Vendor: VMware | Product: Multiple Products | VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-03
CVE-2021-22005 · CISA Known Exploited Vulnerabilities
Vendor: VMware | Product: vCenter Server | VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2021-11-17
CVE-2020-3952 · CISA Known Exploited Vulnerabilities
Vendor: VMware | Product: vCenter Server | VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information. | Required action: Apply updates per vendor instructions. |…
Read full source summary
Vendor: VMware | Product: vCenter Server | VMware vCenter Server contains an information disclosure vulnerability in the VMware Directory Service (vmdir) when the Platform Services Controller (PSC) does not correctly implement access controls. Successful exploitation allows an attacker with network access to port 389 to extract sensitive information. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-03
CVE-2021-21972 · CISA Known Exploited Vulnerabilities
Vendor: VMware | Product: vCenter Server | VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2021-11-17
CVE-2021-21985 · CISA Known Exploited Vulnerabilities
Vendor: VMware | Product: vCenter Server | VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2021-11-17
CVE-2020-4006 · CISA Known Exploited Vulnerabilities
Vendor: VMware | Product: Multiple Products | VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system. |…
Read full source summary
Vendor: VMware | Product: Multiple Products | VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-03
CVE-2020-25213 · CISA Known Exploited Vulnerabilities
Vendor: WordPress | Product: Snap Creek Duplicator Plugin | WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro. | Required action: Apply updates per vendor instructions. | Federal remediation…
Read full source summary
Vendor: WordPress | Product: Snap Creek Duplicator Plugin | WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-03
CVE-2019-9978 · CISA Known Exploited Vulnerabilities
Vendor: WordPress | Product: Social Warfare Plugin | WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-03
CVE-2021-27561 · CISA Known Exploited Vulnerabilities
Vendor: Zoho | Product: ManageEngine | Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2021-11-17
CVE-2020-10189 · CISA Known Exploited Vulnerabilities
Vendor: Zyxel | Product: Multiple Products | Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocumented account ("zyfwp") with an unchangeable password. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-03
BioThreat Corporation threat monitoring workflows bring together reports published by the named source institutions. These are public-source reports; publication dates and source links accompany each record.
01 / SOURCE
Read the source
Open a feed to search titles, summaries, or CVE IDs. Follow a record’s title or the Official source link to read the reporting in its original context.
Daily snapshots are collected when a source is visited and successfully refreshed. Archive dates indicate collection dates, and the archive may contain gaps.
JSON links provide machine-readable records with source names, titles, summaries, links, and publication dates. Choose a saved date for the records collected in that snapshot.