auren-research/cyber-sec huggingface dataset:
cveID: CVE-2019-3929
vendorProject: Crestron
product: Multiple Products
vulnerabilityName: Crestron Multiple Products Command Injection Vulnerability
dateAdded: 2022-04-15
shortDescription: Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-06
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-3929
cwes: CWE-79
cveID: CVE-2019-16057
vendorProject: D-Link
product: DNS-320 Storage Device
vulnerabilityName: D-Link DNS-320 Remote Code Execution Vulnerability
dateAdded: 2022-04-15
shortDescription: The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-05-06
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-16057
cwes: CWE-78
cveID: CVE-2018-7841
vendorProject: Schneider Electric
product: U.motion Builder
vulnerabilityName: Schneider Electric U.motion Builder SQL Injection Vulnerability
dateAdded: 2022-04-15
shortDescription: A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-05-06
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-7841
cwes: CWE-89
cveID: CVE-2016-4523
vendorProject: Trihedral
product: VTScada (formerly VTS)
vulnerabilityName: Trihedral VTScada (formerly VTS) Denial-of-Service Vulnerability
dateAdded: 2022-04-15
shortDescription: The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS).
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-06
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2016-4523
cwes: CWE-119
cveID: CVE-2014-0780
vendorProject: InduSoft
product: Web Studio
vulnerabilityName: InduSoft Web Studio NTWebServer Directory Traversal Vulnerability
dateAdded: 2022-04-15
shortDescription: InduSoft Web Studio NTWebServer contains a directory traversal vulnerability that allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-06
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2014-0780
cwes: CWE-22
cveID: CVE-2010-5330
vendorProject: Ubiquiti
product: AirOS
vulnerabilityName: Ubiquiti AirOS Command Injection Vulnerability
dateAdded: 2022-04-15
shortDescription: Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-06
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2010-5330
cwes: CWE-77
cveID: CVE-2007-3010
vendorProject: Alcatel
product: OmniPCX Enterprise
vulnerabilityName: Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
dateAdded: 2022-04-15
shortDescription: masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-06
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2007-3010
cwes: CWE-20
cveID: CVE-2022-22954
vendorProject: VMware
product: Workspace ONE Access and Identity Manager
vulnerabilityName: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
dateAdded: 2022-04-14
shortDescription: VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-05
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-22954
cwes: CWE-94
cveID: CVE-2022-24521
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
dateAdded: 2022-04-13
shortDescription: Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-04
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-24521
cwes: CWE-787
CWE-1285
cveID: CVE-2018-7602
vendorProject: Drupal
product: Core
vulnerabilityName: Drupal Core Remote Code Execution Vulnerability
dateAdded: 2022-04-13
shortDescription: A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-04
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-7602
cveID: CVE-2018-20753
vendorProject: Kaseya
product: Virtual System/Server Administrator (VSA)
vulnerabilityName: Kaseya VSA Remote Code Execution Vulnerability
dateAdded: 2022-04-13
shortDescription: Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-04
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-20753
cveID: CVE-2015-5123
vendorProject: Adobe
product: Flash Player
vulnerabilityName: Adobe Flash Player Use-After-Free Vulnerability
dateAdded: 2022-04-13
shortDescription: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-05-04
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2015-5123
cwes: CWE-416
cveID: CVE-2015-5122
vendorProject: Adobe
product: Flash Player
vulnerabilityName: Adobe Flash Player Use-After-Free Vulnerability
dateAdded: 2022-04-13
shortDescription: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-05-04
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2015-5122
cwes: CWE-416
cveID: CVE-2015-3113
vendorProject: Adobe
product: Flash Player
vulnerabilityName: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
dateAdded: 2022-04-13
shortDescription: Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-05-04
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2015-3113
cwes: CWE-119
cveID: CVE-2015-2502
vendorProject: Microsoft
product: Internet Explorer
vulnerabilityName: Microsoft Internet Explorer Memory Corruption Vulnerability
dateAdded: 2022-04-13
shortDescription: Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-04
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2015-2502
cwes: CWE-119
cveID: CVE-2015-0313
vendorProject: Adobe
product: Flash Player
