Report Name: Qualys TOP 20 2023 reportGenerated: 2023-09-07 13:20:16
| Product Name | Prevalence | U | C | H | M | L | A | Comment |
|---|---|---|---|---|---|---|---|---|
| Windows SMB | 1 | 3 | 3 | Windows component | ||||
| Apache Log4j2 | 0.9 | 1 | 1 | Log4j2 is revamped version of Apache Logging framework | ||||
| GNU Bash | 0.9 | 1 | 1 | Bash is the shell, or command language interpreter, for the GNU operating system | ||||
| Microsoft Exchange | 0.8 | 4 | 4 | Microsoft Exchange Server is a mail server and calendaring server developed by Microsoft | ||||
| Microsoft Office | 0.8 | 4 | 1 | 5 | Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer | |||
| Netlogon Remote Protocol | 0.8 | 1 | 1 | The Netlogon Remote Protocol is a remote procedure call (RPC) interface that is used for user and machine authentication on domain-based networks | ||||
| Windows VBScript Engine | 0.8 | 1 | 1 | Windows component | ||||
| Citrix Application Delivery Controller | 0.7 | 1 | 1 | Citrix Application Delivery Controller (ADC) is an advanced load balancer with features that enhance the performance of applications | ||||
| Confluence Server | 0.7 | 1 | 1 | Confluence is a web-based corporate wiki | ||||
| Pulse Connect Secure | 0.7 | 1 | 1 | Pulse Connect Secure provides a seamless, cost-effective, SSL VPN solution for remote and mobile users from any web- enabled device to corporate resources | ||||
| Oracle Java SE | 0.6 | 1 | 1 | 2 | Oracle Java SE | |||
| FortiOS | 0.5 | 1 | 1 | FortiOS is Fortinet's operating system used in their hardware, such as the Fortigate firewall and switches | ||||
| Microsoft Silverlight | 0.5 | 1 | 1 | Microsoft Silverlight | ||||
| Oracle WebLogic Server | 0.4 | 1 | 1 | Unified and extensible platform for developing, deploying and running enterprise applications |
| Vulnerability Type | Criticality | U | C | H | M | L | A |
|---|---|---|---|---|---|---|---|
| Remote Code Execution | 1.0 | 14 | 1 | 15 | |||
| Arbitrary File Reading | 0.95 | 1 | 1 | ||||
| Authentication Bypass | 0.95 | 1 | 1 | ||||
| Security Feature Bypass | 0.9 | 1 | 1 | ||||
| Denial of Service | 0.7 | 1 | 1 | ||||
| Elevation of Privilege | 0.5 | 2 | 2 | ||||
| Path Traversal | 0.4 | 2 | 2 | ||||
| Unknown Vulnerability Type | 0 | 1 | 1 |
| Source | U | C | H | M | L | A |
|---|---|---|---|---|---|---|
| Comment | 22 | 2 | 24 |
1. 
Remote Code Execution - Apache Log4j2 (CVE-2021-44228) - Urgent [983]
Description: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can
| Component | Value | Weight | Comment |
|---|---|---|---|
| 1.0 | 18 | Exploitation in the wild is mentioned on Vulners (CISA object, CISA object, CISA object), AttackerKB, Microsoft websites | |
| 1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([packetstorm] Log4Shell HTTP Header Injection, [packetstorm] Intel Data Center Manager 5.1 Local Privilege Escalation, [packetstorm] MobileIron Log4Shell Remote Command Execution) | |
| 1.0 | 15 | Remote Code Execution | |
| 0.9 | 14 | Log4j2 is revamped version of Apache Logging framework | |
| 1.0 | 10 | CVSS Base Score is 10.0. According to Vulners data source | |
| 1.0 | 10 | EPSS Probability is 0.97566, EPSS Percentile is 0.99997 |
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 10. CVE-2021-44228: Apache Log4j Remote Code Execution Vulnerability Vulnerability Trending Over Years: 2021, 2022, 2023 (77 times) It was exploited by 10 Malware, 26 Threat Actors, and 5 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 376157, 730297 In the “Top 12 Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2021-44228, or “Log4Shell,” is a severe vulnerability in Apache’s log4j Java library. The flaw exploits the ‘lookups’ feature of log4j, enabling an attacker to use a specially crafted input to trigger the execution of a remote Java class on an LDAP server, leading to Remote Code Execution. This issue is highly dangerous if the user input containing specific characters is logged by log4j. It can trigger Java method lookup, resulting in the execution of a user-defined remote Java class on an LDAP server, leading to Remote Code Execution (RCE) on the server running the vulnerable log4j instance.
2. Remote Code Execution - GNU Bash (CVE-2014-6271) - Urgent [983]
Description: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 11. CVE-2014-6271: Shellshock – Linux Bash Vulnerability Vulnerability Trending Over Years: 2014, 2016, 2017, 2020, 2021, 2022, 2023 (70 times) It was exploited by 18 Malware, 1 Threat Actors, and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 122693, 13038, 150134 Shellshock (CVE-2014-6271) is a critical vulnerability affecting the Unix Bash shell in many Linux, Unix, and Mac OS systems. It allows remote code execution by misusing Bash’s processing of environment variables, enabling attackers to append and execute malicious commands. It has a high severity score since it can impact multiple devices and applications, risking unauthorized data access or service disruption,
3. Remote Code Execution - Windows SMB (CVE-2017-0143) - Urgent [976]
Description: The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 6. CVE-2017-0144, CVE-2017-0145, CVE-2017-0143: Windows SMBv1 Remote Code Execution Vulnerability WannaCry, Petya Vulnerability Trending Over Years: 2017, 2020, 2021, 2023 (50 times) It was exploited by 12 Malware, 10 Threat Actors, and 12 Ransomware and was trending in the wild as recently as September 1, 2023. Qualys Vulnerability Detection (QID): 91361, 91360, 91359, 91345 Commonly known as Shadow Broker or MS17-010, or “ETERNALBLUE,” or “ETERNALSYNERGY” or “ETERNAL ROMANCE” is a remote code execution vulnerability in Microsoft’s Server Message Block 1.0 (SMBv1) protocol. The vulnerability arises from how SMBv1 handles specific requests, allowing an attacker(usually authenticated) to send a specially crafted packet to an SMBv1 server, enabling them to execute code on the target server. It was infamously exploited in the widespread WannaCry ransomware attack in 2017, leading to global data encryption and ransom demands.
