Sep 3, 2024
1 new incident, 1 with updates.
Started
- ClosedPatched
DrayTek VigorConnect: 2 actively exploited vulnerabilities
CVE-2021-20123: Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. CVE-2021-20124: Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Added to the CISA KEV catalog on 2024-09-03. CVE-2021-20123, CVE-2021-20124 were assigned before 2024; the KEV listing came in 2024.
DrayTek VigorConnectClosed Sep 3, 2024
Updated
- ClosedPatched
Kingsoft WPS Office Path Traversal
Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library. Added to the CISA KEV catalog on 2024-09-03.
Kingsoft WPS OfficeClosed Sep 3, 2024