vulnerabilityName: Adobe Flash Player Use-After-Free Vulnerability
dateAdded: 2022-04-13
shortDescription: Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-05-04
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2015-0313
cwes: CWE-416
cveID: CVE-2015-0311
vendorProject: Adobe
product: Flash Player
vulnerabilityName: Adobe Flash Player Remote Code Execution Vulnerability
dateAdded: 2022-04-13
shortDescription: Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-05-04
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2015-0311
cveID: CVE-2014-9163
vendorProject: Adobe
product: Flash Player
vulnerabilityName: Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
dateAdded: 2022-04-13
shortDescription: Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-05-04
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2014-9163
cveID: CVE-2022-23176
vendorProject: WatchGuard
product: Firebox and XTM
vulnerabilityName: WatchGuard Firebox and XTM Privilege Escalation Vulnerability
dateAdded: 2022-04-11
shortDescription: WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-02
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-23176
cveID: CVE-2021-42287
vendorProject: Microsoft
product: Active Directory
vulnerabilityName: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
dateAdded: 2022-04-11
shortDescription: Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-02
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-42287
cwes: CWE-269
cveID: CVE-2021-42278
vendorProject: Microsoft
product: Active Directory
vulnerabilityName: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
dateAdded: 2022-04-11
shortDescription: Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-02
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-42278
cwes: CWE-20
cveID: CVE-2021-39793
vendorProject: Google
product: Pixel
vulnerabilityName: Google Pixel Out-of-Bounds Write Vulnerability
dateAdded: 2022-04-11
shortDescription: Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-02
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-39793
cwes: CWE-787
cveID: CVE-2021-27852
vendorProject: Checkbox
product: Checkbox Survey
vulnerabilityName: Checkbox Survey Deserialization of Untrusted Data Vulnerability
dateAdded: 2022-04-11
shortDescription: Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.
requiredAction: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.
dueDate: 2022-05-02
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-27852
cwes: CWE-502
cveID: CVE-2021-22600
vendorProject: Linux
product: Kernel
vulnerabilityName: Linux Kernel Privilege Escalation Vulnerability
dateAdded: 2022-04-11
shortDescription: Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-02
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-22600
cwes: CWE-415
cveID: CVE-2020-2509
vendorProject: QNAP
product: QNAP Network-Attached Storage (NAS)
vulnerabilityName: QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
dateAdded: 2022-04-11
shortDescription: QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-02
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-2509
cwes: CWE-77
CWE-78
cveID: CVE-2017-11317
vendorProject: Telerik
product: User Interface (UI) for ASP.NET AJAX
vulnerabilityName: Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability
dateAdded: 2022-04-11
shortDescription: Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-05-02
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-11317
cwes: CWE-326
cveID: CVE-2021-3156
vendorProject: Sudo
product: Sudo
vulnerabilityName: Sudo Heap-Based Buffer Overflow Vulnerability
dateAdded: 2022-04-06
shortDescription: Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-27
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-3156
cwes: CWE-122
CWE-193
cveID: CVE-2021-31166
vendorProject: Microsoft
product: HTTP Protocol Stack
vulnerabilityName: Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability
dateAdded: 2022-04-06
shortDescription: Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-27
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-31166
cwes: CWE-416
cveID: CVE-2017-0148
vendorProject: Microsoft
product: SMBv1 server
vulnerabilityName: Microsoft SMBv1 Server Remote Code Execution Vulnerability
dateAdded: 2022-04-06
shortDescription: The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-27
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2017-0148
cwes: CWE-20
cveID: CVE-2022-22965
vendorProject: VMware
product: Spring Framework
vulnerabilityName: Spring Framework JDK 9+ Remote Code Execution Vulnerability
dateAdded: 2022-04-04
shortDescription: Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-25
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-22965
cwes: CWE-94
cveID: CVE-2022-22675
vendorProject: Apple
product: macOS
vulnerabilityName: Apple macOS Out-of-Bounds Write Vulnerability
dateAdded: 2022-04-04
shortDescription: macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-25