4. Remote Code Execution - Windows SMB (CVE-2017-0144) - Urgent [976]
Description: The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 6. CVE-2017-0144, CVE-2017-0145, CVE-2017-0143: Windows SMBv1 Remote Code Execution Vulnerability WannaCry, Petya Vulnerability Trending Over Years: 2017, 2020, 2021, 2023 (50 times) It was exploited by 12 Malware, 10 Threat Actors, and 12 Ransomware and was trending in the wild as recently as September 1, 2023. Qualys Vulnerability Detection (QID): 91361, 91360, 91359, 91345 Commonly known as Shadow Broker or MS17-010, or “ETERNALBLUE,” or “ETERNALSYNERGY” or “ETERNAL ROMANCE” is a remote code execution vulnerability in Microsoft’s Server Message Block 1.0 (SMBv1) protocol. The vulnerability arises from how SMBv1 handles specific requests, allowing an attacker(usually authenticated) to send a specially crafted packet to an SMBv1 server, enabling them to execute code on the target server. It was infamously exploited in the widespread WannaCry ransomware attack in 2017, leading to global data encryption and ransom demands.
5. Remote Code Execution - Windows SMB (CVE-2017-0145) - Urgent [976]
Description: The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 6. CVE-2017-0144, CVE-2017-0145, CVE-2017-0143: Windows SMBv1 Remote Code Execution Vulnerability WannaCry, Petya Vulnerability Trending Over Years: 2017, 2020, 2021, 2023 (50 times) It was exploited by 12 Malware, 10 Threat Actors, and 12 Ransomware and was trending in the wild as recently as September 1, 2023. Qualys Vulnerability Detection (QID): 91361, 91360, 91359, 91345 Commonly known as Shadow Broker or MS17-010, or “ETERNALBLUE,” or “ETERNALSYNERGY” or “ETERNAL ROMANCE” is a remote code execution vulnerability in Microsoft’s Server Message Block 1.0 (SMBv1) protocol. The vulnerability arises from how SMBv1 handles specific requests, allowing an attacker(usually authenticated) to send a specially crafted packet to an SMBv1 server, enabling them to execute code on the target server. It was infamously exploited in the widespread WannaCry ransomware attack in 2017, leading to global data encryption and ransom demands.
6. Remote Code Execution - Microsoft Exchange (CVE-2021-26855) - Urgent [954]
Description: Microsoft
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 17. CVE-2021-26855: Microsoft Exchange Server Authentication Bypass (RCE) Vulnerability Trending Over Years: 2021, 2023 (46 times) It was exploited by 19 Malware, 22 Threat Actors, and 9 Ransomware and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 50107, 50108 In the “Additional Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2021-26855, a part of the ProxyLogon exploit chain, is a server-side request forgery (SSRF) vulnerability in Microsoft Exchange Server that enables attackers to bypass authentication mechanisms and impersonate users. The flaw allows arbitrary HTTP requests, granting access to users’ mailboxes and enabling information theft. It has been widely exploited by various threat actors, leading to emergency patches by Microsoft.
7. Remote Code Execution - Microsoft Exchange (CVE-2021-34473) - Urgent [954]
Description: Microsoft
| Component | Value | Weight | Comment |
|---|---|---|---|
| 1.0 | 18 | Exploitation in the wild is mentioned on Vulners (AttackerKB object, CISA object), AttackerKB websites | |
| 1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([packetstorm] Microsoft Exchange ProxyShell Remote Code Execution, [metasploit] Microsoft Exchange ProxyShell RCE, [zdt] Microsoft Exchange ProxyShell Remote Code Execution Exploit, [seebug] Exchange ProxyOracle 信息泄露漏洞利用链（CVE-2021-31195、 CVE-2021-31196）) | |
| 1.0 | 15 | Remote Code Execution | |
| 0.8 | 14 | Microsoft Exchange Server is a mail server and calendaring server developed by Microsoft | |
| 0.9 | 10 | CVSS Base Score is 9.1. According to Microsoft data source | |
| 1.0 | 10 | EPSS Probability is 0.97443, EPSS Percentile is 0.99915 |
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 8. CVE-2021-34473, CVE-2021-34523, CVE-2021-31207: Microsoft Exchange Server RCE (ProxyShell) Vulnerability Trending Over Years: 2021, 2022, 2023 (39 times) It was exploited by 12 Malware, 20 Threat Actors, and 12 Ransomware and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 50114, 50111, 50112 In the “Top 12 Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. ProxyShell, a chain of vulnerabilities that impacts on-premises Microsoft Exchange Servers, is widely used for email and associated services globally. These vulnerabilities exist in the Microsoft Client Access Service (CAS), typically running on port 443 in IIS, often exposed to the internet to allow users to access their email remotely. This exposure has led to widespread exploitation by threat actors deploying web shells to execute arbitrary code on compromised devices. They allow an actor to bypass authentication and execute code as a privileged user.
8. Remote Code Execution - Microsoft Office (CVE-2012-0158) - Urgent [954]
Description: The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in
| Component | Value | Weight | Comment |
|---|---|---|---|
| 1.0 | 18 | Exploitation in the wild is mentioned on Vulners (AttackerKB object), AttackerKB websites | |
| 1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([saint] Microsoft Windows Common Controls MSCOMCTL.OCX Vulnerability, [saint] Microsoft Windows Common Controls MSCOMCTL.OCX Vulnerability, [saint] Microsoft Windows Common Controls MSCOMCTL.OCX Vulnerability, [saint] Microsoft Windows Common Controls MSCOMCTL.OCX Vulnerability, [canvas] Immunity Canvas: MS12_027, [packetstorm] MS12-027 MSCOMCTL ActiveX Buffer Overflow, [seebug] Microsoft Office 内存损坏漏洞(CVE-2015-1641)) | |
| 1.0 | 15 | Remote Code Execution | |
| 0.8 | 14 | Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer | |
| 0.9 | 10 | CVSS Base Score is 9.3. According to Vulners data source | |
| 1.0 | 10 | EPSS Probability is 0.97286, EPSS Percentile is 0.99785 |
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 3. CVE-2012-0158: Vulnerability in Windows Common Controls Could Allow RCE Vulnerability Trending Over Years: 2013, 2020, 2021, 2023 (33 times) It was exploited by 63 Malware, 45 Threat Actors, 2 Ransomware and was trending in the wild as recently as August 31, 2023. Qualys Vulnerability Detection (QID): 90793 CVE-2012-0158 is a substantial remote code execution vulnerability in Windows standard controls. An attacker can exploit the flaw by constructing a specially crafted webpage. Upon viewing this webpage, the vulnerability can allow remote code execution, potentially granting the attacker the same rights as the logged-on user. If the user has administrative privileges, this could mean total control of the affected system. Disclosed in 2012, this vulnerability has been notably exploited in various cyber-attacks, enabling attackers to install programs, manipulate data, or create new accounts with full user rights.
