nvd.nist.gov/vuln/detail/CVE-2025-5777","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-5777"},{"cveID":"CVE-2019-6693","vendorProject":"Fortinet","product":"FortiOS","vulnerabilityName":"Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability","dateAdded":"2025-06-25","dueDate":"2025-07-16","knownRansomwareCampaignUse":"Known","cwes":["CWE-798"],"shortDescription":"Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. ","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://fortiguard.com/advisory/FG-IR-19-007 ; https://nvd.nist.gov/vuln/detail/CVE-2019-6693","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2019-6693"},{"cveID":"CVE-2025-42999","vendorProject":"SAP","product":"NetWeaver","vulnerabilityName":"SAP NetWeaver Deserialization Vulnerability","dateAdded":"2025-05-15","dueDate":"2025-06-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"SAP users must have an account to log in and access the patch: https://me.sap.com/notes/3604119 ; https://nvd.nist.gov/vuln/detail/CVE-2025-42999","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-42999"},{"cveID":"CVE-2025-3248","vendorProject":"Langflow","product":"Langflow","vulnerabilityName":"Langflow Missing Authentication Vulnerability","dateAdded":"2025-05-05","dueDate":"2025-05-26","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted HTTP requests.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source project, third-party library, or a protocol used by different products. For more information, please see: https://github.com/advisories/GHSA-c995-4fw3-j39m ; https://nvd.nist.gov/vuln/detail/CVE-2025-3248","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-3248"},{"cveID":"CVE-2025-31324","vendorProject":"SAP","product":"NetWeaver","vulnerabilityName":"SAP NetWeaver Unrestricted File Upload Vulnerability","dateAdded":"2025-04-29","dueDate":"2025-05-20","knownRansomwareCampaignUse":"Known","cwes":["CWE-434"],"shortDescription":"SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://me.sap.com/notes/3594142 ; https://nvd.nist.gov/vuln/detail/CVE-2025-31324","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-31324"},{"cveID":"CVE-2025-29824","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability","dateAdded":"2025-04-08","dueDate":"2025-04-29","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29824 ; https://nvd.nist.gov/vuln/detail/CVE-2025-29824","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-29824"},{"cveID":"CVE-2025-31161","vendorProject":"CrushFTP","product":"CrushFTP","vulnerabilityName":"CrushFTP Authentication Bypass Vulnerability","dateAdded":"2025-04-07","dueDate":"2025-04-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-305"],"shortDescription":"CrushFTP contains an authentication bypass vulnerability in the HTTP authorization header that allows a remote unauthenticated attacker to authenticate to any known or guessable user account (e.g., crushadmin), potentially leading to a full compromise. ","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update ; https://nvd.nist.gov/vuln/detail/CVE-2025-31161","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-31161"},{"cveID":"CVE-2025-22457","vendorProject":"Ivanti","product":"Connect Secure, Policy Secure, and ZTA Gateways","vulnerabilityName":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","dateAdded":"2025-04-04","dueDate":"2025-04-11","knownRansomwareCampaignUse":"Known","cwes":["CWE-121"],"shortDescription":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution. ","requiredAction":"Apply mitigations as set forth in the CISA instructions linked below.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-22457 ; Additional References: https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457 ; https://nvd.nist.gov/vuln/detail/CVE-2025-22457","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-22457"},{"cveID":"CVE-2025-24472","vendorProject":"Fortinet","product":"FortiOS and FortiProxy","vulnerabilityName":"Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability","dateAdded":"2025-03-18","dueDate":"2025-04-08","knownRansomwareCampaignUse":"Known","cwes":["CWE-288"],"shortDescription":" Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24472","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-24472"},{"cveID":"CVE-2025-26633","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability","dateAdded":"2025-03-11","dueDate":"2025-04-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-707"],"shortDescription":"Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-26633 ; https://nvd.nist.gov/vuln/detail/CVE-2025-26633","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-26633"},{"cveID":"CVE-2025-22225","vendorProject":"VMware","product":"ESXi","vulnerabilityName":"VMware ESXi Arbitrary Write Vulnerability","dateAdded":"2025-03-04","dueDate":"2025-03-25","knownRansomwareCampaignUse":"Known","cwes":["CWE-123"],"shortDescription":"VMware ESXi contains an arbitrary write vulnerability. Successful exploitation allows an attacker with privileges within the VMX process to trigger an arbitrary kernel write leading to an escape of the sandbox.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390 ; https://nvd.nist.gov/vuln/detail/CVE-2025-22225","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-22225"},{"cveID":"CVE-2018-8639","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability","dateAdded":"2025-03-03","dueDate":"2025-03-24","knownRansomwareCampaignUse":"Known","cwes":["CWE-404"],"shortDescription":"Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-8639 ; https://nvd.nist.gov/vuln/detail/CVE-2018-8639","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2018-8639"},{"cveID":"CVE-2024-53704","vendorProject":"SonicWall","product":"SonicOS","vulnerabilityName":"SonicWall SonicOS SSLVPN Improper Authentication Vulnerability","dateAdded":"2025-02-18","dueDate":"2025-03-11","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"SonicWall SonicOS contains an improper authentication vulnerability in the SSLVPN authentication mechanism that allows a remote attacker to bypass authentication.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003 ; https://nvd.nist.gov/vuln/detail/CVE-2024-53704","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-53704"},{"cveID":"CVE-2024-57727","vendorProject":"SimpleHelp ","product":"SimpleHelp","vulnerabilityName":"SimpleHelp Path Traversal Vulnerability","dateAdded":"2025-02-13","dueDate":"2025-03-06","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://simple-help.com/kb---security-vulnerabilities-01-2025 ; Additional CISA Mitigation Instructions: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a ; https://nvd.nist.gov/vuln/detail/CVE-2024-57727","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-57727"},{"cveID":"CVE-2020-29574","vendorProject":"Sophos","product":"CyberoamOS","vulnerabilityName":"CyberoamOS (CROS) SQL Injection Vulnerability","dateAdded":"2025-02-06","dueDate":"2025-02-27","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"CyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely.","requiredAction":"The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.","notes":"https://support.sophos.com/support/s/article/KBA-000007526 ; https://nvd.nist.gov/vuln/detail/CVE-2020-29574","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2020-29574"},{"cveID":"CVE-2025-23006","vendorProject":"SonicWall","product":"SMA1000 Appliances","vulnerabilityName":"SonicWall SMA1000 Appliances Deserialization Vulnerability","dateAdded":"2025-01-24","dueDate":"2025-02-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0002 ; https://nvd.nist.gov/vuln/detail/CVE-2025-23006","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-23006"},{"cveID":"CVE-2024-55591","vendorProject":"Fortinet","product":"FortiOS and FortiProxy","vulnerabilityName":"Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability","dateAdded":"2025-01-14","dueDate":"2025-01-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-288"],"shortDescription":"Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://nvd.nist.gov/vuln/detail/CVE-2024-55591","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-55591"},{"cveID":"CVE-2023-48365","vendorProject":"Qlik","product":"Sense","vulnerabilityName":"Qlik Sense HTTP Tunneling Vulnerability","dateAdded":"2025-01-13","dueDate":"2025-02-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-444"],"shortDescription":"Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510 ; https://nvd.nist.gov/vuln/detail/CVE-2023-48365","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2023-48365"},{"cveID":"CVE-2025-0282","vendorProject":"Ivanti","product":"Connect Secure, Policy Secure, and ZTA Gateways","vulnerabilityName":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","dateAdded":"2025-01-08","dueDate":"2025-01-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-121"],"shortDescription":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.","requiredAction":"Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/cisa-mitigation-instructions-CVE-2025-0282 Additional References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0282","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-0282"},{"cveID":"CVE-2024-55550","vendorProject":"Mitel","product":"MiCollab","vulnerabilityName":"Mitel MiCollab Path Traversal Vulnerability","dateAdded":"2025-01-07","dueDate":"2025-01-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029 ; https://nvd.nist.gov/vuln/detail/CVE-2024-55550","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-55550"},{"cveID":"CVE-2024-41713","vendorProject":"Mitel","product":"MiCollab","vulnerabilityName":"Mitel MiCollab Path Traversal Vulnerability","dateAdded":"2025-01-07","dueDate":"2025-01-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029 ; https://nvd.nist.gov/vuln/detail/CVE-2024-41713 ","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-41713"},{"cveID":"CVE-2024-55956","vendorProject":"Cleo","product":"Multiple Products","vulnerabilityName":"Cleo Multiple Products Unauthenticated File Upload Vulnerability","dateAdded":"2024-12-17","dueDate":"2025-01-07","knownRansomwareCampaignUse":"Known","cwes":["CWE-276"],"shortDescription":"Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update-CVE-2024-55956 ; https://nvd.nist.gov/vuln/detail/CVE-2024-55956","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-55956"},{"cveID":"CVE-2024-50623","vendorProject":"Cleo","product":"Multiple Products","vulnerabilityName":"Cleo Multiple Products Unrestricted File Upload Vulnerability","dateAdded":"2024-12-13","dueDate":"2025-01-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-434"],"shortDescription":"Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.cleo.com/hc/en-us/articles/28408134019735-Cleo-Product-Security-Update ; https://nvd.nist.gov/vuln/detail/CVE-2024-50623","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-50623"},{"cveID":"CVE-2024-51378","vendorProject":"CyberPersons","product":"CyberPanel","vulnerabilityName":"CyberPanel Incorrect Default Permissions Vulnerability","dateAdded":"2024-12-04","dueDate":"2024-12-25","knownRansomwareCampaignUse":"Known","cwes":["CWE-276"],"shortDescription":"CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://cyberpanel.net/KnowledgeBase/home/change-logs/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-51378","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-51378"},{"cveID":"CVE-2024-11667","vendorProject":"Zyxel","product":"Multiple Firewalls","vulnerabilityName":"Zyxel Multiple Firewalls Path Traversal Vulnerability","dateAdded":"2024-12-03","dueDate":"2024-12-24","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-11667","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-11667"},{"cveID":"CVE-2023-28461","vendorProject":"Array Networks ","product":"AG/vxAG ArrayOS","vulnerabilityName":"Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability","dateAdded":"2024-11-25","dueDate":"2024-12-16","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2023-28461","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-28461"},{"cveID":"CVE-2024-9474","vendorProject":"Palo Alto Networks","product":"PAN-OS","vulnerabilityName":"Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability","dateAdded":"2024-11-18","dueDate":"2024-12-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-77"],"shortDescription":"Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.","notes":"https://security.paloaltonetworks.com/CVE-2024-9474 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9474","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-9474"},{"cveID":"CVE-2024-0012","vendorProject":"Palo Alto Networks","product":"PAN-OS","vulnerabilityName":"Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability","dateAdded":"2024-11-18","dueDate":"2024-12-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.","notes":"https://security.paloaltonetworks.com/CVE-2024-0012 ; https://nvd.nist.gov/vuln/detail/CVE-2024-0012","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-0012"},{"cveID":"CVE-2024-49039","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Task Scheduler Privilege Escalation Vulnerability","dateAdded":"2024-11-12","dueDate":"2024-12-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039 ; https://nvd.nist.gov/vuln/detail/CVE-2024-49039","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-49039"},{"cveID":"CVE-2024-51567","vendorProject":"CyberPersons","product":"CyberPanel","vulnerabilityName":"CyberPanel Incorrect Default Permissions Vulnerability","dateAdded":"2024-11-07","dueDate":"2024-11-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-276"],"shortDescription":"CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://cyberpanel.net/blog/detials-and-fix-of-recent-security-issue-and-patch-of-cyberpanel ; https://nvd.nist.gov/vuln/detail/CVE-2024-51567","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-51567"},{"cveID":"CVE-2024-38094","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Deserialization Vulnerability","dateAdded":"2024-10-22","dueDate":"2024-11-12","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38094 ; https://nvd.nist.gov/vuln/detail/CVE-2024-38094","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38094"},{"cveID":"CVE-2024-40711","vendorProject":"Veeam","product":"Backup & Replication","vulnerabilityName":"Veeam Backup and Replication Deserialization Vulnerability","dateAdded":"2024-10-17","dueDate":"2024-11-07","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.veeam.com/kb4649 