{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1565.001 Stored Data Manipulation","home_page_url":"https://patchfirst.co/technique/T1565.001/","feed_url":"https://patchfirst.co/feed/technique/T1565.001.json","description":"New and newly exploited CVEs that lead to ATT&CK T1565.001 Stored Data Manipulation, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-104286#kev","url":"https://patchfirst.co/cve/CVE-2026-104286/","title":"[KEV] CVE-2026-104286: Fortinet FortiMail Path Traversal Vulnerability","content_text":"Fortinet · FortiMail. In CISA KEV since 2026-10-01. ENISA EUVD lists it as exploited. EPSS 4.6% (higher than 91.6% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 78.2 of 100.","summary":"Fortinet FortiMail Path Traversal Vulnerability","date_published":"2026-10-01T00:00:00.000Z","date_modified":"2026-10-28T20:09:29.000Z","tags":["kev","public-exploit","T1190","T1565.001"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2026-10-01","ransomware":false},"epss":{"score":0.04573,"percentile":0.91609},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"FortiMail","techniqueIds":["T1190","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-67279#kev","url":"https://patchfirst.co/cve/CVE-2026-67279/","title":"[KEV] CVE-2026-67279: Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","content_text":"MikroTik · RouterOS. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.1% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1565.001 Stored Data Manipulation. Priority 74.2 of 100.","summary":"Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability","date_published":"2026-09-25T00:00:00.000Z","date_modified":"2026-09-26T04:17:47.000Z","tags":["kev","public-exploit","T1190","T1059","T1565.001"],"_patchfirst":{"reason":"kev","priority":74.2,"kev":{"dateAdded":"2026-09-25","ransomware":false},"epss":{"score":0.02277,"percentile":0.83093},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"MikroTik","product":"RouterOS","techniqueIds":["T1190","T1059","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20253#kev","url":"https://patchfirst.co/cve/CVE-2026-20253/","title":"[KEV] CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function Vulnerability","content_text":"Splunk · Enterprise. In CISA KEV since 2026-06-18. ENISA EUVD lists it as exploited. EPSS 96.9% (higher than 99.89% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 74.8 of 100.","summary":"Splunk Enterprise Missing Authentication for Critical Function Vulnerability","date_published":"2026-06-18T00:00:00.000Z","date_modified":"2026-07-23T09:10:00.000Z","tags":["kev","public-exploit","T1190","T1565.001"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-06-18","ransomware":false},"epss":{"score":0.96939,"percentile":0.99888},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Splunk","product":"Enterprise","techniqueIds":["T1190","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20262#kev","url":"https://patchfirst.co/cve/CVE-2026-20262/","title":"[KEV] CVE-2026-20262: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability","content_text":"Cisco · Catalyst SD-WAN Manager. In CISA KEV since 2026-06-15. ENISA EUVD lists it as exploited. EPSS 29.1% (higher than 98.2% of CVEs). CVSS 6.5 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 72.2 of 100.","summary":"Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability","date_published":"2026-06-15T00:00:00.000Z","date_modified":"2026-07-24T19:10:00.000Z","tags":["kev","public-exploit","T1190","T1565.001"],"_patchfirst":{"reason":"kev","priority":72.2,"kev":{"dateAdded":"2026-06-15","ransomware":false},"epss":{"score":0.29116,"percentile":0.98163},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1"},"vendor":"Cisco","product":"Catalyst SD-WAN Manager","techniqueIds":["T1190","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-42208#kev","url":"https://patchfirst.co/cve/CVE-2026-42208/","title":"[KEV] CVE-2026-42208: BerriAI LiteLLM SQL Injection Vulnerability","content_text":"BerriAI · LiteLLM. In CISA KEV since 2026-05-08. ENISA EUVD lists it as exploited. EPSS 89.4% (higher than 99.78% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1565.001 Stored Data Manipulation. Priority 