9. Remote Code Execution - Confluence Server (CVE-2021-26084) - Urgent [950]
Description: In affected versions of
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 20. CVE-2021-26084: Atlassian Confluence Server Webwork OGNL Injection RCE Vulnerability Vulnerability Trending Over Years: 2021, 2022, 2023 (35 times) It was exploited by 8 Malware, 6 Threat Actors, and 8 Ransomware and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 730172, 150368, 375839 In the “Top 12 Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2021-26084 is a critical vulnerability in Atlassian’s Confluence Server and Data Center, specifically within the Webwork OGNL component. This vulnerability can enable an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance, potentially compromising system integrity.
10. Remote Code Execution - Microsoft Office (CVE-2017-11882) - Urgent [942]
Description:
| Component | Value | Weight | Comment |
|---|---|---|---|
| 1.0 | 18 | Exploitation in the wild is mentioned on Vulners (AttackerKB object), AttackerKB websites | |
| 1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([exploitpack] Microsoft Office - OLE Remote Code Execution, [metasploit] Microsoft Office CVE-2017-11882) | |
| 1.0 | 15 | Remote Code Execution | |
| 0.8 | 14 | Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer | |
| 0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
| 1.0 | 10 | EPSS Probability is 0.97464, EPSS Percentile is 0.99935 |
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 1. CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability Vulnerability Trending Over Years: 2018, 2020, 2021, 2022, 2023 (79 times) It was exploited by 467 Malware, 53 Threat Actors, and 14 Ransomware and was trending in the wild as recently as August 31, 2023. In the “Additional Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. Qualys Vulnerability Detection (QID): 110308 Disclosed in 2017, CVE-2017-11882 is a significant memory corruption vulnerability in Microsoft Office’s Equation Editor. It could enable an attacker to execute arbitrary code under the current user’s permissions. If the user has administrative rights, the attacker could gain complete control of the system, install programs, alter data, or create new user accounts with full privileges. This vulnerability will be exploited if the user opens a specially crafted file, potentially sent via email or hosted on a compromised website. It’s been primarily exploited in various cyber-attacks and espionage campaigns.
11. Remote Code Execution - Microsoft Office (CVE-2017-8570) - Urgent [942]
Description:
| Component | Value | Weight | Comment |
|---|---|---|---|
| 1.0 | 18 | Exploitation in the wild is mentioned on Vulners (AttackerKB object), AttackerKB websites | |
| 1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([zdt] Microsoft Office - Composite Moniker Remote Code Execution Exploit, [exploitpack] Microsoft Office - Composite Moniker Remote Code Execution, [exploitdb] Microsoft Office - 'Composite Moniker Remote Code Execution, [canvas] Immunity Canvas: OFFICE_WSDL) | |
| 1.0 | 15 | Remote Code Execution | |
| 0.8 | 14 | Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer | |
| 0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
| 1.0 | 10 | EPSS Probability is 0.97337, EPSS Percentile is 0.9982 |
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 4. CVE-2017-8570: Microsoft Office Remote Code Execution Vulnerability Vulnerability Trending Over Years: 2018, 2020, 2023 (25 times) It was exploited by 52 Malware 11 Threat Actors and was trending in the wild as recently as September 2, 2023 Qualys Vulnerability Detection (QID): 110300 CVE-2017-8570 is a significant remote code execution vulnerability in Microsoft Office and WordPad. It involves the way these applications handle specially crafted files. It can be exploited by an attacker who convinces a user to open a specially designed file, potentially allowing the attacker to run arbitrary code on the victim’s machine with the same privileges as the logged-in user and serving as a downloader to other high-profile malware.
12. Remote Code Execution - Windows VBScript Engine (CVE-2018-8174) - Urgent [942]
Description: A
| Component | Value | Weight | Comment |
|---|---|---|---|
| 1.0 | 18 | Exploitation in the wild is mentioned on Vulners (AttackerKB object), AttackerKB, Microsoft websites | |
| 1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([packetstorm] Microsoft Internet Explorer 11 Vbscript Code Execution, [zdt] Microsoft Internet Explorer 11 #InternetExplorer #IE (#Windows7 x64/x86) - vbscript Code Execution E, [srcincite] SRC-2019-0009 : Foxit Reader SDK ActiveX Launch Action New Window Command Injection Remote Code Execution Vulnerability, [srcincite] SRC-2019-0010 : Foxit Reader SDK ActiveX URI Parsing Stack Based Buffer Overflow Remote Code Execution Vulnerability) | |
| 1.0 | 15 | Remote Code Execution | |
| 0.8 | 14 | Windows component | |
| 0.8 | 10 | CVSS Base Score is 7.5. According to Microsoft data source | |
| 1.0 | 10 | EPSS Probability is 0.97445, EPSS Percentile is 0.99917 |
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 12. CVE-2018-8174: Windows VBScript Engine Remote Code Execution Vulnerability Vulnerability Trending Over Years: 2018, 2020, 2023 (30 times) It was exploited by 21 Malware, 10 Threat Actors, and 7 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 91447 CVE-2018-8174 is a critical vulnerability in Microsoft Windows’ VBScript Engine, enabling remote code execution. Triggered by viewing a malicious website with Internet Explorer or opening a rigged Microsoft Office document, this flaw allows an attacker to manipulate memory objects and execute code. The attacker can fully control the system if the user has administrative rights.
13. 