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40711","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-40711"},{"cveID":"CVE-2024-9680","vendorProject":"Mozilla","product":"Firefox","vulnerabilityName":"Mozilla Firefox Use-After-Free Vulnerability","dateAdded":"2024-10-15","dueDate":"2024-11-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-9680","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-9680"},{"cveID":"CVE-2024-30088","vendorProject":"Microsoft","product":"Windows ","vulnerabilityName":"Microsoft Windows Kernel TOCTOU Race Condition Vulnerability","dateAdded":"2024-10-15","dueDate":"2024-11-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-367"],"shortDescription":"Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation. ","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-30088 ; https://nvd.nist.gov/vuln/detail/CVE-2024-30088","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-30088"},{"cveID":"CVE-2020-0618","vendorProject":"Microsoft","product":"SQL Server","vulnerabilityName":"Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability","dateAdded":"2024-09-18","dueDate":"2024-10-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-0618  ;  https://nvd.nist.gov/vuln/detail/CVE-2020-0618","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2020-0618"},{"cveID":"CVE-2024-6670","vendorProject":"Progress","product":"WhatsUp Gold","vulnerabilityName":"Progress WhatsUp Gold SQL Injection Vulnerability","dateAdded":"2024-09-16","dueDate":"2024-10-07","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-6670","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-6670"},{"cveID":"CVE-2024-40766","vendorProject":"SonicWall","product":"SonicOS","vulnerabilityName":"SonicWall SonicOS Improper Access Control Vulnerability","dateAdded":"2024-09-09","dueDate":"2024-09-30","knownRansomwareCampaignUse":"Known","cwes":["CWE-284"],"shortDescription":"SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015; https://www.sonicwall.com/support/notices/gen-7-and-newer-sonicwall-firewalls-sslvpn-recent-threat-activity/kA1VN0000000RDG0A2 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40766","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-40766"},{"cveID":"CVE-2017-1000253","vendorProject":"Linux","product":"Kernel","vulnerabilityName":"Linux Kernel PIE Stack Buffer Corruption Vulnerability ","dateAdded":"2024-09-09","dueDate":"2024-09-30","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges. ","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a87938b2e246b81b4fb713edb371a9fa3c5c3c86; https://nvd.nist.gov/vuln/detail/CVE-2017-1000253","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2017-1000253"},{"cveID":"CVE-2024-23897","vendorProject":"Jenkins","product":"Jenkins Command Line Interface (CLI)","vulnerabilityName":"Jenkins Command Line Interface (CLI) Path Traversal Vulnerability","dateAdded":"2024-08-19","dueDate":"2024-09-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-27"],"shortDescription":"Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3314; https://nvd.nist.gov/vuln/detail/CVE-2024-23897","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-23897"},{"cveID":"CVE-2024-37085","vendorProject":"VMware","product":"ESXi","vulnerabilityName":"VMware ESXi Authentication Bypass Vulnerability","dateAdded":"2024-07-30","dueDate":"2024-08-20","knownRansomwareCampaignUse":"Known","cwes":["CWE-305"],"shortDescription":"VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24505;   https://nvd.nist.gov/vuln/detail/CVE-2024-37085","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-37085"},{"cveID":"CVE-2024-23692","vendorProject":"Rejetto","product":"HTTP File Server","vulnerabilityName":"Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","dateAdded":"2024-07-09","dueDate":"2024-07-30","knownRansomwareCampaignUse":"Known","cwes":["CWE-1336"],"shortDescription":"Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"The patched Rejetto HTTP File Server (HFS) is version 3: https://github.com/rejetto/hfs?tab=readme-ov-file#installation, https://www.rejetto.com/hfs/ ;   https://nvd.nist.gov/vuln/detail/CVE-2024-23692","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-23692"},{"cveID":"CVE-2024-26169","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability","dateAdded":"2024-06-13","dueDate":"2024-07-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-269"],"shortDescription":"Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26169; https://nvd.nist.gov/vuln/detail/CVE-2024-26169","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-26169"},{"cveID":"CVE-2024-4577","vendorProject":"PHP Group","product":"PHP","vulnerabilityName":"PHP-CGI OS Command Injection Vulnerability","dateAdded":"2024-06-12","dueDate":"2024-07-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-78"],"shortDescription":"PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see:  https://www.php.net/ChangeLog-8.php#;   https://nvd.nist.gov/vuln/detail/CVE-2024-4577","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-4577"},{"cveID":"CVE-2024-24919","vendorProject":"Check Point","product":"Quantum Security Gateways","vulnerabilityName":"Check Point Quantum Security Gateways Information Disclosure Vulnerability","dateAdded":"2024-05-30","dueDate":"2024-06-20","knownRansomwareCampaignUse":"Known","cwes":["CWE-200"],"shortDescription":"Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.checkpoint.com/results/sk/sk182336 ; https://nvd.nist.gov/vuln/detail/CVE-2024-24919","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-24919"},{"cveID":"CVE-2024-1086","vendorProject":"Linux","product":"Kernel","vulnerabilityName":"Linux Kernel Use-After-Free Vulnerability","dateAdded":"2024-05-30","dueDate":"2024-06-20","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f342de4e2f33e0e39165d8639387aa6c19dff660;   https://nvd.nist.gov/vuln/detail/CVE-2024-1086","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-1086"},{"cveID":"CVE-2023-43208","vendorProject":"NextGen Healthcare","product":"Mirth Connect","vulnerabilityName":"NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability","dateAdded":"2024-05-20","dueDate":"2024-06-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status.   For more information, please see: https://github.com/nextgenhealthcare/connect/wiki/4.4.1---What%27s-New ;  https://nvd.nist.gov/vuln/detail/CVE-2023-43208","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-43208"},{"cveID":"CVE-2024-30051","vendorProject":"Microsoft","product":"DWM Core Library","vulnerabilityName":" Microsoft DWM Core Library Privilege Escalation Vulnerability","dateAdded":"2024-05-14","dueDate":"2024-06-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-122"],"shortDescription":"Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-30051; https://nvd.nist.gov/vuln/detail/CVE-2024-30051","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-30051"},{"cveID":"CVE-2024-3400","vendorProject":"Palo Alto Networks","product":"PAN-OS","vulnerabilityName":"Palo Alto Networks PAN-OS Command Injection Vulnerability","dateAdded":"2024-04-12","dueDate":"2024-04-19","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-77"],"shortDescription":"Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.","requiredAction":"Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.","notes":"https://security.paloaltonetworks.com/CVE-2024-3400 ;   https://nvd.nist.gov/vuln/detail/CVE-2024-3400","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-3400"},{"cveID":"CVE-2023-24955","vendorProject":"Microsoft","product":"SharePoint Server","vulnerabilityName":"Microsoft SharePoint Server Code Injection Vulnerability","dateAdded":"2024-03-26","dueDate":"2024-04-16","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24955;  https://nvd.nist.gov/vuln/detail/CVE-2023-24955","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-24955"},{"cveID":"CVE-2023-48788","vendorProject":"Fortinet","product":"FortiClient EMS","vulnerabilityName":"Fortinet FortiClient EMS SQL Injection Vulnerability","dateAdded":"2024-03-25","dueDate":"2024-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.fortiguard.com/psirt/FG-IR-24-007;  https://nvd.nist.gov/vuln/detail/CVE-2023-48788","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-48788"},{"cveID":"CVE-2021-44529","vendorProject":"Ivanti","product":"Endpoint Manager Cloud Service Appliance (EPM CSA)","vulnerabilityName":"Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability ","dateAdded":"2024-03-25","dueDate":"2024-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2021-44529","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2021-44529"},{"cveID":"CVE-2024-27198","vendorProject":"JetBrains","product":"TeamCity","vulnerabilityName":"JetBrains TeamCity Authentication Bypass Vulnerability","dateAdded":"2024-03-07","dueDate":"2024-03-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-288"],"shortDescription":"JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.jetbrains.com/help/teamcity/teamcity-2023-11-4-release-notes.html; https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-27198","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-27198"},{"cveID":"CVE-2024-21338","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability","dateAdded":"2024-03-04","dueDate":"2024-03-25","knownRansomwareCampaignUse":"Known","cwes":["CWE-822"],"shortDescription":"Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338; https://nvd.nist.gov/vuln/detail/CVE-2024-21338","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-21338"},{"cveID":"CVE-2024-1709","vendorProject":"ConnectWise","product":"ScreenConnect","vulnerabilityName":"ConnectWise ScreenConnect Authentication Bypass Vulnerability","dateAdded":"2024-02-22","dueDate":"2024-02-29","knownRansomwareCampaignUse":"Known","cwes":["CWE-288"],"shortDescription":"ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8; https://nvd.nist.gov/vuln/detail/CVE-2024-1709","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-1709"},{"cveID":"CVE-2020-3259","vendorProject":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","vulnerabilityName":"Cisco ASA and FTD Information Disclosure Vulnerability","dateAdded":"2024-02-15","dueDate":"2024-03-07","knownRansomwareCampaignUse":"Known","cwes":["CWE-200"],"shortDescription":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-info-disclose-9eJtycMB; https://nvd.nist.gov/vuln/detail/CVE-2020-3259","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2020-3259"},{"cveID":"CVE-2024-21412","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability","dateAdded":"2024-02-13","dueDate":"2024-03-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-693"],"shortDescription":"Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21412; https://nvd.nist.gov/vuln/detail/CVE-2024-21412","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-21412"},{"cveID":"CVE-2024-21762","vendorProject":"Fortinet","product":"FortiOS","vulnerabilityName":"Fortinet FortiOS Out-of-Bound Write Vulnerability","dateAdded":"2024-02-09","dueDate":"2024-02-16","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015 ;   https://nvd.nist.gov/vuln/detail/CVE-2024-21762","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-21762"},{"cveID":"CVE-2024-21893","vendorProject":"Ivanti","product":"Connect Secure, Policy Secure, and Neurons","vulnerabilityName":"Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability","dateAdded":"2024-01-31","dueDate":"2024-02-02","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-21893","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-21893"},{"cveID":"CVE-2023-22527","vendorProject":"Atlassian","product":"Confluence Data Center and Server","vulnerabilityName":"Atlassian Confluence Data Center and Server Template Injection Vulnerability","dateAdded":"2024-01-24","dueDate":"2024-02-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-74"],"shortDescription":"Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-22527","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-22527"},{"cveID":"CVE-2023-35082","vendorProject":"Ivanti","product":"Endpoint Manager Mobile (EPMM) and MobileIron Core","vulnerabilityName":"Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability","dateAdded":"2024-01-18","dueDate":"2024-02-08","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older;  https://nvd.nist.gov/vuln/detail/CVE-2023-35082","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-35082"},{"cveID":"CVE-2024-21887","vendorProject":"Ivanti","product":"Connect Secure and Policy Secure","vulnerabilityName":"Ivanti Connect Secure and Policy Secure Command Injection Vulnerability","dateAdded":"2024-01-10","dueDate":"2024-01-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-77"],"shortDescription":"Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"Please apply mitigations per vendor instructions. For more information, please see: https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-21887","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-21887"},{"cveID":"CVE-2023-46805","vendorProject":"Ivanti","product":"Connect Secure and Policy Secure","vulnerabilityName":"Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability","dateAdded":"2024-01-10","dueDate":"2024-01-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"Please apply mitigations per vendor instructions. For more information, please see: https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ;  https://nvd.nist.gov/vuln/detail/CVE-2023-46805","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-46805"},{"cveID":"CVE-2023-29357","vendorProject":"Microsoft","product":"SharePoint Server","vulnerabilityName":"Microsoft SharePoint Server Privilege Escalation Vulnerability","dateAdded":"2024-01-10","dueDate":"2024-01-31","knownRansomwareCampaignUse":"Known","cwes":["CWE-303"],"shortDescription":"Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29357; https://nvd.nist.gov/vuln/detail/CVE-2023-29357","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-29357"},{"cveID":"CVE-2023-38203","vendorProject":"Adobe","product":"ColdFusion","vulnerabilityName":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","dateAdded":"2024-01-08","dueDate":"2024-01-29","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://helpx.adobe.com/security/products/coldfusion/apsb23-41.html ;  https://nvd.nist.gov/vuln/detail/CVE-2023-38203","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-38203"},{"cveID":"CVE-2023-29300","vendorProject":"Adobe","product":"ColdFusion","vulnerabilityName":"Adobe ColdFusion Deserialization of Untrusted Data