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-22675
cwes: CWE-20
CWE-125
cveID: CVE-2022-22674
vendorProject: Apple
product: macOS
vulnerabilityName: Apple macOS Out-of-Bounds Read Vulnerability
dateAdded: 2022-04-04
shortDescription: macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-25
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-22674
cwes: CWE-20
CWE-125
cveID: CVE-2021-45382
vendorProject: D-Link
product: Multiple Routers
vulnerabilityName: D-Link Multiple Routers Remote Code Execution Vulnerability
dateAdded: 2022-04-04
shortDescription: A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-04-25
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-45382
cwes: CWE-78
cveID: CVE-2022-26871
vendorProject: Trend Micro
product: Apex Central
vulnerabilityName: Trend Micro Apex Central Arbitrary File Upload Vulnerability
dateAdded: 2022-03-31
shortDescription: An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-21
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-26871
cwes: CWE-184
cveID: CVE-2022-1040
vendorProject: Sophos
product: Firewall
vulnerabilityName: Sophos Firewall Authentication Bypass Vulnerability
dateAdded: 2022-03-31
shortDescription: An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-21
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-1040
cwes: CWE-158
cveID: CVE-2021-34484
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows User Profile Service Privilege Escalation Vulnerability
dateAdded: 2022-03-31
shortDescription: Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-21
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-34484
cwes: CWE-269
cveID: CVE-2021-28799
vendorProject: QNAP
product: Network Attached Storage (NAS)
vulnerabilityName: QNAP NAS Improper Authorization Vulnerability
dateAdded: 2022-03-31
shortDescription: QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-21
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-28799
cwes: CWE-285
cveID: CVE-2021-21551
vendorProject: Dell
product: dbutil Driver
vulnerabilityName: Dell dbutil Driver Insufficient Access Control Vulnerability
dateAdded: 2022-03-31
shortDescription: Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-21
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-21551
cwes: CWE-782
cveID: CVE-2018-10562
vendorProject: Dasan
product: Gigabit Passive Optical Network (GPON) Routers
vulnerabilityName: Dasan GPON Routers Command Injection Vulnerability
dateAdded: 2022-03-31
shortDescription: Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-04-21
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-10562
cwes: CWE-78
cveID: CVE-2018-10561
vendorProject: Dasan
product: Gigabit Passive Optical Network (GPON) Routers
vulnerabilityName: Dasan GPON Routers Authentication Bypass Vulnerability
dateAdded: 2022-03-31
shortDescription: Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-04-21
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-10561
cwes: CWE-287
cveID: CVE-2022-1096
vendorProject: Google
product: Chromium V8
vulnerabilityName: Google Chromium V8 Type Confusion Vulnerability
dateAdded: 2022-03-28
shortDescription: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-1096
cwes: CWE-843
cveID: CVE-2022-0543
vendorProject: Redis
product: Debian-specific Redis Servers
vulnerabilityName: Debian-specific Redis Server Lua Sandbox Escape Vulnerability
dateAdded: 2022-03-28
shortDescription: Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-0543
cwes: CWE-862
cveID: CVE-2021-38646
vendorProject: Microsoft
product: Office
vulnerabilityName: Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
dateAdded: 2022-03-28
shortDescription: Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-18
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-38646
cveID: CVE-2021-34486
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Event Tracing Privilege Escalation Vulnerability
dateAdded: 2022-03-28
shortDescription: Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-34486
cwes: CWE-416
cveID: CVE-2021-26085
vendorProject: Atlassian
product: Confluence Server
vulnerabilityName: Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability
dateAdded: 2022-03-28
shortDescription: Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-18
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-26085
cwes: CWE-425
cveID: CVE-2021-20028
vendorProject: SonicWall
product: Secure Remote Access (SRA)
vulnerabilityName: SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability
dateAdded: 2022-03-28
shortDescription: SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-04-18
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-20028
cwes: CWE-89
cveID: CVE-2019-7483
vendorProject: SonicWall
product: SMA100
vulnerabilityName: SonicWall SMA100 Directory Traversal Vulnerability
dateAdded: 2022-03-28
shortDescription: In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-04-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-7483
cwes: CWE-22