Arbitrary File Reading - Pulse Connect Secure (CVE-2019-11510) - Urgent [941]
Description: In Pulse Secure
| Component | Value | Weight | Comment |
|---|---|---|---|
| 1.0 | 18 | Exploitation in the wild is mentioned on Vulners (AttackerKB object), AttackerKB websites | |
| 1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([zdt] Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN - Arbitrary File Disclosure Exploit, [exploitpack] Pulse Secure 8.1R15.18.28.39.0 SSL VPN - Arbitrary File Disclosure (Metasploit), [packetstorm] Pulse Secure SSL VPN 8.1R15.1 / 8.2 / 8.3 / 9.0 Arbitrary File Disclosure, [dsquare] Pulse Connect Secure File Disclosure, [exploitdb] Pulse Secure 8.1R15.1/8.2/8.3/9.0 SSL VPN - Arbitrary File Disclosure (Metasploit)) | |
| 0.95 | 15 | Arbitrary File Reading | |
| 0.7 | 14 | Pulse Connect Secure provides a seamless, cost-effective, SSL VPN solution for remote and mobile users from any web- enabled device to corporate resources | |
| 1.0 | 10 | CVSS Base Score is 10.0. According to Vulners data source | |
| 1.0 | 10 | EPSS Probability is 0.97226, EPSS Percentile is 0.99748 |
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 9. CVE-2019-11510: Pulse Secure Pulse Connect Secure SSL VPN Unauthenticated Path Vulnerability Trending Over Years: 2019, 2020, 2023 (53 times) It was exploited by 13 Malware, 18 Threat Actors, and 12 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 38771 In the “Additional Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2019-11510 is a critical vulnerability found in Pulse Connect Secure, a widely used VPN solution by Pulse Secure. The flaw enables an unauthenticated, remote attacker to exploit a specific endpoint and read arbitrary files on the system, including sensitive information such as private keys and user credentials. Due to its severity, It can provide an attacker with similar access to the corporate network as a legitimate user.
14. Remote Code Execution - Microsoft Office (CVE-2017-0199) - Urgent [930]
Description:
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 2. CVE-2017-0199: Microsoft Wordpad Remote Code Execution Vulnerability Vulnerability Trending Over Years: 2017, 2020, 2021, 2023 (59 times) It was exploited by 93 Malware, 53 Threat Actors, and 5 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 110297 In the “Additional Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2017-0199 is a notable remote code execution vulnerability that affects specific Microsoft Office and WordPad versions precisely when they parse specially crafted files. This vulnerability is the most favored vulnerability by malware, threat actors, and ransomware. If successfully exploited, an attacker could execute arbitrary code in the current user’s security context, potentially taking control of the system. Exploitation involves a user opening or previewing a maliciously crafted file, often sent via email. Microsoft has addressed this vulnerability by correcting how Office and WordPad parse these files and by enabling certain API functionality in Windows for further resolution.
15. 
Security Feature Bypass - Microsoft Exchange (CVE-2021-31207) - Urgent [913]
Description: Microsoft
| Component | Value | Weight | Comment |
|---|---|---|---|
| 1.0 | 18 | Exploitation in the wild is mentioned on Vulners (CISA object), AttackerKB websites | |
| 1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([packetstorm] Microsoft Exchange ProxyShell Remote Code Execution, [metasploit] Microsoft Exchange ProxyShell RCE) | |
| 0.9 | 15 | Security Feature Bypass | |
| 0.8 | 14 | Microsoft Exchange Server is a mail server and calendaring server developed by Microsoft | |
| 0.7 | 10 | CVSS Base Score is 6.6. According to Microsoft data source | |
| 1.0 | 10 | EPSS Probability is 0.97158, EPSS Percentile is 0.99692 |
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 8. CVE-2021-34473, CVE-2021-34523, CVE-2021-31207: Microsoft Exchange Server RCE (ProxyShell) Vulnerability Trending Over Years: 2021, 2022, 2023 (39 times) It was exploited by 12 Malware, 20 Threat Actors, and 12 Ransomware and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 50114, 50111, 50112 In the “Top 12 Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. ProxyShell, a chain of vulnerabilities that impacts on-premises Microsoft Exchange Servers, is widely used for email and associated services globally. These vulnerabilities exist in the Microsoft Client Access Service (CAS), typically running on port 443 in IIS, often exposed to the internet to allow users to access their email remotely. This exposure has led to widespread exploitation by threat actors deploying web shells to execute arbitrary code on compromised devices. They allow an actor to bypass authentication and execute code as a privileged user.
16. Remote Code Execution - Microsoft Silverlight (CVE-2013-0074) - Urgent [904]
Description:
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 13. CVE-2013-0074: Microsoft Silverlight Could Allow Remote Code Execution Vulnerability Trending Over Years: 2023 (8 times) It was exploited by 62 Malware 50 Ransomware and was trending in the wild as recently as August 20, 2023. Qualys Vulnerability Detection (QID): 90870 CVE-2013-0074 is a remote code execution vulnerability in Microsoft Silverlight, which permits a crafted Silverlight application to access memory unsafely, thereby leading to the execution of arbitrary code under the current user’s security context. If the user has admin rights, the attacker installs programs, alters or deletes data, or generates new accounts with full privileges. The user can be deceived into visiting a malicious website or clicking on a link, commonly through an email or instant message.
17. 
Authentication Bypass - Oracle WebLogic Server (CVE-2019-2725) - Urgent [891]
Description: Vulnerability in the
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 18. CVE-2019-2725: Oracle WebLogic Affected by Unauthenticated RCE Vulnerability Vulnerability Trending Over Years: 2019, 2020, 2022, 2023 (53 times) It was exploited by 10 Malware, 4 Threat Actors, 9 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 150267, 87386 CVE-2019-2725 is a severe remote code execution vulnerability in Oracle WebLogic Server that allows unauthenticated attackers to execute arbitrary code over a network without user interaction. It was quickly weaponized to install cryptocurrency miners.
18. 