Vulnerability","dateAdded":"2024-01-08","dueDate":"2024-01-29","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html; https://nvd.nist.gov/vuln/detail/CVE-2023-29300","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-29300"},{"cveID":"CVE-2023-41266","vendorProject":"Qlik","product":"Sense","vulnerabilityName":"Qlik Sense Path Traversal Vulnerability","dateAdded":"2023-12-07","dueDate":"2023-12-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","notes":"https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801  ;  https://nvd.nist.gov/vuln/detail/CVE-2023-41266","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-41266"},{"cveID":"CVE-2023-41265","vendorProject":"Qlik","product":"Sense","vulnerabilityName":"Qlik Sense HTTP Tunneling Vulnerability","dateAdded":"2023-12-07","dueDate":"2023-12-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-444"],"shortDescription":"Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","notes":"https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801;  https://nvd.nist.gov/vuln/detail/CVE-2023-41265","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-41265"},{"cveID":"CVE-2023-47246","vendorProject":"SysAid","product":"SysAid Server","vulnerabilityName":"SysAid Server Path Traversal Vulnerability","dateAdded":"2023-11-13","dueDate":"2023-12-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification; https://nvd.nist.gov/vuln/detail/CVE-2023-47246","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-47246"},{"cveID":"CVE-2023-22518","vendorProject":"Atlassian","product":"Confluence Data Center and Server","vulnerabilityName":"Atlassian Confluence Data Center and Server Improper Authorization Vulnerability","dateAdded":"2023-11-07","dueDate":"2023-11-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-863"],"shortDescription":"Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-22518","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-22518"},{"cveID":"CVE-2023-46604","vendorProject":"Apache","product":"ActiveMQ","vulnerabilityName":"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability","dateAdded":"2023-11-02","dueDate":"2023-11-23","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://nvd.nist.gov/vuln/detail/CVE-2023-46604","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-46604"},{"cveID":"CVE-2023-46747","vendorProject":"F5","product":"BIG-IP Configuration Utility","vulnerabilityName":"F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability","dateAdded":"2023-10-31","dueDate":"2023-11-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-288"],"shortDescription":"F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://my.f5.com/manage/s/article/K000137353;   https://nvd.nist.gov/vuln/detail/CVE-2023-46747","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-46747"},{"cveID":"CVE-2023-4966","vendorProject":"Citrix","product":"NetScaler ADC and NetScaler Gateway","vulnerabilityName":"Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability","dateAdded":"2023-10-18","dueDate":"2023-11-08","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.","requiredAction":"Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.","notes":"https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/, https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967 ;  https://nvd.nist.gov/vuln/detail/CVE-2023-4966","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-4966"},{"cveID":"CVE-2023-40044","vendorProject":"Progress","product":"WS_FTP Server","vulnerabilityName":"Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability","dateAdded":"2023-10-05","dueDate":"2023-10-26","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023; https://nvd.nist.gov/vuln/detail/CVE-2023-40044","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-40044"},{"cveID":"CVE-2023-22515","vendorProject":"Atlassian","product":"Confluence Data Center and Server","vulnerabilityName":"Atlassian Confluence Data Center and Server Broken Access Control Vulnerability","dateAdded":"2023-10-05","dueDate":"2023-10-13","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.","notes":"https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-22515","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-22515"},{"cveID":"CVE-2023-42793","vendorProject":"JetBrains","product":"TeamCity","vulnerabilityName":"JetBrains TeamCity Authentication Bypass Vulnerability","dateAdded":"2023-10-04","dueDate":"2023-10-25","knownRansomwareCampaignUse":"Known","cwes":["CWE-288"],"shortDescription":"JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/ ;  https://nvd.nist.gov/vuln/detail/CVE-2023-42793","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-42793"},{"cveID":"CVE-2021-3129","vendorProject":"Laravel","product":"Ignition","vulnerabilityName":"Laravel Ignition File Upload Vulnerability","dateAdded":"2023-09-18","dueDate":"2023-10-09","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://github.com/facade/ignition/releases/tag/2.5.2; https://nvd.nist.gov/vuln/detail/CVE-2021-3129","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2021-3129"},{"cveID":"CVE-2017-6884","vendorProject":"Zyxel","product":"EMG2926 Routers","vulnerabilityName":"Zyxel EMG2926 Routers Command Injection Vulnerability","dateAdded":"2023-09-18","dueDate":"2023-10-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-78"],"shortDescription":"Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-emg2926-q10a-ethernet-cpe, https://www.zyxelguard.com/Zyxel-EOL.asp; https://nvd.nist.gov/vuln/detail/CVE-2017-6884","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2017-6884"},{"cveID":"CVE-2023-20269","vendorProject":"Cisco","product":"Adaptive Security Appliance and Firepower Threat Defense","vulnerabilityName":"Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability","dateAdded":"2023-09-13","dueDate":"2023-10-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-288"],"shortDescription":"Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.","requiredAction":"Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.","notes":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC;  https://nvd.nist.gov/vuln/detail/CVE-2023-20269","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-20269"},{"cveID":"CVE-2023-38831","vendorProject":"RARLAB","product":"WinRAR","vulnerabilityName":"RARLAB WinRAR Code Execution Vulnerability","dateAdded":"2023-08-24","dueDate":"2023-09-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-351"],"shortDescription":"RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"http://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa;  https://nvd.nist.gov/vuln/detail/CVE-2023-38831","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-38831"},{"cveID":"CVE-2023-38035","vendorProject":"Ivanti","product":"Sentry","vulnerabilityName":"Ivanti Sentry Authentication Bypass Vulnerability","dateAdded":"2023-08-22","dueDate":"2023-09-12","knownRansomwareCampaignUse":"Known","cwes":["CWE-863"],"shortDescription":"Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US ;  https://nvd.nist.gov/vuln/detail/CVE-2023-38035","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-38035"},{"cveID":"CVE-2023-27532","vendorProject":"Veeam","product":"Backup & Replication","vulnerabilityName":"Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability","dateAdded":"2023-08-22","dueDate":"2023-09-12","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.veeam.com/kb4424;  https://nvd.nist.gov/vuln/detail/CVE-2023-27532","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-27532"},{"cveID":"CVE-2023-35078","vendorProject":"Ivanti","product":"Endpoint Manager Mobile (EPMM)","vulnerabilityName":"Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability","dateAdded":"2023-07-25","dueDate":"2023-08-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US;  https://nvd.nist.gov/vuln/detail/CVE-2023-35078","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-35078"},{"cveID":"CVE-2023-3519","vendorProject":"Citrix","product":"NetScaler ADC and NetScaler Gateway","vulnerabilityName":"Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability","dateAdded":"2023-07-19","dueDate":"2023-08-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467;  https://nvd.nist.gov/vuln/detail/CVE-2023-3519","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-3519"},{"cveID":"CVE-2023-36884","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Search Remote Code Execution Vulnerability","dateAdded":"2023-07-17","dueDate":"2023-08-29","knownRansomwareCampaignUse":"Known","cwes":["CWE-362"],"shortDescription":"Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884;  https://nvd.nist.gov/vuln/detail/CVE-2023-36884","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-36884"},{"cveID":"CVE-2022-31199","vendorProject":"Netwrix","product":"Auditor","vulnerabilityName":"Netwrix Auditor Insecure Object Deserialization Vulnerability","dateAdded":"2023-07-11","dueDate":"2023-08-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-502","CWE-122"],"shortDescription":"Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.","requiredAction":"Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.","notes":"Patch application requires login to customer portal: https://security.netwrix.com/Account/SignIn?ReturnUrl=%2FAdvisories%2FADV-2022-003;  https://nvd.nist.gov/vuln/detail/CVE-2022-31199","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-31199"},{"cveID":"CVE-2023-27997","vendorProject":"Fortinet","product":"FortiOS and FortiProxy SSL-VPN","vulnerabilityName":"Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability","dateAdded":"2023-06-13","dueDate":"2023-07-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-122"],"shortDescription":"Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.fortiguard.com/psirt/FG-IR-23-097;  https://nvd.nist.gov/vuln/detail/CVE-2023-27997","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-27997"},{"cveID":"CVE-2023-34362","vendorProject":"Progress","product":"MOVEit Transfer","vulnerabilityName":"Progress MOVEit Transfer SQL Injection Vulnerability","dateAdded":"2023-06-02","dueDate":"2023-06-23","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.","requiredAction":"Apply updates per vendor instructions.","notes":"This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023.;  https://nvd.nist.gov/vuln/detail/CVE-2023-34362","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-34362"},{"cveID":"CVE-2021-45046","vendorProject":"Apache","product":"Log4j2","vulnerabilityName":"Apache Log4j2 Deserialization of Untrusted Data Vulnerability","dateAdded":"2023-05-01","dueDate":"2023-05-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-917"],"shortDescription":"Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.","requiredAction":"Apply updates per vendor instructions.","notes":"https://logging.apache.org/log4j/2.x/security.html; https://nvd.nist.gov/vuln/detail/CVE-2021-45046","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2021-45046"},{"cveID":"CVE-2023-27350","vendorProject":"PaperCut","product":"MF/NG","vulnerabilityName":"PaperCut MF/NG Improper Access Control Vulnerability","dateAdded":"2023-04-21","dueDate":"2023-05-12","knownRansomwareCampaignUse":"Known","cwes":["CWE-284"],"shortDescription":"PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.papercut.com/kb/Main/PO-1216-and-PO-1219;  https://nvd.nist.gov/vuln/detail/CVE-2023-27350","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-27350"},{"cveID":"CVE-2023-28252","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","dateAdded":"2023-04-11","dueDate":"2023-05-02","knownRansomwareCampaignUse":"Known","cwes":["CWE-122"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28252;  https://nvd.nist.gov/vuln/detail/CVE-2023-28252","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-28252"},{"cveID":"CVE-2021-27878","vendorProject":"Veritas","product":"Backup Exec Agent","vulnerabilityName":"Veritas Backup Exec Agent Command Execution Vulnerability","dateAdded":"2023-04-07","dueDate":"2023-04-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.veritas.com/support/en_US/security/VTS21-001; https://nvd.nist.gov/vuln/detail/CVE-2021-27878","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2021-27878"},{"cveID":"CVE-2021-27877","vendorProject":"Veritas","product":"Backup Exec Agent","vulnerabilityName":"Veritas Backup Exec Agent Improper Authentication Vulnerability","dateAdded":"2023-04-07","dueDate":"2023-04-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.veritas.com/support/en_US/security/VTS21-001; https://nvd.nist.gov/vuln/detail/CVE-2021-27877","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2021-27877"},{"cveID":"CVE-2021-27876","vendorProject":"Veritas","product":"Backup Exec Agent","vulnerabilityName":"Veritas Backup Exec Agent File Access Vulnerability","dateAdded":"2023-04-07","dueDate":"2023-04-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.veritas.com/support/en_US/security/VTS21-001; https://nvd.nist.gov/vuln/detail/CVE-2021-27876","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2021-27876"},{"cveID":"CVE-2019-1388","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability","dateAdded":"2023-04-07","dueDate":"2023-04-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-269"],"shortDescription":"Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.","requiredAction":"Apply updates per vendor instructions.","notes":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388; https://nvd.nist.gov/vuln/detail/CVE-2019-1388","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2019-1388"},{"cveID":"CVE-2017-7494","vendorProject":"Samba","product":"Samba","vulnerabilityName":"Samba Remote Code Execution Vulnerability","dateAdded":"2023-03-30","dueDate":"2023-04-20","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.samba.org/samba/security/CVE-2017-7494.html; https://nvd.nist.gov/vuln/detail/CVE-2017-7494","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2017-7494"},{"cveID":"CVE-2023-24880","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows SmartScreen Security Feature Bypass Vulnerability","dateAdded":"2023-03-14","dueDate":"2023-04-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-863"],"shortDescription":"Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-24880;  https://nvd.nist.gov/vuln/detail/CVE-2023-24880","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-24880"},{"cveID":"CVE-2022-36537","vendorProject":"ZK Framework","product":"AuUploader","vulnerabilityName":"ZK Framework AuUploader Unspecified Vulnerability","dateAdded":"2023-02-27","dueDate":"2023-03-20","knownRansomwareCampaignUse":"Known","cwes":["CWE-441"],"shortDescription":"ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.","requiredAction":"Apply updates per vendor instructions.","notes":"https://tracker.zkoss.org/browse/ZK-5150;  https://nvd.nist.gov/vuln/detail/CVE-2022-36537","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-36537"},{"cveID":"CVE-2022-47986","vendorProject":"IBM","product":"Aspera Faspex","vulnerabilityName":"IBM Aspera Faspex Code Execution Vulnerability","dateAdded":"2023-02-21","dueDate":"2023-03-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.","requiredAction":"Apply updates per vendor instructions.","notes":"https://exchange.xforce.ibmcloud.com/vulnerabilities/243512?