74.8 of 100.","summary":"BerriAI LiteLLM SQL Injection Vulnerability","date_published":"2026-05-08T00:00:00.000Z","date_modified":"2026-10-26T20:10:00.000Z","tags":["kev","public-exploit","T1190","T1005","T1565.001"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-05-08","ransomware":false},"epss":{"score":0.8942,"percentile":0.99785},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"BerriAI","product":"LiteLLM","techniqueIds":["T1190","T1005","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-20122#kev","url":"https://patchfirst.co/cve/CVE-2026-20122/","title":"[KEV] CVE-2026-20122: Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability","content_text":"Cisco · Catalyst SD-WAN Manger. In CISA KEV since 2026-04-20. ENISA EUVD lists it as exploited. EPSS 25.8% (higher than 98% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 66.4 of 100.","summary":"Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability","date_published":"2026-04-20T00:00:00.000Z","date_modified":"2026-06-17T10:17:09.000Z","tags":["kev","T1190","T1565.001"],"_patchfirst":{"reason":"kev","priority":66.4,"kev":{"dateAdded":"2026-04-20","ransomware":false},"epss":{"score":0.25801,"percentile":0.97972},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Cisco","product":"Catalyst SD-WAN Manger","techniqueIds":["T1190","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2025-0108#kev","url":"https://patchfirst.co/cve/CVE-2025-0108/","title":"[KEV] CVE-2025-0108: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","content_text":"Palo Alto Networks · PAN-OS. In CISA KEV since 2025-02-18. ENISA EUVD lists it as exploited. EPSS 98.1% (higher than 99.91% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1055 Process Injection; T1565.001 Stored Data Manipulation. Priority 69.4 of 100.","summary":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","date_published":"2025-02-18T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","public-exploit","T1190","T1055","T1565.001"],"_patchfirst":{"reason":"kev","priority":69.4,"kev":{"dateAdded":"2025-02-18","ransomware":false},"epss":{"score":0.98141,"percentile":0.99913},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"Palo Alto Networks","product":"PAN-OS","techniqueIds":["T1190","T1055","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-8956#kev","url":"https://patchfirst.co/cve/CVE-2024-8956/","title":"[KEV] CVE-2024-8956: PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability","content_text":"PTZOptics · PT30X-SDI/NDI Cameras. In CISA KEV since 2024-11-04. ENISA EUVD lists it as exploited. EPSS 58.8% (higher than 99.11% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1565.001 Stored Data Manipulation. Priority 69.2 of 100.","summary":"PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass Vulnerability","date_published":"2024-11-04T00:00:00.000Z","date_modified":"2026-06-17T08:23:37.000Z","tags":["kev","public-exploit","T1190","T1005","T1565.001"],"_patchfirst":{"reason":"kev","priority":69.2,"kev":{"dateAdded":"2024-11-04","ransomware":false},"epss":{"score":0.58787,"percentile":0.99105},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"PTZOptics","product":"PT30X-SDI/NDI Cameras","techniqueIds":["T1190","T1005","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-41328#kev","url":"https://patchfirst.co/cve/CVE-2022-41328/","title":"[KEV] CVE-2022-41328: Fortinet FortiOS Path Traversal Vulnerability","content_text":"Fortinet · FortiOS. In CISA KEV since 2023-03-14. ENISA EUVD lists it as exploited. EPSS 10.7% (higher than 95.8% of CVEs). CVSS 7.1 HIGH. ATT&CK: T1574 Hijack Execution Flow; T1037 Boot or Logon Initialization Scripts; T1049 System Network Connections Discovery; T1565.001 Stored Data Manipulation. Named in 1 threat report. Priority 66.0 of 100.","summary":"Fortinet FortiOS Path Traversal Vulnerability","date_published":"2023-03-14T00:00:00.000Z","date_modified":"2026-06-17T05:03:02.000Z","tags":["kev","T1574","T1037","T1049","T1565.001"],"_patchfirst":{"reason":"kev","priority":66,"kev":{"dateAdded":"2023-03-14","ransomware":false},"epss":{"score":0.10682,"percentile":0.95802},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1"},"vendor":"Fortinet","product":"FortiOS","techniqueIds":["T1574","T1037","T1049","T1565.001"],"reportCount":1,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-27593#kev","url":"https://patchfirst.co/cve/CVE-2022-27593/","title":"[KEV] CVE-2022-27593: QNAP Photo Station Externally Controlled Reference Vulnerability","content_text":"QNAP · Photo Station. In CISA KEV since 2022-09-08, known ransomware use. ENISA EUVD lists it as exploited. EPSS 87.9% (higher than 99.76% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 79.3 of 100.","summary":"QNAP Photo Station Externally Controlled Reference Vulnerability","date_published":"2022-09-08T00:00:00.000Z","date_modified":"2026-06-17T04:37:19.000Z","tags":["kev","ransomware","public-exploit","T1190","T1565.001"],"_patchfirst":{"reason":"kev","priority":79.3,"kev":{"dateAdded":"2022-09-08","ransomware":true},"epss":{"score":0.87908,"percentile":0.99762},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"QNAP","product":"Photo Station","techniqueIds":["T1190","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-36193#kev","url":"https://patchfirst.co/cve/CVE-2020-36193/","title":"[KEV] CVE-2020-36193: PEAR Archive_Tar Improper Link Resolution Vulnerability","content_text":"PEAR · Archive_Tar. In CISA KEV since 2022-08-25. ENISA EUVD lists it as exploited. EPSS 70.6% (higher than 99.39% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 73.1 of 100.","summary":"PEAR Archive_Tar Improper Link Resolution Vulnerability","date_published":"2022-08-25T00:00:00.000Z","date_modified":"2026-06-17T03:14:58.000Z","tags":["kev","T1190","T1565.001"],"_patchfirst":{"reason":"kev","priority":73.1,"kev":{"dateAdded":"2022-08-25","ransomware":false},"epss":{"score":0.70595,"percentile":0.9939},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"PEAR","product":"Archive_Tar","techniqueIds":["T1190","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2022-30333#kev","url":"https://patchfirst.co/cve/CVE-2022-30333/","title":"[KEV] CVE-2022-30333: RARLAB UnRAR Directory Traversal Vulnerability","content_text":"RARLAB · UnRAR. In CISA KEV since 2022-08-09, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.2% (higher than 99.94% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1565.001 Stored Data Manipulation. Priority 78.2 of 100.","summary":"RARLAB UnRAR Directory Traversal Vulnerability","date_published":"2022-08-09T00:00:00.000Z","date_modified":"2026-10-02T14:54:55.000Z","tags":["kev","ransomware","public-exploit","T1565.001"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2022-08-09","ransomware":true},"epss":{"score":0.99233,"percentile":0.99936},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"RARLAB","product":"UnRAR","techniqueIds":["T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-27924#kev","url":"https://patchfirst.co/cve/CVE-2022-27924/","title":"[KEV] CVE-2022-27924: Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability","content_text":"Synacor · Zimbra Collaboration Suite (ZCS). In CISA KEV since 2022-08-04, known ransomware use. ENISA EUVD lists it as exploited. EPSS 93.9% (higher than 99.84% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1565.001 Stored Data Manipulation. Priority 78.2 of 100.","summary":"Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability","date_published":"2022-08-04T00:00:00.000Z","date_modified":"2026-10-02T14:55:01.000Z","tags":["kev","ransomware","public-exploit","T1190","T1565.001"],"_patchfirst":{"reason":"kev","priority":78.2,"kev":{"dateAdded":"2022-08-04","ransomware":true},"epss":{"score":0.93908,"percentile":0.99844},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","techniqueIds":["T1190","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-2616#kev","url":"https://patchfirst.co/cve/CVE-2019-2616/","title":"[KEV] CVE-2019-2616: Oracle BI Publisher Unauthorized Access Vulnerability","content_text":"Oracle · BI Publisher (Formerly XML Publisher). In CISA KEV since 2022-03-25. ENISA EUVD lists it as exploited. EPSS 92.2% (higher than 99.82% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1213 Data from Information Repositories; T1565.001 Stored Data Manipulation. Priority 68.0 of 100.","summary":"Oracle BI Publisher