Denial of Service - Oracle Java SE (CVE-2012-0507) - Urgent [879]
Description: Unspecified vulnerability in the Java Runtime Environment (
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 14. CVE-2012-0507: Oracle Java SE Remote Java Runtime Environment Vulnerability Vulnerability Trending Over Years: 2023 (10 times) It was exploited by 66 Malware, 3 Threat Actors, and 42 Ransomware and was trending in the wild as recently as July 26, 2023. Qualys Vulnerability Detection (QID): 119956 CVE-2012-0507 is a critical vulnerability in the Java Runtime Environment (JRE) allowing untrusted Java applets to execute arbitrary code outside the Java sandbox. Originating from a flaw in the AtomicReferenceArray class implementation, this vulnerability was exploited by Flashback Trojan in 2012. It was observed to have led to one of the most significant known malware attacks on Apple devices. Attackers can exploit this vulnerability by tricking users into visiting a malicious website hosting a Java applet.
19. 
Elevation of Privilege - Netlogon Remote Protocol (CVE-2020-1472) - Urgent [877]
Description: An elevation of privilege vulnerability exists when an attacker establishes a vulnerable
| Component | Value | Weight | Comment |
|---|---|---|---|
| 1.0 | 18 | Exploitation in the wild is mentioned on Vulners (AttackerKB object, CISA object, CISA object, CISA object), AttackerKB, AttackerKB websites | |
| 1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([metasploit] Netlogon Weak Cryptographic Authentication, [zdt] ZeroLogon - Netlogon Elevation of Privilege Exploit, [packetstorm] Zerologon Netlogon Privilege Escalation, [exploitdb] ZeroLogon - Netlogon Elevation of Privilege) | |
| 0.5 | 15 | Elevation of Privilege | |
| 0.8 | 14 | The Netlogon Remote Protocol is a remote procedure call (RPC) interface that is used for user and machine authentication on domain-based networks | |
| 1.0 | 10 | CVSS Base Score is 10.0. According to Microsoft data source | |
| 1.0 | 10 | EPSS Probability is 0.97369, EPSS Percentile is 0.99847 |
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 5. CVE-2020-1472: Zerologon – An Unauthenticated Privilege Escalation to Full Domain Privileges Vulnerability Trending Over Years: 2020, 2021, 2022, 2023 (56 times) It was exploited by 18 Malware, 16 Threat Actors, 11 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 91680 In the “Additional Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2020-1472, or Zerologon, is a severe vulnerability in Microsoft’s Netlogon Remote Protocol due to a flawed implementation of AES-CFB8 encryption. Using a fixed initialization vector and accepting unencrypted sessions allows an attacker to impersonate a server and compromise the entire Windows domain. The attacker takes control over all the Active Directory identity services.
20. Elevation of Privilege - Microsoft Exchange (CVE-2021-34523) - Urgent [865]
Description: Microsoft
| Component | Value | Weight | Comment |
|---|---|---|---|
| 1.0 | 18 | Exploitation in the wild is mentioned on Vulners (CISA object), AttackerKB websites | |
| 1.0 | 17 | The existence of a publicly available exploit is mentioned on Vulners website ([packetstorm] Microsoft Exchange ProxyShell Remote Code Execution, [metasploit] Microsoft Exchange ProxyShell RCE) | |
| 0.5 | 15 | Elevation of Privilege | |
| 0.8 | 14 | Microsoft Exchange Server is a mail server and calendaring server developed by Microsoft | |
| 0.9 | 10 | CVSS Base Score is 9.0. According to Microsoft data source | |
| 1.0 | 10 | EPSS Probability is 0.97368, EPSS Percentile is 0.9984 |
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 8. CVE-2021-34473, CVE-2021-34523, CVE-2021-31207: Microsoft Exchange Server RCE (ProxyShell) Vulnerability Trending Over Years: 2021, 2022, 2023 (39 times) It was exploited by 12 Malware, 20 Threat Actors, and 12 Ransomware and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 50114, 50111, 50112 In the “Top 12 Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. ProxyShell, a chain of vulnerabilities that impacts on-premises Microsoft Exchange Servers, is widely used for email and associated services globally. These vulnerabilities exist in the Microsoft Client Access Service (CAS), typically running on port 443 in IIS, often exposed to the internet to allow users to access their email remotely. This exposure has led to widespread exploitation by threat actors deploying web shells to execute arbitrary code on compromised devices. They allow an actor to bypass authentication and execute code as a privileged user.
21. 
Path Traversal - Citrix Application Delivery Controller (CVE-2019-19781) - Urgent [842]
Description: An issue was discovered in
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 15. CVE-2019-19781: Citrix ADC and Citrix Gateway – Remote Code Execution (RCE) Vulnerability Vulnerability Trending Over Years: 2020, 2022, 2023 (60 times) It was exploited by 11 Malware, 12 Threat Actors, and 10 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 372305, 150273 In the “Additional Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2019-19781, or “Shitrix,” is a significant vulnerability associated with Citrix Application Delivery Controller (ADC) and Citrix Gateway, allowing unauthenticated attackers to perform arbitrary code execution, granting them access to internal network resources. The flaw resides in the VPN component of the affected products, enabling directory traversal and giving attackers both read and write access to the underlying file system.
22. Path Traversal - FortiOS (CVE-2018-13379) - Urgent [809]
Description: An Improper Limitation of a Pathname to a Restricted Directory ("
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 19. CVE-2018-13379: Fortinet FortiGate (FortiOS) System File Leak through Secure Sockets Layer (SSL) Vulnerability Trending Over Years: 2020, 2021, 2023 (41 times) It was exploited by 6 Malware, 13 Threat Actors, 6 Ransomware and was trending in the wild as recently as August 30, 2023. Qualys Vulnerability Detection (QID): 43702 In the “Top 12 Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2018-13379 is a path traversal vulnerability found in the Fortinet FortiOS SSL VPN web portal. An unauthenticated attacker can read sensitive system files via specially crafted HTTP requests. The exploit could expose SSL VPN session data, leading to more severe attacks.
23. 