_ga=2.189195179.1800390251.1676559338-700333034.1676325890;  https://nvd.nist.gov/vuln/detail/CVE-2022-47986","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-47986"},{"cveID":"CVE-2022-41223","vendorProject":"Mitel","product":"MiVoice Connect","vulnerabilityName":"Mitel MiVoice Connect Code Injection Vulnerability","dateAdded":"2023-02-21","dueDate":"2023-03-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008;  https://nvd.nist.gov/vuln/detail/CVE-2022-41223","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-41223"},{"cveID":"CVE-2022-40765","vendorProject":"Mitel","product":"MiVoice Connect","vulnerabilityName":"Mitel MiVoice Connect Command Injection Vulnerability","dateAdded":"2023-02-21","dueDate":"2023-03-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-77"],"shortDescription":"The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0007;  https://nvd.nist.gov/vuln/detail/CVE-2022-40765","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-40765"},{"cveID":"CVE-2023-23376","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","dateAdded":"2023-02-14","dueDate":"2023-03-07","knownRansomwareCampaignUse":"Known","cwes":["CWE-122"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23376;  https://nvd.nist.gov/vuln/detail/CVE-2023-23376","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-23376"},{"cveID":"CVE-2023-0669","vendorProject":"Fortra","product":"GoAnywhere MFT","vulnerabilityName":"Fortra GoAnywhere MFT Remote Code Execution Vulnerability","dateAdded":"2023-02-10","dueDate":"2023-03-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.","requiredAction":"Apply updates per vendor instructions.","notes":"This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://my.goanywhere.com/webclient/DownloadProductFiles.xhtml. Fortra users must have an account in order to login and access the patch.;  https://nvd.nist.gov/vuln/detail/CVE-2023-0669","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-0669"},{"cveID":"CVE-2022-24990","vendorProject":"TerraMaster","product":"TerraMaster OS","vulnerabilityName":"TerraMaster OS Remote Command Execution Vulnerability","dateAdded":"2023-02-10","dueDate":"2023-03-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.","requiredAction":"Apply updates per vendor instructions.","notes":"https://forum.terra-master.com/en/viewtopic.php?t=3030;  https://nvd.nist.gov/vuln/detail/CVE-2022-24990","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-24990"},{"cveID":"CVE-2015-2291","vendorProject":"Intel","product":"Ethernet Diagnostics Driver for Windows","vulnerabilityName":"Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability","dateAdded":"2023-02-10","dueDate":"2023-03-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00051.html; https://nvd.nist.gov/vuln/detail/CVE-2015-2291","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2015-2291"},{"cveID":"CVE-2022-21587","vendorProject":"Oracle","product":"E-Business Suite","vulnerabilityName":"Oracle E-Business Suite Unspecified Vulnerability","dateAdded":"2023-02-02","dueDate":"2023-02-23","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.oracle.com/security-alerts/cpuoct2022.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-21587","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-21587"},{"cveID":"CVE-2017-11357","vendorProject":"Telerik","product":"User Interface (UI) for ASP.NET AJAX","vulnerabilityName":"Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability","dateAdded":"2023-01-26","dueDate":"2023-02-16","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/asyncupload-insecure-direct-object-reference; https://nvd.nist.gov/vuln/detail/CVE-2017-11357","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2017-11357"},{"cveID":"CVE-2022-47966","vendorProject":"Zoho","product":"ManageEngine","vulnerabilityName":"Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability","dateAdded":"2023-01-23","dueDate":"2023-02-13","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-47966","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-47966"},{"cveID":"CVE-2022-41080","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Privilege Escalation Vulnerability","dateAdded":"2023-01-10","dueDate":"2023-01-31","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41080;  https://nvd.nist.gov/vuln/detail/CVE-2022-41080","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-41080"},{"cveID":"CVE-2022-44698","vendorProject":"Microsoft","product":"Defender","vulnerabilityName":"Microsoft Defender SmartScreen Security Feature Bypass Vulnerability","dateAdded":"2022-12-13","dueDate":"2023-01-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-755"],"shortDescription":"Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698;  https://nvd.nist.gov/vuln/detail/CVE-2022-44698","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-44698"},{"cveID":"CVE-2022-42475","vendorProject":"Fortinet","product":"FortiOS","vulnerabilityName":"Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability","dateAdded":"2022-12-13","dueDate":"2023-01-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-197"],"shortDescription":"Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.fortiguard.com/psirt/FG-IR-22-398;  https://nvd.nist.gov/vuln/detail/CVE-2022-42475","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-42475"},{"cveID":"CVE-2022-26501","vendorProject":"Veeam","product":"Backup & Replication","vulnerabilityName":"Veeam Backup & Replication Remote Code Execution Vulnerability","dateAdded":"2022-12-13","dueDate":"2023-01-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.veeam.com/kb4288;  https://nvd.nist.gov/vuln/detail/CVE-2022-26501","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-26501"},{"cveID":"CVE-2022-26500","vendorProject":"Veeam","product":"Backup & Replication","vulnerabilityName":"Veeam Backup & Replication Remote Code Execution Vulnerability","dateAdded":"2022-12-13","dueDate":"2023-01-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.veeam.com/kb4288;  https://nvd.nist.gov/vuln/detail/CVE-2022-26500","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-26500"},{"cveID":"CVE-2022-41091","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability","dateAdded":"2022-11-08","dueDate":"2022-12-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-863"],"shortDescription":"Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.","requiredAction":"Apply updates per vendor instructions.","notes":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41091;  https://nvd.nist.gov/vuln/detail/CVE-2022-41091","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41091"},{"cveID":"CVE-2022-41073","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability","dateAdded":"2022-11-08","dueDate":"2022-12-09","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41073;  https://nvd.nist.gov/vuln/detail/CVE-2022-41073","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41073"},{"cveID":"CVE-2020-3433","vendorProject":"Cisco","product":"AnyConnect Secure","vulnerabilityName":"Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability","dateAdded":"2022-10-24","dueDate":"2022-11-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-427"],"shortDescription":"Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW; https://nvd.nist.gov/vuln/detail/CVE-2020-3433","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-3433"},{"cveID":"CVE-2020-3153","vendorProject":"Cisco","product":"AnyConnect Secure","vulnerabilityName":"Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability","dateAdded":"2022-10-24","dueDate":"2022-11-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-427"],"shortDescription":"Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.","requiredAction":"Apply updates per vendor instructions.","notes":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj; https://nvd.nist.gov/vuln/detail/CVE-2020-3153","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-3153"},{"cveID":"CVE-2018-19323","vendorProject":"GIGABYTE","product":"Multiple Products","vulnerabilityName":"GIGABYTE Multiple Products Privilege Escalation Vulnerability","dateAdded":"2022-10-24","dueDate":"2022-11-14","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19323","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-19323"},{"cveID":"CVE-2018-19322","vendorProject":"GIGABYTE","product":"Multiple Products","vulnerabilityName":"GIGABYTE Multiple Products Code Execution Vulnerability","dateAdded":"2022-10-24","dueDate":"2022-11-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-749"],"shortDescription":"The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19322","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-19322"},{"cveID":"CVE-2018-19321","vendorProject":"GIGABYTE","product":"Multiple Products","vulnerabilityName":"GIGABYTE Multiple Products Privilege Escalation Vulnerability","dateAdded":"2022-10-24","dueDate":"2022-11-14","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19321","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-19321"},{"cveID":"CVE-2018-19320","vendorProject":"GIGABYTE","product":"Multiple Products","vulnerabilityName":"GIGABYTE Multiple Products Unspecified Vulnerability","dateAdded":"2022-10-24","dueDate":"2022-11-14","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19320","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-19320"},{"cveID":"CVE-2022-41352","vendorProject":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","vulnerabilityName":"Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability","dateAdded":"2022-10-20","dueDate":"2022-11-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.","requiredAction":"Apply updates per vendor instructions.","notes":"https://wiki.zimbra.com/wiki/Security_Center;  https://nvd.nist.gov/vuln/detail/CVE-2022-41352","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41352"},{"cveID":"CVE-2022-40684","vendorProject":"Fortinet","product":"Multiple Products","vulnerabilityName":"Fortinet Multiple Products Authentication Bypass Vulnerability","dateAdded":"2022-10-11","dueDate":"2022-11-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-288"],"shortDescription":"Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.fortiguard.com/psirt/FG-IR-22-377;  https://nvd.nist.gov/vuln/detail/CVE-2022-40684","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-40684"},{"cveID":"CVE-2022-41082","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2022-09-30","dueDate":"2022-10-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/;  https://nvd.nist.gov/vuln/detail/CVE-2022-41082","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41082"},{"cveID":"CVE-2022-41040","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Server-Side Request Forgery Vulnerability","dateAdded":"2022-09-30","dueDate":"2022-10-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"Microsoft Exchange Server allows for server-side request forgery. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/;  https://nvd.nist.gov/vuln/detail/CVE-2022-41040","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-41040"},{"cveID":"CVE-2022-37969","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","dateAdded":"2022-09-14","dueDate":"2022-10-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-787"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-37969;  https://nvd.nist.gov/vuln/detail/CVE-2022-37969","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-37969"},{"cveID":"CVE-2022-27593","vendorProject":"QNAP","product":"Photo Station","vulnerabilityName":"QNAP Photo Station Externally Controlled Reference Vulnerability","dateAdded":"2022-09-08","dueDate":"2022-09-29","knownRansomwareCampaignUse":"Known","cwes":["CWE-610"],"shortDescription":"Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.qnap.com/en/security-advisory/qsa-22-24;  https://nvd.nist.gov/vuln/detail/CVE-2022-27593","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-27593"},{"cveID":"CVE-2018-6530","vendorProject":"D-Link","product":"Multiple Routers","vulnerabilityName":"D-Link Multiple Routers OS Command Injection Vulnerability","dateAdded":"2022-09-08","dueDate":"2022-09-29","knownRansomwareCampaignUse":"Known","cwes":["CWE-78"],"shortDescription":"Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands.","requiredAction":"The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.","notes":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10105; https://nvd.nist.gov/vuln/detail/CVE-2018-6530","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-6530"},{"cveID":"CVE-2018-13374","vendorProject":"Fortinet","product":"FortiOS and FortiADC","vulnerabilityName":"Fortinet FortiOS and FortiADC Improper Access Control Vulnerability","dateAdded":"2022-09-08","dueDate":"2022-09-29","knownRansomwareCampaignUse":"Known","cwes":["CWE-732"],"shortDescription":"Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.fortiguard.com/psirt/FG-IR-18-157; https://nvd.nist.gov/vuln/detail/CVE-2018-13374","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-13374"},{"cveID":"CVE-2022-26352","vendorProject":"dotCMS","product":"dotCMS","vulnerabilityName":"dotCMS Unrestricted Upload of File Vulnerability","dateAdded":"2022-08-25","dueDate":"2022-09-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-22","CWE-138"],"shortDescription":"dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://www.dotcms.com/security/SI-62;  https://nvd.nist.gov/vuln/detail/CVE-2022-26352","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-26352"},{"cveID":"CVE-2022-2294","vendorProject":"WebRTC","product":"WebRTC","vulnerabilityName":"WebRTC Heap Buffer Overflow Vulnerability","dateAdded":"2022-08-25","dueDate":"2022-09-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-122"],"shortDescription":"WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.","requiredAction":"Apply updates per vendor instructions.","notes":"https://groups.google.com/g/discuss-webrtc/c/5KBtZx2gvcQ;  