Unauthorized Access Vulnerability","date_published":"2022-03-25T00:00:00.000Z","date_modified":"2026-06-17T02:34:13.000Z","tags":["kev","public-exploit","T1190","T1213","T1565.001"],"_patchfirst":{"reason":"kev","priority":68,"kev":{"dateAdded":"2022-03-25","ransomware":false},"epss":{"score":0.92183,"percentile":0.99821},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"Oracle","product":"BI Publisher (Formerly XML Publisher)","techniqueIds":["T1190","T1213","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-3476","url":"https://patchfirst.co/cve/CVE-2020-3476/","title":"CVE-2020-3476: Cisco IOS XE Software Arbitrary File Overwrite Vulnerability","content_text":"Cisco · Cisco IOS XE Software. Not in CISA KEV. EPSS 0.3% (higher than 19.1% of CVEs). CVSS 4.4 MEDIUM. ATT&CK: T1078 Valid Accounts; T1565.001 Stored Data Manipulation. Priority 6.9 of 100.","summary":"Cisco IOS XE Software Arbitrary File Overwrite Vulnerability","date_published":"2020-09-24T00:00:00.000Z","date_modified":"2024-11-13T17:57:51.000Z","tags":["T1078","T1565.001"],"_patchfirst":{"reason":"published","priority":6.9,"kev":null,"epss":{"score":0.00269,"percentile":0.19135},"cvss":{"score":4.4,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco IOS XE Software","techniqueIds":["T1078","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-3440","url":"https://patchfirst.co/cve/CVE-2020-3440/","title":"CVE-2020-3440: Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite Vulnerability","content_text":"Cisco · Cisco Webex Meetings. Not in CISA KEV. EPSS 2.6% (higher than 85.4% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1565.001 Stored Data Manipulation. Priority 23.0 of 100.","summary":"Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite Vulnerability","date_published":"2020-08-26T00:00:00.000Z","date_modified":"2024-11-13T18:11:22.000Z","tags":["T1204.002","T1566","T1565.001"],"_patchfirst":{"reason":"published","priority":23,"kev":null,"epss":{"score":0.0262,"percentile":0.85439},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco Webex Meetings","techniqueIds":["T1204.002","T1566","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-5345","url":"https://patchfirst.co/cve/CVE-2020-5345/","title":"CVE-2020-5345: Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions…","content_text":"Dell · Unisphere for PowerMax. Not in CISA KEV. EPSS 0.7% (higher than 54.8% of CVEs). CVSS 6.4 MEDIUM. ATT&CK: T1565.001 Stored Data Manipulation; T1190 Exploit Public-Facing Application. Priority 15.4 of 100.","summary":"Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions…","date_published":"2020-06-23T00:00:00.000Z","date_modified":"2024-09-17T01:51:14.000Z","tags":["T1565.001","T1190"],"_patchfirst":{"reason":"published","priority":15.4,"kev":null,"epss":{"score":0.00748,"percentile":0.54837},"cvss":{"score":6.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Dell","product":"Unisphere for PowerMax","techniqueIds":["T1565.001","T1190"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-3237","url":"https://patchfirst.co/cve/CVE-2020-3237/","title":"CVE-2020-3237: Cisco IOx Application Framework Arbitrary File Overwrite Vulnerability","content_text":"Cisco · Cisco IOx. Not in CISA KEV. EPSS 0.4% (higher than 28.6% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1133 External Remote Services; T1565.001 Stored Data Manipulation. Priority 10.1 of 100.","summary":"Cisco IOx Application Framework Arbitrary File Overwrite Vulnerability","date_published":"2020-06-03T00:00:00.000Z","date_modified":"2024-11-15T17:11:36.000Z","tags":["T1133","T1565.001"],"_patchfirst":{"reason":"published","priority":10.1,"kev":null,"epss":{"score":0.0035,"percentile":0.28643},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco IOx","techniqueIds":["T1133","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-3309","url":"https://patchfirst.co/cve/CVE-2020-3309/","title":"CVE-2020-3309: Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite Vulnerability","content_text":"Cisco · Cisco Firepower Threat Defense Software. Not in CISA KEV. EPSS 1.8% (higher than 78% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1574 Hijack Execution Flow; T1565.001 Stored Data