Unknown Vulnerability Type - Oracle Java SE (CVE-2012-1723) - Critical [754]
Description: {'ms_cve_data_all': '', 'nvd_cve_data_all': 'Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.', 'epss_cve_data_all': '', 'attackerkb_cve_data_all': '', 'vulners_cve_data_all': 'Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.', 'combined_cve_data_all': ''}
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 7. CVE-2012-1723: Java Applet Field Bytecode Verifier Cache Remote Code Execution Vulnerability Trending Over Years: 2023 (6 times) It was exploited by 91 Malware, 8 Threat Actors, 41 Ransomware and was trending in the wild as recently as August 17, 2023. Qualys Vulnerability Detection (QID): 120274 CVE-2012-1723 is a substantial vulnerability found in the Java Runtime Environment. It can be exploited through a malicious web page, hosting a rogue Java applet can be exploited through a malicious web page hosting rogue Java applet. The issue, originating from a type-confusion error in the “HotSpot” component, allows untrusted Java applets or applications to bypass the Java sandbox security restrictions and execute arbitrary code on a user’s system
24. Remote Code Execution - Microsoft Office (CVE-2018-0802) - Critical [740]
Description: Equation Editor in
| Component | Value | Weight | Comment |
|---|---|---|---|
| 1.0 | 18 | Exploitation in the wild is mentioned on Vulners (AttackerKB object), AttackerKB, Microsoft websites | |
| 0 | 17 | The exploit's existence is NOT mentioned on Vulners and Microsoft websites. | |
| 1.0 | 15 | Remote Code Execution | |
| 0.8 | 14 | Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer | |
| 0.8 | 10 | CVSS Base Score is 7.8. According to Vulners data source | |
| 1.0 | 10 | EPSS Probability is 0.97389, EPSS Percentile is 0.99869 |
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 16. CVE-2018-0802: Microsoft Office Memory Corruption Vulnerability Vulnerability Trending Over Years: 2021, 2022, 2023 (19 times) Exploited by 29 Malware 24 Threat Actors, and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 110310 CVE-2018-0802 is a critical vulnerability within Microsoft Office and WordPad, which, if exploited, allows remote code execution via specially crafted files. Attackers can run arbitrary code in the current user’s context, potentially taking over the system if the user holds administrative rights. This vulnerability was notably used in targeted attacks and was being actively exploited before Microsoft released a security update in January 2018 that correctly handles objects in memory, resolving the issue.
Remote Code Execution (15)Comment: Qualys Top 20 Most Exploited Vulnerabilities: 10. CVE-2021-44228: Apache Log4j Remote Code Execution Vulnerability Vulnerability Trending Over Years: 2021, 2022, 2023 (77 times) It was exploited by 10 Malware, 26 Threat Actors, and 5 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 376157, 730297 In the “Top 12 Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2021-44228, or “Log4Shell,” is a severe vulnerability in Apache’s log4j Java library. The flaw exploits the ‘lookups’ feature of log4j, enabling an attacker to use a specially crafted input to trigger the execution of a remote Java class on an LDAP server, leading to Remote Code Execution. This issue is highly dangerous if the user input containing specific characters is logged by log4j. It can trigger Java method lookup, resulting in the execution of a user-defined remote Java class on an LDAP server, leading to Remote Code Execution (RCE) on the server running the vulnerable log4j instance.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 11. CVE-2014-6271: Shellshock – Linux Bash Vulnerability Vulnerability Trending Over Years: 2014, 2016, 2017, 2020, 2021, 2022, 2023 (70 times) It was exploited by 18 Malware, 1 Threat Actors, and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 122693, 13038, 150134 Shellshock (CVE-2014-6271) is a critical vulnerability affecting the Unix Bash shell in many Linux, Unix, and Mac OS systems. It allows remote code execution by misusing Bash’s processing of environment variables, enabling attackers to append and execute malicious commands. It has a high severity score since it can impact multiple devices and applications, risking unauthorized data access or service disruption,
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 6. CVE-2017-0144, CVE-2017-0145, CVE-2017-0143: Windows SMBv1 Remote Code Execution Vulnerability WannaCry, Petya Vulnerability Trending Over Years: 2017, 2020, 2021, 2023 (50 times) It was exploited by 12 Malware, 10 Threat Actors, and 12 Ransomware and was trending in the wild as recently as September 1, 2023. Qualys Vulnerability Detection (QID): 91361, 91360, 91359, 91345 Commonly known as Shadow Broker or MS17-010, or “ETERNALBLUE,” or “ETERNALSYNERGY” or “ETERNAL ROMANCE” is a remote code execution vulnerability in Microsoft’s Server Message Block 1.0 (SMBv1) protocol. The vulnerability arises from how SMBv1 handles specific requests, allowing an attacker(usually authenticated) to send a specially crafted packet to an SMBv1 server, enabling them to execute code on the target server. It was infamously exploited in the widespread WannaCry ransomware attack in 2017, leading to global data encryption and ransom demands.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 8. CVE-2021-34473, CVE-2021-34523, CVE-2021-31207: Microsoft Exchange Server RCE (ProxyShell) Vulnerability Trending Over Years: 2021, 2022, 2023 (39 times) It was exploited by 12 Malware, 20 Threat Actors, and 12 Ransomware and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 50114, 50111, 50112 In the “Top 12 Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. ProxyShell, a chain of vulnerabilities that impacts on-premises Microsoft Exchange Servers, is widely used for email and associated services globally. These vulnerabilities exist in the Microsoft Client Access Service (CAS), typically running on port 443 in IIS, often exposed to the internet to allow users to access their email remotely. This exposure has led to widespread exploitation by threat actors deploying web shells to execute arbitrary code on compromised devices. They allow an actor to bypass authentication and execute code as a privileged user.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 17. CVE-2021-26855: Microsoft Exchange Server Authentication Bypass (RCE) Vulnerability Trending Over Years: 2021, 2023 (46 times) It was exploited by 19 Malware, 22 Threat Actors, and 9 Ransomware and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 50107, 50108 In the “Additional Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2021-26855, a part of the ProxyLogon exploit chain, is a server-side request forgery (SSRF) vulnerability in Microsoft Exchange Server that enables attackers to bypass authentication mechanisms and impersonate users. The flaw allows arbitrary HTTP requests, granting access to users’ mailboxes and enabling information theft. It has been widely exploited by various threat actors, leading to emergency patches by Microsoft.