https://nvd.nist.gov/vuln/detail/CVE-2022-2294","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-2294"},{"cveID":"CVE-2022-37042","vendorProject":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","vulnerabilityName":"Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability","dateAdded":"2022-08-11","dueDate":"2022-09-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-23"],"shortDescription":"Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/;  https://nvd.nist.gov/vuln/detail/CVE-2022-37042","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-37042"},{"cveID":"CVE-2022-27925","vendorProject":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","vulnerabilityName":"Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability","dateAdded":"2022-08-11","dueDate":"2022-09-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/;  https://nvd.nist.gov/vuln/detail/CVE-2022-27925","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-27925"},{"cveID":"CVE-2022-30333","vendorProject":"RARLAB","product":"UnRAR","vulnerabilityName":"RARLAB UnRAR Directory Traversal Vulnerability","dateAdded":"2022-08-09","dueDate":"2022-08-30","knownRansomwareCampaignUse":"Known","cwes":["CWE-22","CWE-59"],"shortDescription":"RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.","requiredAction":"Apply updates per vendor instructions.","notes":"Vulnerability updated with version 6.12. Accessing link will download update information: https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz;  https://nvd.nist.gov/vuln/detail/CVE-2022-30333","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-30333"},{"cveID":"CVE-2022-27924","vendorProject":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","vulnerabilityName":"Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability","dateAdded":"2022-08-04","dueDate":"2022-08-25","knownRansomwareCampaignUse":"Known","cwes":["CWE-93"],"shortDescription":"Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.","requiredAction":"Apply updates per vendor instructions.","notes":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24.1#Security_Fixes;  https://nvd.nist.gov/vuln/detail/CVE-2022-27924","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-27924"},{"cveID":"CVE-2022-29499","vendorProject":"Mitel","product":"MiVoice Connect","vulnerabilityName":"Mitel MiVoice Connect Data Validation Vulnerability","dateAdded":"2022-06-27","dueDate":"2022-07-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-29499","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-29499"},{"cveID":"CVE-2021-4034","vendorProject":"Red Hat","product":"Polkit","vulnerabilityName":"Red Hat Polkit Out-of-Bounds Read and Write Vulnerability","dateAdded":"2022-06-27","dueDate":"2022-07-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-4034","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-4034"},{"cveID":"CVE-2022-30190","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability","dateAdded":"2022-06-14","dueDate":"2022-07-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-610"],"shortDescription":"A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-30190","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-30190"},{"cveID":"CVE-2019-7195","vendorProject":"QNAP","product":"Photo Station","vulnerabilityName":"QNAP Photo Station Path Traversal Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7195","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-7195"},{"cveID":"CVE-2019-7194","vendorProject":"QNAP","product":"Photo Station","vulnerabilityName":"QNAP Photo Station Path Traversal Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7194","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-7194"},{"cveID":"CVE-2019-7193","vendorProject":"QNAP","product":"QTS","vulnerabilityName":"QNAP QTS Improper Input Validation Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7193","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-7193"},{"cveID":"CVE-2019-7192","vendorProject":"QNAP","product":"Photo Station","vulnerabilityName":"QNAP Photo Station Improper Access Control Vulnerability","dateAdded":"2022-06-08","dueDate":"2022-06-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-863"],"shortDescription":"QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7192","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-7192"},{"cveID":"CVE-2022-26134","vendorProject":"Atlassian","product":"Confluence Server/Data Center","vulnerabilityName":"Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability","dateAdded":"2022-06-02","dueDate":"2022-06-06","knownRansomwareCampaignUse":"Known","cwes":["CWE-917"],"shortDescription":"Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution.","requiredAction":"Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-26134","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-26134"},{"cveID":"CVE-2016-0034","vendorProject":"Microsoft","product":"Silverlight","vulnerabilityName":"Microsoft Silverlight Runtime Remote Code Execution Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).","requiredAction":"The impacted products are end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0034","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-0034"},{"cveID":"CVE-2013-3993","vendorProject":"IBM","product":"InfoSphere BigInsights","vulnerabilityName":"IBM InfoSphere BigInsights Invalid Input Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-3993","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-3993"},{"cveID":"CVE-2013-0431","vendorProject":"Oracle","product":"Java Runtime Environment (JRE)","vulnerabilityName":"Oracle JRE Sandbox Bypass Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-0431","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-0431"},{"cveID":"CVE-2013-0422","vendorProject":"Oracle","product":"Java Runtime Environment (JRE)","vulnerabilityName":"Oracle JRE Remote Code Execution Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-0422","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-0422"},{"cveID":"CVE-2013-0074","vendorProject":"Microsoft","product":"Silverlight","vulnerabilityName":"Microsoft Silverlight Double Dereference Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-0074","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-0074"},{"cveID":"CVE-2012-1710","vendorProject":"Oracle","product":"Fusion Middleware","vulnerabilityName":"Oracle Fusion Middleware Unspecified Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-1710","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2012-1710"},{"cveID":"CVE-2010-1428","vendorProject":"Red Hat","product":"JBoss","vulnerabilityName":"Red Hat JBoss Information Disclosure Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-1428","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2010-1428"},{"cveID":"CVE-2010-0738","vendorProject":"Red Hat","product":"JBoss","vulnerabilityName":"Red Hat JBoss Authentication Bypass Vulnerability","dateAdded":"2022-05-25","dueDate":"2022-06-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-0738","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2010-0738"},{"cveID":"CVE-2018-19953","vendorProject":"QNAP","product":"Network Attached Storage (NAS)","vulnerabilityName":"QNAP NAS File Station Cross-Site Scripting Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-79","CWE-80"],"shortDescription":"A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-19953","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-19953"},{"cveID":"CVE-2018-19949","vendorProject":"QNAP","product":"Network Attached Storage (NAS)","vulnerabilityName":"QNAP NAS File Station Command Injection Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-77","CWE-78"],"shortDescription":"A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-19949","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-19949"},{"cveID":"CVE-2018-19943","vendorProject":"QNAP","product":"Network Attached Storage (NAS)","vulnerabilityName":"QNAP NAS File Station Cross-Site Scripting Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-79","CWE-80"],"shortDescription":"A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-19943","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-19943"},{"cveID":"CVE-2017-18362","vendorProject":"Kaseya","product":"Virtual System/Server Administrator (VSA)","vulnerabilityName":"Kaseya VSA SQL Injection Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-18362","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-18362"},{"cveID":"CVE-2017-0147","vendorProject":"Microsoft","product":"SMBv1 server","vulnerabilityName":"Microsoft Windows SMBv1 Information Disclosure Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-200"],"shortDescription":"The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0147","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0147"},{"cveID":"CVE-2016-3351","vendorProject":"Microsoft","product":"Internet Explorer and Edge","vulnerabilityName":"Microsoft Internet Explorer and Edge Information Disclosure Vulnerability","dateAdded":"2022-05-24","dueDate":"2022-06-14","knownRansomwareCampaignUse":"Known","cwes":["CWE-200"],"shortDescription":"An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-3351","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-3351"},{"cveID":"CVE-2020-0638","vendorProject":"Microsoft","product":"Update Notification Manager","vulnerabilityName":"Microsoft Update Notification Manager Privilege Escalation Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0638","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-0638"},{"cveID":"CVE-2019-1385","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1385","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1385"},{"cveID":"CVE-2019-1130","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability","dateAdded":"2022-05-23","dueDate":"2022-06-13","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1130","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1130"},{"cveID":"CVE-2022-1388","vendorProject":"F5","product":"BIG-IP","vulnerabilityName":"F5 BIG-IP Missing Authentication Vulnerability","dateAdded":"2022-05-10","dueDate":"2022-05-31","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-1388","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-1388"},{"cveID":"CVE-2022-29464","vendorProject":"WSO2","product":"Multiple Products","vulnerabilityName":"WSO2 Multiple Products Unrestrictive Upload of File Vulnerability","dateAdded":"2022-04-25","dueDate":"2022-05-16","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-29464","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-29464"},{"cveID":"CVE-2018-6882","vendorProject":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","vulnerabilityName":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","dateAdded":"2022-04-19","dueDate":"2022-05-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-79"],"shortDescription":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-6882","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-6882"},{"cveID":"CVE-2019-16057","vendorProject":"D-Link","product":"DNS-320 Storage Device","vulnerabilityName":"D-Link DNS-320 Remote Code Execution Vulnerability","dateAdded":"2022-04-15","dueDate":"2022-05-06","knownRansomwareCampaignUse":"Known","cwes":["CWE-78"],"shortDescription":"The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-16057","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-16057"},{"cveID":"CVE-2022-22954","vendorProject":"VMware","product":"Workspace ONE Access and Identity Manager","vulnerabilityName":"VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability","dateAdded":"2022-04-14","dueDate":"2022-05-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-22954","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-22954"},{"cveID":"CVE-2022-24521","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows CLFS Driver Privilege Escalation Vulnerability","dateAdded":"2022-04-13","dueDate":"2022-05-04","knownRansomwareCampaignUse":"Known","cwes":["CWE-787","CWE-1285"],"shortDescription":"Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-24521","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-24521"},{"cveID":"CVE-2018-7602","vendorProject":"Drupal","product":"Core","vulnerabilityName":"Drupal Core Remote Code Execution Vulnerability","dateAdded":"2022-04-13","dueDate":"2022-05-04","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-7602","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-7602"},{"cveID":"CVE-2018-20753","vendorProject":"Kaseya","product":"Virtual System/Server Administrator (VSA)","vulnerabilityName":"Kaseya VSA Remote Code Execution Vulnerability","dateAdded":"2022-04-13","dueDate":"2022-05-04","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-20753","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-20753"},{"cveID":"CVE-2021-42287","vendorProject":"Microsoft","product":"Active Directory","vulnerabilityName":"Microsoft Active Directory Domain Services Privilege Escalation Vulnerability","dateAdded":"2022-04-11","dueDate":"2022-05-02","knownRansomwareCampaignUse":"Known","cwes":["CWE-269"],"shortDescription":"Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-42287","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-42287"},{"cveID":"CVE-2021-42278","vendorProject":"Microsoft","product":"Active Directory","vulnerabilityName":"Microsoft Active Directory Domain Services Privilege Escalation Vulnerability","dateAdded":"2022-04-11","dueDate":"2022-05-02","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-42278","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-42278"},{"cveID":"CVE-2017-0148","vendorProject":"Microsoft","product":"SMBv1 server","vulnerabilityName":"Microsoft SMBv1 Server Remote Code Execution Vulnerability","dateAdded":"2022-04-06","dueDate":"2022-04-27","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0148","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0148"},{"cveID":"CVE-2021-28799","vendorProject":"QNAP","product":"Network Attached Storage (NAS)","vulnerabilityName":"QNAP NAS Improper Authorization Vulnerability","dateAdded":"2022-03-31","dueDate":"2022-04-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-285"],"shortDescription":"QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-28799","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-28799"},{"cveID":"CVE-2018-10562","vendorProject":"Dasan","product":"Gigabit Passive Optical Network (GPON) Routers","vulnerabilityName":"Dasan GPON Routers Command Injection Vulnerability","dateAdded":"2022-03-31","dueDate":"2022-04-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-78"],"shortDescription":"Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-10562","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-10562"},{"cveID":"CVE-2021-38646","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-38646","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-38646"},{"cveID":"CVE-2021-26085","vendorProject":"Atlassian","product":"Confluence