Manipulation. Priority 20.2 of 100.","summary":"Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite Vulnerability","date_published":"2020-05-06T00:00:00.000Z","date_modified":"2024-11-15T17:27:25.000Z","tags":["T1133","T1190","T1574","T1565.001"],"_patchfirst":{"reason":"published","priority":20.2,"kev":null,"epss":{"score":0.01766,"percentile":0.78045},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco Firepower Threat Defense Software","techniqueIds":["T1133","T1190","T1574","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-11010","url":"https://patchfirst.co/cve/CVE-2020-11010/","title":"CVE-2020-11010: SQL injection in Tortoise ORM","content_text":"tortoise · tortoise-orm. Not in CISA KEV. EPSS 1.0% (higher than 64.2% of CVEs). CVSS 6.3 MEDIUM. ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 17.2 of 100.","summary":"SQL injection in Tortoise ORM","date_published":"2020-04-20T00:00:00.000Z","date_modified":"2024-08-04T11:21:14.000Z","tags":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"_patchfirst":{"reason":"published","priority":17.2,"kev":null,"epss":{"score":0.01047,"percentile":0.64169},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"tortoise","product":"tortoise-orm","techniqueIds":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-18234","url":"https://patchfirst.co/cve/CVE-2019-18234/","title":"CVE-2019-18234: Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…","content_text":"Not in CISA KEV. EPSS 1.9% (higher than 79.5% of CVEs). ATT&CK: T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1136 Create Account; T1190 Exploit Public-Facing Application; T1505.003 Web Shell; +1 more. Priority 15.9 of 100.","summary":"Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely…","date_published":"2019-12-23T00:00:00.000Z","date_modified":"2024-08-05T01:47:14.000Z","tags":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"_patchfirst":{"reason":"published","priority":15.9,"kev":null,"epss":{"score":0.01889,"percentile":0.79525},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1133","T1059","T1005","T1136","T1190","T1505.003","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-15972","url":"https://patchfirst.co/cve/CVE-2019-15972/","title":"CVE-2019-15972: Cisco Unified Communications Manager SQL Injection Vulnerability","content_text":"Cisco · Cisco Unified Communications Manager. Not in CISA KEV. EPSS 1.6% (higher than 75.8% of CVEs). CVSS 5.4 MEDIUM. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1565.001 Stored Data Manipulation. Priority 23.9 of 100.","summary":"Cisco Unified Communications Manager SQL Injection Vulnerability","date_published":"2019-11-26T00:00:00.000Z","date_modified":"2024-11-21T19:04:30.000Z","tags":["public-exploit","T1078","T1133","T1059","T1005","T1565.001"],"_patchfirst":{"reason":"published","priority":23.9,"kev":null,"epss":{"score":0.01605,"percentile":0.75835},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco Unified Communications Manager","techniqueIds":["T1078","T1133","T1059","T1005","T1565.001"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-1863","url":"https://patchfirst.co/cve/CVE-2019-1863/","title":"CVE-2019-1863: Cisco Integrated Management Controller Privilege Escalation Vulnerability","content_text":"Cisco · Cisco Unified Computing System E-Series Software (UCSE). Not in CISA KEV. EPSS 1.7% (higher than 77.2% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation; T1565.001 Stored Data Manipulation. Priority 20.0 of 100.","summary":"Cisco Integrated Management Controller Privilege Escalation Vulnerability","date_published":"2019-08-21T00:00:00.000Z","date_modified":"2024-11-21T19:15:47.000Z","tags":["T1078","T1190","T1068","T1565.001"],"_patchfirst":{"reason":"published","priority":20,"kev":null,"epss":{"score":0.01703,"percentile":0.77217},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco Unified Computing System E-Series Software (UCSE)","techniqueIds":["T1078","T1190","T1068","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1942","url":"https://patchfirst.co/cve/CVE-2019-1942/","title":"CVE-2019-1942: Cisco Identity Services Engine Blind SQL Injection Vulnerability","content_text":"Cisco · Cisco Identity Services