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 1. CVE-2017-11882: Microsoft Office Memory Corruption Vulnerability Vulnerability Trending Over Years: 2018, 2020, 2021, 2022, 2023 (79 times) It was exploited by 467 Malware, 53 Threat Actors, and 14 Ransomware and was trending in the wild as recently as August 31, 2023. In the “Additional Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. Qualys Vulnerability Detection (QID): 110308 Disclosed in 2017, CVE-2017-11882 is a significant memory corruption vulnerability in Microsoft Office’s Equation Editor. It could enable an attacker to execute arbitrary code under the current user’s permissions. If the user has administrative rights, the attacker could gain complete control of the system, install programs, alter data, or create new user accounts with full privileges. This vulnerability will be exploited if the user opens a specially crafted file, potentially sent via email or hosted on a compromised website. It’s been primarily exploited in various cyber-attacks and espionage campaigns.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 2. CVE-2017-0199: Microsoft Wordpad Remote Code Execution Vulnerability Vulnerability Trending Over Years: 2017, 2020, 2021, 2023 (59 times) It was exploited by 93 Malware, 53 Threat Actors, and 5 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 110297 In the “Additional Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2017-0199 is a notable remote code execution vulnerability that affects specific Microsoft Office and WordPad versions precisely when they parse specially crafted files. This vulnerability is the most favored vulnerability by malware, threat actors, and ransomware. If successfully exploited, an attacker could execute arbitrary code in the current user’s security context, potentially taking control of the system. Exploitation involves a user opening or previewing a maliciously crafted file, often sent via email. Microsoft has addressed this vulnerability by correcting how Office and WordPad parse these files and by enabling certain API functionality in Windows for further resolution.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 3. CVE-2012-0158: Vulnerability in Windows Common Controls Could Allow RCE Vulnerability Trending Over Years: 2013, 2020, 2021, 2023 (33 times) It was exploited by 63 Malware, 45 Threat Actors, 2 Ransomware and was trending in the wild as recently as August 31, 2023. Qualys Vulnerability Detection (QID): 90793 CVE-2012-0158 is a substantial remote code execution vulnerability in Windows standard controls. An attacker can exploit the flaw by constructing a specially crafted webpage. Upon viewing this webpage, the vulnerability can allow remote code execution, potentially granting the attacker the same rights as the logged-on user. If the user has administrative privileges, this could mean total control of the affected system. Disclosed in 2012, this vulnerability has been notably exploited in various cyber-attacks, enabling attackers to install programs, manipulate data, or create new accounts with full user rights.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 4. CVE-2017-8570: Microsoft Office Remote Code Execution Vulnerability Vulnerability Trending Over Years: 2018, 2020, 2023 (25 times) It was exploited by 52 Malware 11 Threat Actors and was trending in the wild as recently as September 2, 2023 Qualys Vulnerability Detection (QID): 110300 CVE-2017-8570 is a significant remote code execution vulnerability in Microsoft Office and WordPad. It involves the way these applications handle specially crafted files. It can be exploited by an attacker who convinces a user to open a specially designed file, potentially allowing the attacker to run arbitrary code on the victim’s machine with the same privileges as the logged-in user and serving as a downloader to other high-profile malware.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 16. CVE-2018-0802: Microsoft Office Memory Corruption Vulnerability Vulnerability Trending Over Years: 2021, 2022, 2023 (19 times) Exploited by 29 Malware 24 Threat Actors, and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 110310 CVE-2018-0802 is a critical vulnerability within Microsoft Office and WordPad, which, if exploited, allows remote code execution via specially crafted files. Attackers can run arbitrary code in the current user’s context, potentially taking over the system if the user holds administrative rights. This vulnerability was notably used in targeted attacks and was being actively exploited before Microsoft released a security update in January 2018 that correctly handles objects in memory, resolving the issue.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 20. CVE-2021-26084: Atlassian Confluence Server Webwork OGNL Injection RCE Vulnerability Vulnerability Trending Over Years: 2021, 2022, 2023 (35 times) It was exploited by 8 Malware, 6 Threat Actors, and 8 Ransomware and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 730172, 150368, 375839 In the “Top 12 Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2021-26084 is a critical vulnerability in Atlassian’s Confluence Server and Data Center, specifically within the Webwork OGNL component. This vulnerability can enable an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance, potentially compromising system integrity.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 12. CVE-2018-8174: Windows VBScript Engine Remote Code Execution Vulnerability Vulnerability Trending Over Years: 2018, 2020, 2023 (30 times) It was exploited by 21 Malware, 10 Threat Actors, and 7 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 91447 CVE-2018-8174 is a critical vulnerability in Microsoft Windows’ VBScript Engine, enabling remote code execution. Triggered by viewing a malicious website with Internet Explorer or opening a rigged Microsoft Office document, this flaw allows an attacker to manipulate memory objects and execute code. The attacker can fully control the system if the user has administrative rights.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 13. CVE-2013-0074: Microsoft Silverlight Could Allow Remote Code Execution Vulnerability Trending Over Years: 2023 (8 times) It was exploited by 62 Malware 50 Ransomware and was trending in the wild as recently as August 20, 2023. Qualys Vulnerability Detection (QID): 90870 CVE-2013-0074 is a remote code execution vulnerability in Microsoft Silverlight, which permits a crafted Silverlight application to access memory unsafely, thereby leading to the execution of arbitrary code under the current user’s security context. If the user has admin rights, the attacker installs programs, alters or deletes data, or generates new accounts with full privileges. The user can be deceived into visiting a malicious website or clicking on a link, commonly through an email or instant message.
Arbitrary File Reading (1)Comment: Qualys Top 20 Most Exploited Vulnerabilities: 9. CVE-2019-11510: Pulse Secure Pulse Connect Secure SSL VPN Unauthenticated Path Vulnerability Trending Over Years: 2019, 2020, 2023 (53 times) It was exploited by 13 Malware, 18 Threat Actors, and 12 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 38771 In the “Additional Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2019-11510 is a critical vulnerability found in Pulse Connect Secure, a widely used VPN solution by Pulse Secure. The flaw enables an unauthenticated, remote attacker to exploit a specific endpoint and read arbitrary files on the system, including sensitive information such as private keys and user credentials. Due to its severity, It can provide an attacker with similar access to the corporate network as a legitimate user.