Server","vulnerabilityName":"Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-425"],"shortDescription":"Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-26085","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-26085"},{"cveID":"CVE-2021-20028","vendorProject":"SonicWall","product":"Secure Remote Access (SRA)","vulnerabilityName":"SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20028","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-20028"},{"cveID":"CVE-2018-8440","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8440","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8440"},{"cveID":"CVE-2018-8406","vendorProject":"Microsoft","product":"DirectX Graphics Kernel (DXGKRNL)","vulnerabilityName":"Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-404"],"shortDescription":"An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8406","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8406"},{"cveID":"CVE-2018-8405","vendorProject":"Microsoft","product":"DirectX Graphics Kernel (DXGKRNL)","vulnerabilityName":"Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-404"],"shortDescription":"An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8405","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8405"},{"cveID":"CVE-2017-0213","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0213","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0213"},{"cveID":"CVE-2016-0189","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Memory Corruption Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0189","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-0189"},{"cveID":"CVE-2016-0151","vendorProject":"Microsoft","product":"Client-Server Run-time Subsystem (CSRSS)","vulnerabilityName":"Microsoft Windows CSRSS Security Feature Bypass Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0151","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-0151"},{"cveID":"CVE-2013-2551","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Use-After-Free Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-2551","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-2551"},{"cveID":"CVE-2013-2465","vendorProject":"Oracle","product":"Java SE","vulnerabilityName":"Oracle Java SE Unspecified Vulnerability","dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-2465","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-2465"},{"cveID":"CVE-2022-21999","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Print Spooler Privilege Escalation Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-40","CWE-1386"],"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-21999","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-21999"},{"cveID":"CVE-2021-42237","vendorProject":"Sitecore","product":"XP","vulnerabilityName":"Sitecore XP Remote Command Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-42237","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-42237"},{"cveID":"CVE-2021-22941","vendorProject":"Citrix","product":"ShareFile","vulnerabilityName":"Citrix ShareFile Improper Access Control Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-284"],"shortDescription":"Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-22941","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-22941"},{"cveID":"CVE-2020-2021","vendorProject":"Palo Alto Networks","product":"PAN-OS","vulnerabilityName":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-347"],"shortDescription":"Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-2021","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-2021"},{"cveID":"CVE-2019-15107","vendorProject":"Webmin","product":"Webmin","vulnerabilityName":"Webmin Command Injection Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-78"],"shortDescription":"An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-15107","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-15107"},{"cveID":"CVE-2019-11043","vendorProject":"PHP","product":"FastCGI Process Manager (FPM)","vulnerabilityName":"PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-120"],"shortDescription":"In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11043","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-11043"},{"cveID":"CVE-2018-1273","vendorProject":"VMware Tanzu","product":"Spring Data Commons","vulnerabilityName":"VMware Tanzu Spring Data Commons Property Binder Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-1273","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-1273"},{"cveID":"CVE-2018-11138","vendorProject":"Quest","product":"KACE System Management Appliance","vulnerabilityName":"Quest KACE System Management Appliance Remote Command Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-78"],"shortDescription":"The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-11138","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-11138"},{"cveID":"CVE-2017-12615","vendorProject":"Apache","product":"Tomcat","vulnerabilityName":"Apache Tomcat on Windows Remote Code Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-434"],"shortDescription":"When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-12615","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-12615"},{"cveID":"CVE-2017-0146","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows SMB Remote Code Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0146","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0146"},{"cveID":"CVE-2010-2861","vendorProject":"Adobe","product":"ColdFusion","vulnerabilityName":"Adobe ColdFusion Directory Traversal Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-2861","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2010-2861"},{"cveID":"CVE-2020-5135","vendorProject":"SonicWall","product":"SonicOS","vulnerabilityName":"SonicWall SonicOS Buffer Overflow Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-120"],"shortDescription":"A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-5135","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-5135"},{"cveID":"CVE-2019-1405","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1405","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1405"},{"cveID":"CVE-2019-1322","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1322","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1322"},{"cveID":"CVE-2019-1315","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1315","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1315"},{"cveID":"CVE-2019-1253","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1253","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1253"},{"cveID":"CVE-2019-1129","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1129","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1129"},{"cveID":"CVE-2019-1069","vendorProject":"Microsoft","product":"Task Scheduler","vulnerabilityName":"Microsoft Task Scheduler Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1069","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1069"},{"cveID":"CVE-2019-1064","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1064","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1064"},{"cveID":"CVE-2019-0841","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-59"],"shortDescription":"A privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0841","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-0841"},{"cveID":"CVE-2019-0543","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"A privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0543","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-0543"},{"cveID":"CVE-2018-8120","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-404"],"shortDescription":"A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8120","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8120"},{"cveID":"CVE-2017-0101","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Transaction Manager Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"A privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0101","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0101"},{"cveID":"CVE-2016-3309","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Kernel Privilege Escalation Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-3309","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-3309"},{"cveID":"CVE-2015-2546","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Memory Corruption Vulnerability","dateAdded":"2022-03-15","dueDate":"2022-04-05","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2546","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-2546"},{"cveID":"CVE-2009-3960","vendorProject":"Adobe","product":"BlazeDS","vulnerabilityName":"Adobe BlazeDS Information Disclosure Vulnerability","dateAdded":"2022-03-07","dueDate":"2022-09-07","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability that allows for information disclosure.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2009-3960","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2009-3960"},{"cveID":"CVE-2021-41379","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Installer Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-1386"],"shortDescription":"Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-41379","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-41379"},{"cveID":"CVE-2018-8581","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-17","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8581","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8581"},{"cveID":"CVE-2016-4117","vendorProject":"Adobe","product":"Flash Player","vulnerabilityName":"Adobe Flash Player Arbitrary Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-4117","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-4117"},{"cveID":"CVE-2016-1019","vendorProject":"Adobe","product":"Flash Player","vulnerabilityName":"Adobe Flash Player Arbitrary Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-1019","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-1019"},{"cveID":"CVE-2016-0099","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0099","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-0099"},{"cveID":"CVE-2015-7645","vendorProject":"Adobe","product":"Flash Player","vulnerabilityName":"Adobe Flash Player Arbitrary Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-7645","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-7645"},{"cveID":"CVE-2015-1701","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-1701","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2015-1701"},{"cveID":"CVE-2012-4681","vendorProject":"Oracle","product":"Java SE","vulnerabilityName":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-4681","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2012-4681"},{"cveID":"CVE-2012-1723","vendorProject":"Oracle","product":"Java SE","vulnerabilityName":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-1723","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2012-1723"},{"cveID":"CVE-2012-0507","vendorProject":"Oracle","product":"Java SE","vulnerabilityName":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-0507","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2012-0507"},{"cveID":"CVE-2010-0188","vendorProject":"Adobe","product":"Reader and Acrobat","vulnerabilityName":"Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2010-0188","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2010-0188"},{"cveID":"CVE-2008-2992","vendorProject":"Adobe","product":"Acrobat and Reader","vulnerabilityName":"Adobe Reader and Acrobat Input Validation Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-24","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2008-2992","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2008-2992"},{"cveID":"CVE-2022-24682","vendorProject":"Synacor","product":"Zimbra Collaborate Suite (ZCS)","vulnerabilityName":"Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability","dateAdded":"2022-02-25","dueDate":"2022-03-11","knownRansomwareCampaignUse":"Known","cwes":["CWE-79","CWE-116"],"shortDescription":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-24682","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-24682"},{"cveID":"CVE-2019-0752","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Type Confusion Vulnerability","dateAdded":"2022-02-15","dueDate":"2022-08-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-843"],"shortDescription":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0752","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-0752"},{"cveID":"CVE-2018-8174","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability","dateAdded":"2022-02-15","dueDate":"2022-08-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka \"Windows VBScript Engine Remote Code Execution\"","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8174","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8174"},{"cveID":"CVE-2018-20250","vendorProject":"RARLAB","product":"WinRAR","vulnerabilityName":"WinRAR Absolute Path Traversal Vulnerability","dateAdded":"2022-02-15","dueDate":"2022-08-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-36"],"shortDescription":"WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-20250","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-20250"},{"cveID":"CVE-2018-15982","vendorProject":"Adobe","product":"Flash Player","vulnerabilityName":"Adobe Flash Player Use-After-Free Vulnerability","dateAdded":"2022-02-15","dueDate":"2022-08-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-15982","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-15982"},{"cveID":"CVE-2020-0796","vendorProject":"Microsoft","product":"SMBv3","vulnerabilityName":"Microsoft SMBv3 Remote Code Execution Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0796","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-0796"},{"cveID":"CVE-2017-10271","vendorProject":"Oracle","product":"WebLogic Server","vulnerabilityName":"Oracle Corporation WebLogic Server Remote Code Execution Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-10271","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-10271"},{"cveID":"CVE-2017-0145","vendorProject":"Microsoft","product":"SMBv1","vulnerabilityName":"Microsoft SMBv1 Remote Code Execution Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0145","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0145"},{"cveID":"CVE-2017-0144","vendorProject":"Microsoft","product":"SMBv1","vulnerabilityName":"Microsoft SMBv1 Remote Code