Engine Software. Not in CISA KEV. EPSS 1.2% (higher than 68.8% of CVEs). CVSS 4.3 MEDIUM. ATT&CK: T1078 Valid Accounts; T1133 External Remote Services; T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1565.001 Stored Data Manipulation. Priority 16.8 of 100.","summary":"Cisco Identity Services Engine Blind SQL Injection Vulnerability","date_published":"2019-07-17T00:00:00.000Z","date_modified":"2024-11-21T19:18:59.000Z","tags":["T1078","T1133","T1059","T1005","T1565.001"],"_patchfirst":{"reason":"published","priority":16.8,"kev":null,"epss":{"score":0.01226,"percentile":0.68814},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco Identity Services Engine Software","techniqueIds":["T1078","T1133","T1059","T1005","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1836","url":"https://patchfirst.co/cve/CVE-2019-1836/","title":"CVE-2019-1836: Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Symbolic Link Path Traversal…","content_text":"Cisco · Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode. Not in CISA KEV. EPSS 0.4% (higher than 38.1% of CVEs). CVSS 5.5 MEDIUM. ATT&CK: T1133 External Remote Services; T1565.001 Stored Data Manipulation. Priority 12.8 of 100.","summary":"Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Symbolic Link Path Traversal…","date_published":"2019-05-03T00:00:00.000Z","date_modified":"2024-11-21T19:34:07.000Z","tags":["T1133","T1565.001"],"_patchfirst":{"reason":"published","priority":12.8,"kev":null,"epss":{"score":0.00438,"percentile":0.38093},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.0"},"vendor":"Cisco","product":"Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode","techniqueIds":["T1133","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3786","url":"https://patchfirst.co/cve/CVE-2019-3786/","title":"CVE-2019-3786: BBR could run arbitrary scripts on deployment VMs","content_text":"Cloud Foundry · BOSH Backup and Restore. Not in CISA KEV. EPSS 0.6% (higher than 47.8% of CVEs). CVSS 7.7 HIGH. ATT&CK: T1565.001 Stored Data Manipulation; T1005 Data from Local System. Priority 14.9 of 100.","summary":"BBR could run arbitrary scripts on deployment VMs","date_published":"2019-04-24T00:00:00.000Z","date_modified":"2024-09-17T02:15:38.000Z","tags":["T1565.001","T1005"],"_patchfirst":{"reason":"published","priority":14.9,"kev":null,"epss":{"score":0.00581,"percentile":0.47762},"cvss":{"score":7.7,"severity":"HIGH","version":"3.0"},"vendor":"Cloud Foundry","product":"BOSH Backup and Restore","techniqueIds":["T1565.001","T1005"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1689","url":"https://patchfirst.co/cve/CVE-2019-1689/","title":"CVE-2019-1689: Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability","content_text":"Cisco · Cisco Webex Teams. Not in CISA KEV. EPSS 1.6% (higher than 75.4% of CVEs). CVSS 7.3 HIGH. ATT&CK: T1105 Ingress Tool Transfer; T1531 Account Access Removal; T1565.001 Stored Data Manipulation. Priority 20.2 of 100.","summary":"Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability","date_published":"2019-02-25T00:00:00.000Z","date_modified":"2024-11-21T19:44:24.000Z","tags":["T1105","T1531","T1565.001"],"_patchfirst":{"reason":"published","priority":20.2,"kev":null,"epss":{"score":0.01574,"percentile":0.75413},"cvss":{"score":7.3,"severity":"HIGH","version":"3.0"},"vendor":"Cisco","product":"Cisco Webex Teams","techniqueIds":["T1105","T1531","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-5459","url":"https://patchfirst.co/cve/CVE-2018-5459/","title":"CVE-2018-5459: An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X","content_text":"Not in CISA KEV. EPSS 2.7% (higher than 85.8% of CVEs). ATT&CK: T1005 Data from Local System; T1485 Data Destruction; T1565.001 Stored Data Manipulation. Priority 17.2 of 100.","summary":"An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X","date_published":"2018-02-13T00:00:00.000Z","date_modified":"2024-08-05T05:33:44.000Z","tags":["T1005","T1485","T1565.001"],"_patchfirst":{"reason":"published","priority":17.2,"kev":null,"epss":{"score":0.02676,"percentile":0.85778},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1005","T1485","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}