CVE-2020-13671 — Drupal core Un-restricted Upload of File
Improper sanitization in the extension file names is present in Drupal core.
Drupal Core · Jan 18, 2022
CISA Known Exploited Vulnerabilities Directory
Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2020-13671 — Drupal core Un-restricted Upload of File
Improper sanitization in the extension file names is present in Drupal core.
|
Drupal | Drupal Core | Jan 18, 2022 | Jul 18, 2022 | |
|
CVE-2020-13927 — Apache Airflow's Experimental API Authentication Bypass
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
|
Apache | Airflow's Experimental API | Jan 18, 2022 | Jul 18, 2022 | |
|
CVE-2020-14864 — Oracle Business Intelligence Enterprise Edition Path Transversal
Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
|
Oracle | Intelligence Enterprise Edition | Jan 18, 2022 | Jul 18, 2022 | |
|
CVE-2021-21315 — System Information Library for Node.JS Command Injection
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
|
Npm package | System Information Library for Node.JS | Jan 18, 2022 | Feb 1, 2022 | |
|
CVE-2021-21975 — VMware Server Side Request Forgery in vRealize Operations Manager API
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
|
VMware | vRealize Operations Manager API | Jan 18, 2022 | Feb 1, 2022 | Ransomware |
|
CVE-2021-22991 — F5 BIG-IP Traffic Management Microkernel Buffer Overflow
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
|
F5 | BIG-IP Traffic Management Microkernel | Jan 18, 2022 | Feb 1, 2022 | |
|
CVE-2021-25296 — Nagios XI OS Command Injection
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
|
Nagios | Nagios XI | Jan 18, 2022 | Feb 1, 2022 | |
|
CVE-2021-25297 — Nagios XI OS Command Injection
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
|
Nagios | Nagios XI | Jan 18, 2022 | Feb 1, 2022 | |
|
CVE-2021-25298 — Nagios XI OS Command Injection
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
|
Nagios | Nagios XI | Jan 18, 2022 | Feb 1, 2022 | |
|
CVE-2021-32648 — October CMS Improper Authentication
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
|
October CMS | October CMS | Jan 18, 2022 | Feb 1, 2022 |
CVE-2020-13927 — Apache Airflow's Experimental API Authentication Bypass
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.
Airflow's Experimental API · Jan 18, 2022
CVE-2020-14864 — Oracle Business Intelligence Enterprise Edition Path Transversal
Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.
Intelligence Enterprise Edition · Jan 18, 2022
CVE-2021-21315 — System Information Library for Node.JS Command Injection
In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.
System Information Library for Node.JS · Jan 18, 2022
Ransomware
VMware
CVE-2021-21975 — VMware Server Side Request Forgery in vRealize Operations Manager API
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
vRealize Operations Manager API · Jan 18, 2022
CVE-2021-22991 — F5 BIG-IP Traffic Management Microkernel Buffer Overflow
The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
BIG-IP Traffic Management Microkernel · Jan 18, 2022
CVE-2021-25296 — Nagios XI OS Command Injection
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Nagios XI · Jan 18, 2022
CVE-2021-25297 — Nagios XI OS Command Injection
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Nagios XI · Jan 18, 2022
CVE-2021-25298 — Nagios XI OS Command Injection
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
Nagios XI · Jan 18, 2022
CVE-2021-32648 — October CMS Improper Authentication
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.
October CMS · Jan 18, 2022