Execution Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0144","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-0144"},{"cveID":"CVE-2022-21882","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-02-04","dueDate":"2022-02-18","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-21882","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-21882"},{"cveID":"CVE-2021-20038","vendorProject":"SonicWall","product":"SMA 100 Appliances","vulnerabilityName":"SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability","dateAdded":"2022-01-28","dueDate":"2022-02-11","knownRansomwareCampaignUse":"Known","cwes":["CWE-121"],"shortDescription":"SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20038","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-20038"},{"cveID":"CVE-2020-0787","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability","dateAdded":"2022-01-28","dueDate":"2022-07-28","knownRansomwareCampaignUse":"Known","cwes":["CWE-269","CWE-59"],"shortDescription":"Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0787","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-0787"},{"cveID":"CVE-2018-8453","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-01-21","dueDate":"2022-07-21","knownRansomwareCampaignUse":"Known","cwes":["CWE-404"],"shortDescription":"Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-8453","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-8453"},{"cveID":"CVE-2021-21975","vendorProject":"VMware","product":"vRealize Operations Manager API","vulnerabilityName":"VMware Server Side Request Forgery in vRealize Operations Manager API","dateAdded":"2022-01-18","dueDate":"2022-02-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-21975","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2021-21975"},{"cveID":"CVE-2019-2725","vendorProject":"Oracle","product":"WebLogic Server","vulnerabilityName":"Oracle WebLogic Server, Injection","dateAdded":"2022-01-10","dueDate":"2022-07-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-74"],"shortDescription":"Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-2725","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-2725"},{"cveID":"CVE-2019-1579","vendorProject":"Palo Alto Networks","product":"PAN-OS","vulnerabilityName":"Palo Alto Networks PAN-OS Remote Code Execution Vulnerability","dateAdded":"2022-01-10","dueDate":"2022-07-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-134"],"shortDescription":"Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1579","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1579"},{"cveID":"CVE-2019-1458","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2022-01-10","dueDate":"2022-07-10","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1458","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2019-1458"},{"cveID":"CVE-2018-13383","vendorProject":"Fortinet","product":"FortiOS and FortiProxy","vulnerabilityName":"Fortinet FortiOS and FortiProxy Out-of-bounds Write","dateAdded":"2022-01-10","dueDate":"2022-07-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-13383","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-13383"},{"cveID":"CVE-2018-13382","vendorProject":"Fortinet","product":"FortiOS and FortiProxy","vulnerabilityName":"Fortinet FortiOS and FortiProxy Improper Authorization","dateAdded":"2022-01-10","dueDate":"2022-07-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-285"],"shortDescription":"An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-13382","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2018-13382"},{"cveID":"CVE-2021-43890","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows AppX Installer Spoofing Vulnerability","dateAdded":"2021-12-15","dueDate":"2021-12-29","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-43890","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-43890"},{"cveID":"CVE-2021-44228","vendorProject":"Apache","product":"Log4j2","vulnerabilityName":"Apache Log4j2 Remote Code Execution Vulnerability","dateAdded":"2021-12-10","dueDate":"2021-12-24","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-400","CWE-502"],"shortDescription":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","requiredAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-44228"},{"cveID":"CVE-2017-12149","vendorProject":"Red Hat","product":"JBoss Application Server","vulnerabilityName":"Red Hat JBoss Application Server Remote Code Execution Vulnerability","dateAdded":"2021-12-10","dueDate":"2022-06-10","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-12149","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-12149"},{"cveID":"CVE-2021-40438","vendorProject":"Apache","product":"Apache","vulnerabilityName":"Apache HTTP Server-Side Request Forgery (SSRF)","dateAdded":"2021-12-01","dueDate":"2021-12-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40438","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-40438"},{"cveID":"CVE-2021-42321","vendorProject":"Microsoft","product":"Exchange","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-17","dueDate":"2021-12-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-184","CWE-502"],"shortDescription":"An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-42321","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-42321"},{"cveID":"CVE-2021-40449","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-17","dueDate":"2021-12-01","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Unspecified vulnerability allows for an authenticated user to escalate privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40449","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-40449"},{"cveID":"CVE-2021-42258","vendorProject":"BQE","product":"BillQuick Web Suite","vulnerabilityName":"BQE BillQuick Web Suite SQL Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-42258","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-42258"},{"cveID":"CVE-2021-42013","vendorProject":"Apache","product":"HTTP Server","vulnerabilityName":"Apache HTTP Server Path Traversal Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-42013","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-42013"},{"cveID":"CVE-2021-41773","vendorProject":"Apache","product":"HTTP Server","vulnerabilityName":"Apache HTTP Server Path Traversal Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-41773","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-41773"},{"cveID":"CVE-2021-40539","vendorProject":"Zoho","product":"ManageEngine","vulnerabilityName":"Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-55"],"shortDescription":"Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40539","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-40539"},{"cveID":"CVE-2021-40444","vendorProject":"Microsoft","product":"MSHTML","vulnerabilityName":"Microsoft MSHTML Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40444","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-40444"},{"cveID":"CVE-2021-38647","vendorProject":"Microsoft","product":"Open Management Infrastructure (OMI)","vulnerabilityName":"Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-1390"],"shortDescription":"Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-38647","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-38647"},{"cveID":"CVE-2021-36955","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36955","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-36955"},{"cveID":"CVE-2021-36942","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-749"],"shortDescription":"Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-36942","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-36942"},{"cveID":"CVE-2021-35464","vendorProject":"ForgeRock","product":"Access Management (AM)","vulnerabilityName":"ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend).","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-35464","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-35464"},{"cveID":"CVE-2021-35211","vendorProject":"SolarWinds","product":"Serv-U","vulnerabilityName":"SolarWinds Serv-U Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-35211","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-35211"},{"cveID":"CVE-2021-34527","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-269"],"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-04 (https://www.cisa.gov/news-events/directives/ed-21-04-mitigate-windows-print-spooler-service-vulnerability) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-04. https://nvd.nist.gov/vuln/detail/CVE-2021-34527","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-34527"},{"cveID":"CVE-2021-34523","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34523","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-34523"},{"cveID":"CVE-2021-34473","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-34473","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-34473"},{"cveID":"CVE-2021-31207","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Security Feature Bypass Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-434"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-31207","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-31207"},{"cveID":"CVE-2021-30116","vendorProject":"Kaseya","product":"Virtual System/Server Administrator (VSA)","vulnerabilityName":"Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-522"],"shortDescription":"Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-30116","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-30116"},{"cveID":"CVE-2021-27104","vendorProject":"Accellion","product":"FTA","vulnerabilityName":"Accellion FTA OS Command Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-78"],"shortDescription":"Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-27104","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-27104"},{"cveID":"CVE-2021-27103","vendorProject":"Accellion","product":"FTA","vulnerabilityName":"Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-27103","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-27103"},{"cveID":"CVE-2021-27102","vendorProject":"Accellion","product":"FTA","vulnerabilityName":"Accellion FTA OS Command Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-78"],"shortDescription":"Accellion FTA contains an OS command injection vulnerability exploited via a local web service call.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-27102","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-27102"},{"cveID":"CVE-2021-27101","vendorProject":"Accellion","product":"FTA","vulnerabilityName":"Accellion FTA SQL Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-89","CWE-138"],"shortDescription":"Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-27101","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-27101"},{"cveID":"CVE-2021-27065","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-39"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-27065","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-27065"},{"cveID":"CVE-2021-26858","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26858","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-26858"},{"cveID":"CVE-2021-26857","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26857","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-26857"},{"cveID":"CVE-2021-26855","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-02 (https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-02. https://nvd.nist.gov/vuln/detail/CVE-2021-26855","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-26855"},{"cveID":"CVE-2021-26411","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Microsoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-26411","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-26411"},{"cveID":"CVE-2021-26084","vendorProject":"Atlassian","product":"Confluence Server and Data Center","vulnerabilityName":"Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-917"],"shortDescription":"Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language (OGNL) injection vulnerability that may allow an unauthenticated attacker to execute code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-26084","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-26084"},{"cveID":"CVE-2021-22986","vendorProject":"F5","product":"BIG-IP and BIG-IQ Centralized Management","vulnerabilityName":"F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-863"],"shortDescription":"F5 BIG-IP and BIG-IQ Centralized Management contain a remote code execution vulnerability in the iControl REST interface that allows unauthenticated attackers with network access to execute system commands, create or delete files, and disable services.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-22986","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-22986"},{"cveID":"CVE-2021-22893","vendorProject":"Ivanti","product":"Pulse Connect Secure","vulnerabilityName":"Ivanti Pulse Connect Secure Use-After-Free Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22893","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-22893"},{"cveID":"CVE-2021-22205","vendorProject":"GitLab","product":"Community and Enterprise Editions","vulnerabilityName":"GitLab Community and Enterprise Editions Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-95"],"shortDescription":"GitHub Community and Enterprise Editions that utilize the ability to upload images through GitLab Workhorse are vulnerable to remote code execution. Workhorse passes image file extensions through ExifTool, which improperly validates the image files.