Security Feature Bypass (1)Comment: Qualys Top 20 Most Exploited Vulnerabilities: 8. CVE-2021-34473, CVE-2021-34523, CVE-2021-31207: Microsoft Exchange Server RCE (ProxyShell) Vulnerability Trending Over Years: 2021, 2022, 2023 (39 times) It was exploited by 12 Malware, 20 Threat Actors, and 12 Ransomware and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 50114, 50111, 50112 In the “Top 12 Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. ProxyShell, a chain of vulnerabilities that impacts on-premises Microsoft Exchange Servers, is widely used for email and associated services globally. These vulnerabilities exist in the Microsoft Client Access Service (CAS), typically running on port 443 in IIS, often exposed to the internet to allow users to access their email remotely. This exposure has led to widespread exploitation by threat actors deploying web shells to execute arbitrary code on compromised devices. They allow an actor to bypass authentication and execute code as a privileged user.
Authentication Bypass (1)Comment: Qualys Top 20 Most Exploited Vulnerabilities: 18. CVE-2019-2725: Oracle WebLogic Affected by Unauthenticated RCE Vulnerability Vulnerability Trending Over Years: 2019, 2020, 2022, 2023 (53 times) It was exploited by 10 Malware, 4 Threat Actors, 9 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 150267, 87386 CVE-2019-2725 is a severe remote code execution vulnerability in Oracle WebLogic Server that allows unauthenticated attackers to execute arbitrary code over a network without user interaction. It was quickly weaponized to install cryptocurrency miners.
Denial of Service (1)Comment: Qualys Top 20 Most Exploited Vulnerabilities: 14. CVE-2012-0507: Oracle Java SE Remote Java Runtime Environment Vulnerability Vulnerability Trending Over Years: 2023 (10 times) It was exploited by 66 Malware, 3 Threat Actors, and 42 Ransomware and was trending in the wild as recently as July 26, 2023. Qualys Vulnerability Detection (QID): 119956 CVE-2012-0507 is a critical vulnerability in the Java Runtime Environment (JRE) allowing untrusted Java applets to execute arbitrary code outside the Java sandbox. Originating from a flaw in the AtomicReferenceArray class implementation, this vulnerability was exploited by Flashback Trojan in 2012. It was observed to have led to one of the most significant known malware attacks on Apple devices. Attackers can exploit this vulnerability by tricking users into visiting a malicious website hosting a Java applet.
Elevation of Privilege (2)Comment: Qualys Top 20 Most Exploited Vulnerabilities: 5. CVE-2020-1472: Zerologon – An Unauthenticated Privilege Escalation to Full Domain Privileges Vulnerability Trending Over Years: 2020, 2021, 2022, 2023 (56 times) It was exploited by 18 Malware, 16 Threat Actors, 11 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 91680 In the “Additional Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2020-1472, or Zerologon, is a severe vulnerability in Microsoft’s Netlogon Remote Protocol due to a flawed implementation of AES-CFB8 encryption. Using a fixed initialization vector and accepting unencrypted sessions allows an attacker to impersonate a server and compromise the entire Windows domain. The attacker takes control over all the Active Directory identity services.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 8. CVE-2021-34473, CVE-2021-34523, CVE-2021-31207: Microsoft Exchange Server RCE (ProxyShell) Vulnerability Trending Over Years: 2021, 2022, 2023 (39 times) It was exploited by 12 Malware, 20 Threat Actors, and 12 Ransomware and was trending in the wild as recently as September 2, 2023. Qualys Vulnerability Detection (QID): 50114, 50111, 50112 In the “Top 12 Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. ProxyShell, a chain of vulnerabilities that impacts on-premises Microsoft Exchange Servers, is widely used for email and associated services globally. These vulnerabilities exist in the Microsoft Client Access Service (CAS), typically running on port 443 in IIS, often exposed to the internet to allow users to access their email remotely. This exposure has led to widespread exploitation by threat actors deploying web shells to execute arbitrary code on compromised devices. They allow an actor to bypass authentication and execute code as a privileged user.
Path Traversal (2)Comment: Qualys Top 20 Most Exploited Vulnerabilities: 15. CVE-2019-19781: Citrix ADC and Citrix Gateway – Remote Code Execution (RCE) Vulnerability Vulnerability Trending Over Years: 2020, 2022, 2023 (60 times) It was exploited by 11 Malware, 12 Threat Actors, and 10 Ransomware and was trending in the wild as recently as September 4, 2023. Qualys Vulnerability Detection (QID): 372305, 150273 In the “Additional Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2019-19781, or “Shitrix,” is a significant vulnerability associated with Citrix Application Delivery Controller (ADC) and Citrix Gateway, allowing unauthenticated attackers to perform arbitrary code execution, granting them access to internal network resources. The flaw resides in the VPN component of the affected products, enabling directory traversal and giving attackers both read and write access to the underlying file system.
Comment: Qualys Top 20 Most Exploited Vulnerabilities: 19. CVE-2018-13379: Fortinet FortiGate (FortiOS) System File Leak through Secure Sockets Layer (SSL) Vulnerability Trending Over Years: 2020, 2021, 2023 (41 times) It was exploited by 6 Malware, 13 Threat Actors, 6 Ransomware and was trending in the wild as recently as August 30, 2023. Qualys Vulnerability Detection (QID): 43702 In the “Top 12 Routinely Exploited Vulnerabilities in 2022” list, published by CISA earlier. CVE-2018-13379 is a path traversal vulnerability found in the Fortinet FortiOS SSL VPN web portal. An unauthenticated attacker can read sensitive system files via specially crafted HTTP requests. The exploit could expose SSL VPN session data, leading to more severe attacks.
Unknown Vulnerability Type (1)Comment: Qualys Top 20 Most Exploited Vulnerabilities: 7. CVE-2012-1723: Java Applet Field Bytecode Verifier Cache Remote Code Execution Vulnerability Trending Over Years: 2023 (6 times) It was exploited by 91 Malware, 8 Threat Actors, 41 Ransomware and was trending in the wild as recently as August 17, 2023. Qualys Vulnerability Detection (QID): 120274 CVE-2012-1723 is a substantial vulnerability found in the Java Runtime Environment. It can be exploited through a malicious web page, hosting a rogue Java applet can be exploited through a malicious web page hosting rogue Java applet. The issue, originating from a type-confusion error in the “HotSpot” component, allows untrusted Java applets or applications to bypass the Java sandbox security restrictions and execute arbitrary code on a user’s system