Vulnerabilidades exploradas (CISA KEV)

CVE-2021-42258 Crítica · 9.8 KEV Urgente · 89 Exploit público Ransomware CWE-89 22/10/2021

BQE BillQuick Web Suite SQL Injection Vulnerability

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

CVE-2021-30807 Alta · 7.8 KEV Alta · 62 Exploit público CWE-787 19/10/2021

Apple Multiple Products Memory Corruption Vulnerability

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.5.1, iOS 14.7.1 and iPadOS 14.7.1, watchOS 7.6.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

CVE-2021-27561 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-78 15/10/2021

Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability

Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.

CVE-2021-20123 Alta · 7.5 KEV Alta · 63 Exploit público CWE-22 13/10/2021

Draytek VigorConnect Path Traversal Vulnerability

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

CVE-2021-20124 Alta · 7.5 KEV Alta · 63 Exploit público CWE-22 13/10/2021

Draytek VigorConnect Path Traversal Vulnerability

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

CVE-2021-41357 Alta · 7.8 KEV Alta · 52 12/10/2021

Microsoft Win32k Privilege Escalation Vulnerability

Win32k Elevation of Privilege Vulnerability

CVE-2021-40449 Alta · 7.8 KEV Urgente · 84 Exploit público Ransomware CWE-416 12/10/2021

Microsoft Windows Win32k Privilege Escalation Vulnerability

Win32k Elevation of Privilege Vulnerability

CVE-2021-40450 Alta · 7.8 KEV Alta · 52 12/10/2021

Microsoft Win32k Privilege Escalation Vulnerability

Win32k Elevation of Privilege Vulnerability

CVE-2021-37975 Alta · 8.8 KEV Alta · 62 Exploit público CWE-416 08/10/2021

Google Chromium V8 Use-After-Free Vulnerability

Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2021-37973 Crítica · 9.6 KEV Alta · 59 CWE-416 08/10/2021

Google Chromium Portals Use-After-Free Vulnerability

Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVE-2021-37976 Média · 6.5 KEV Alta · 53 CWE-862 08/10/2021

Google Chromium Information Disclosure Vulnerability

Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVE-2021-30633 Crítica · 9.6 KEV Alta · 60 CWE-416 08/10/2021

Google Chromium Indexed DB API Use-After-Free Vulnerability

Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVE-2021-30632 Alta · 8.8 KEV Alta · 62 Exploit público CWE-787 08/10/2021

Google Chromium V8 Out-of-Bounds Write Vulnerability

Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2021-42013 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-22 07/10/2021

Apache HTTP Server Path Traversal Vulnerability

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

CVE-2021-25489 Média · 5.5 KEV Alta · 45 CWE-134 06/10/2021

Samsung Mobile Devices Improper Input Validation Vulnerability

Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic.

CVE-2021-25487 Alta · 7.8 KEV Alta · 49 CWE-125 06/10/2021

Samsung Mobile Devices Out-of-Bounds Read Vulnerability

Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid function pointer.

CVE-2021-39226 Alta · 7.3 KEV Alta · 63 Exploit público CWE-862 05/10/2021

Grafana Authentication Bypass Vulnerability

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.

CVE-2021-41773 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-22 05/10/2021

Apache HTTP Server Path Traversal Vulnerability

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

CVE-2021-20035 Média · 6.5 KEV Alta · 52 CWE-78 27/09/2021

SonicWall SMA100 Appliances OS Command Injection Vulnerability

Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS.

CVE-2021-40655 Alta · 7.5 KEV Alta · 60 Exploit público CWE-863 24/09/2021

D-Link DIR-605 Router Information Disclosure Vulnerability

An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page

CVE-2021-22017 Média · 5.3 KEV Alta · 60 Exploit público 23/09/2021

VMware vCenter Server Improper Access Control

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.

CVE-2021-22941 Crítica · 9.8 KEV Urgente · 79 Exploit público Ransomware CWE-284 23/09/2021

Citrix ShareFile Improper Access Control Vulnerability

Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.

CVE-2021-22005 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-22 23/09/2021

VMware vCenter Server File Upload Vulnerability

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.

CVE-2021-36260 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-78 22/09/2021

Hikvision Improper Input Validation

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

CVE-2021-38406 Alta · 7.8 KEV Alta · 56 CWE-787 17/09/2021

Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.