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-22205","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-22205"},{"cveID":"CVE-2021-22005","vendorProject":"VMware","product":"vCenter Server","vulnerabilityName":"VMware vCenter Server File Upload Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-23"],"shortDescription":"VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-22005","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-22005"},{"cveID":"CVE-2021-21985","vendorProject":"VMware","product":"vCenter Server","vulnerabilityName":"VMware vCenter Server Improper Input Validation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-470","CWE-918"],"shortDescription":"VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-21985","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-21985"},{"cveID":"CVE-2021-21972","vendorProject":"VMware","product":"vCenter Server","vulnerabilityName":"VMware vCenter Server Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-23"],"shortDescription":"VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-21972","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-21972"},{"cveID":"CVE-2021-20023","vendorProject":"SonicWall","product":"SonicWall Email Security","vulnerabilityName":"SonicWall Email Security Path Traversal Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20023","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-20023"},{"cveID":"CVE-2021-20022","vendorProject":"SonicWall","product":"SonicWall Email Security","vulnerabilityName":"SonicWall Email Security Unrestricted Upload of File Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-434"],"shortDescription":"SonicWall Email Security contains an unrestricted upload of file with dangerous type vulnerability that allows a post-authenticated attacker to upload a file to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20023 to achieve privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20022","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-20022"},{"cveID":"CVE-2021-20021","vendorProject":"SonicWall","product":"SonicWall Email Security","vulnerabilityName":"SonicWall Email Security Improper Privilege Management Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20021","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-20021"},{"cveID":"CVE-2021-20016","vendorProject":"SonicWall","product":"SSLVPN SMA100","vulnerabilityName":"SonicWall SSLVPN SMA100 SQL Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-20016","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-20016"},{"cveID":"CVE-2021-1732","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-1732","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-1732"},{"cveID":"CVE-2021-1675","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Print Spooler Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-285"],"shortDescription":"Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-1675","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-1675"},{"cveID":"CVE-2020-5902","vendorProject":"F5","product":"BIG-IP","vulnerabilityName":"F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-5902","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-5902"},{"cveID":"CVE-2020-3992","vendorProject":"VMware","product":"ESXi","vulnerabilityName":"VMware ESXi OpenSLP Use-After-Free Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-3992","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-3992"},{"cveID":"CVE-2020-3580","vendorProject":"Cisco","product":"Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)","vulnerabilityName":"Cisco ASA and FTD Cross-Site Scripting (XSS) Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-79"],"shortDescription":"Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an insufficient input validation vulnerability for user-supplied input by the web services interface.  Successful exploitation could allow an attacker to perform cross-site scripting (XSS) in the context of the interface or access sensitive browser-based information.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-3580","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-3580"},{"cveID":"CVE-2020-1472","vendorProject":"Microsoft","product":"Netlogon","vulnerabilityName":"Microsoft Netlogon Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-330"],"shortDescription":"Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 20-04 (https://www.cisa.gov/news-events/directives/ed-20-04-mitigate-netlogon-elevation-privilege-vulnerability-august-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-04. https://nvd.nist.gov/vuln/detail/CVE-2020-1472","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-1472"},{"cveID":"CVE-2020-12812","vendorProject":"Fortinet","product":"FortiOS","vulnerabilityName":"Fortinet FortiOS SSL VPN Improper Authentication Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-178","CWE-287"],"shortDescription":"Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-12812","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-12812"},{"cveID":"CVE-2020-12271","vendorProject":"Sophos","product":"SFOS","vulnerabilityName":"Sophos SFOS SQL Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"Sophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords).","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-12271","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-12271"},{"cveID":"CVE-2020-0968","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0968","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-0968"},{"cveID":"CVE-2020-0878","vendorProject":"Microsoft","product":"Edge and Internet Explorer","vulnerabilityName":"Microsoft Edge and Internet Explorer Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0878","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-0878"},{"cveID":"CVE-2020-0688","vendorProject":"Microsoft","product":"Exchange Server","vulnerabilityName":"Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-287"],"shortDescription":"Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-0688","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-0688"},{"cveID":"CVE-2019-7481","vendorProject":"SonicWall","product":"SMA100","vulnerabilityName":"SonicWall SMA100 SQL Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-89"],"shortDescription":"SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7481","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-7481"},{"cveID":"CVE-2019-5591","vendorProject":"Fortinet","product":"FortiOS","vulnerabilityName":"Fortinet FortiOS Default Configuration Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-306"],"shortDescription":"Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-5591","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-5591"},{"cveID":"CVE-2019-5544","vendorProject":"VMware","product":"VMware ESXi and Horizon DaaS","vulnerabilityName":"VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"VMware ESXi and Horizon Desktop as a Service (DaaS) OpenSLP contains a heap-based buffer overflow vulnerability that allows an attacker with network access to port 427 to overwrite the heap of the OpenSLP service to perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-5544","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-5544"},{"cveID":"CVE-2019-3396","vendorProject":"Atlassian","product":"Confluence Server and Data Server","vulnerabilityName":"Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-3396","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-3396"},{"cveID":"CVE-2019-19781","vendorProject":"Citrix","product":"Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance","vulnerabilityName":"Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-19781","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-19781"},{"cveID":"CVE-2019-18935","vendorProject":"Progress","product":"Telerik UI for ASP.NET AJAX","vulnerabilityName":"Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Progress Telerik UI for ASP.NET AJAX contains a deserialization of untrusted data vulnerability through RadAsyncUpload which leads to code execution on the server in the context of the w3wp.exe process.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-18935","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-18935"},{"cveID":"CVE-2019-1367","vendorProject":"Microsoft","product":"Internet Explorer","vulnerabilityName":"Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1367","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-1367"},{"cveID":"CVE-2019-13608","vendorProject":"Citrix","product":"StoreFront Server","vulnerabilityName":"Citrix StoreFront Server XML External Entity (XXE) Processing Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-611"],"shortDescription":"Citrix StoreFront Server contains an XML External Entity (XXE) processing vulnerability that may allow an unauthenticated attacker to retrieve potentially sensitive information.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-13608","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-13608"},{"cveID":"CVE-2019-1215","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1215","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-1215"},{"cveID":"CVE-2019-11634","vendorProject":"Citrix","product":"Workspace Application and Receiver for Windows","vulnerabilityName":"Citrix Workspace Application and Receiver for Windows Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Citrix Workspace Application and Receiver for Windows contains remote code execution vulnerability resulting from local drive access preferences not being enforced into the clients' local drives.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11634","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-11634"},{"cveID":"CVE-2019-11580","vendorProject":"Atlassian","product":"Crowd and Crowd Data Center","vulnerabilityName":"Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Atlassian Crowd and Crowd Data Center contain a remote code execution vulnerability resulting from a pdkinstall development plugin being incorrectly enabled in release builds.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11580","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-11580"},{"cveID":"CVE-2019-11539","vendorProject":"Ivanti","product":"Pulse Connect Secure and Pulse Policy Secure","vulnerabilityName":"Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-78"],"shortDescription":"Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11539","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-11539"},{"cveID":"CVE-2019-11510","vendorProject":"Ivanti","product":"Pulse Connect Secure","vulnerabilityName":"Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Ivanti Pulse Connect Secure contains an arbitrary file read vulnerability that allows an unauthenticated remote attacker with network access via HTTPS to send a specially crafted URI.","requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2019-11510","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-11510"},{"cveID":"CVE-2019-0859","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0859","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0859"},{"cveID":"CVE-2019-0803","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0803","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0803"},{"cveID":"CVE-2019-0708","vendorProject":"Microsoft","product":"Remote Desktop Services","vulnerabilityName":"Microsoft Remote Desktop Services Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0708","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0708"},{"cveID":"CVE-2019-0604","vendorProject":"Microsoft","product":"SharePoint","vulnerabilityName":"Microsoft SharePoint Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0604","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0604"},{"cveID":"CVE-2018-7600","vendorProject":"Drupal","product":"Drupal Core","vulnerabilityName":"Drupal Core Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-7600","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2018-7600"},{"cveID":"CVE-2018-6789","vendorProject":"Exim","product":"Exim","vulnerabilityName":"Exim Buffer Overflow Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-6789","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2018-6789"},{"cveID":"CVE-2018-4878","vendorProject":"Adobe","product":"Flash Player","vulnerabilityName":"Adobe Flash Player Use-After-Free Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-416"],"shortDescription":"Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution.","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-4878","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2018-4878"},{"cveID":"CVE-2018-2380","vendorProject":"SAP","product":"Customer Relationship Management (CRM)","vulnerabilityName":"SAP Customer Relationship Management (CRM) Path Traversal Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-2380","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2018-2380"},{"cveID":"CVE-2018-13379","vendorProject":"Fortinet","product":"FortiOS","vulnerabilityName":"Fortinet FortiOS SSL VPN Path Traversal Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-13379","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2018-13379"},{"cveID":"CVE-2018-0802","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-787"],"shortDescription":"Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-0802","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2018-0802"},{"cveID":"CVE-2017-9822","vendorProject":"DotNetNuke (DNN)","product":"DotNetNuke (DNN)","vulnerabilityName":"DotNetNuke (DNN) Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"DotNetNuke (DNN) contains a vulnerability that may allow for remote code execution via cookie deserialization.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-9822","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-9822"},{"cveID":"CVE-2017-5638","vendorProject":"Apache","product":"Struts","vulnerabilityName":"Apache Struts Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-5638","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-5638"},{"cveID":"CVE-2017-11882","vendorProject":"Microsoft","product":"Office","vulnerabilityName":"Microsoft Office Memory Corruption Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-119"],"shortDescription":"Microsoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-11882","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-11882"},{"cveID":"CVE-2017-0199","vendorProject":"Microsoft","product":"Office and WordPad","vulnerabilityName":"Microsoft Office and WordPad Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":[],"shortDescription":"Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0199","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-0199"},{"cveID":"CVE-2017-0143","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-0143","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-0143"},{"cveID":"CVE-2016-7255","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-7255","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2016-7255"},{"cveID":"CVE-2016-0167","vendorProject":"Microsoft","product":"Win32k","vulnerabilityName":"Microsoft Win32k Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-264"],"shortDescription":"Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-0167","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2016-0167"},{"cveID":"CVE-2014-1812","vendorProject":"Microsoft","product":"Windows","vulnerabilityName":"Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-255"],"shortDescription":"Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-1812","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2014-1812"},{"cveID":"CVE-2012-0158","vendorProject":"Microsoft","product":"MSCOMCTL.OCX","vulnerabilityName":"Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-94"],"shortDescription":"Microsoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-0158","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2012-0158"}]}