Skip to content
OpenAdvisories

Source

CISA Known Exploited Vulnerabilities

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

All Critical High Medium Low Public exploit

468 results · Clear filters · Feed

  • Critical 9.0
    CVE-2020-4427 Exploited Public exploit Scanner template EPSS 70%

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security res…

    IBM Data Risk Manager
    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2020-4428 Exploited Public exploit EPSS 62%

    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary c…

    IBM Data Risk Manager
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-29583 Exploited Public exploit Scanner template EPSS 90%

    Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-17496 Exploited Public exploit Scanner template EPSS 87%

    vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabb…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-17530 Exploited Public exploit Scanner template EPSS 96%

    Remote code execution in Apache Struts

    Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-6287 Exploited Public exploit Scanner template EPSS 95%

    SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication …

    SAP SAP NetWeaver AS JAVA (LM Configuration Wizard)
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-6207 Exploited Public exploit Scanner template EPSS 98%

    SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform a…

    SAP SAP Solution Manager (User Experience Monitoring)
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-3952 Exploited Public exploit Scanner template EPSS 90%

    Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Serv…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-3992 Exploited · Ransomware Public exploit EPSS 83%

    OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-3161 Exploited Public exploit EPSS 84%

    Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability

    A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to…

    Cisco Cisco IP phone Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-2555 Exploited Public exploit EPSS 97%

    Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). S…

    Oracle WebCenter Portal Utilities Framework
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-8657 Exploited Public exploit Scanner template EPSS 92%

    An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in includ…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-8515 Exploited Public exploit Scanner template EPSS 100%

    DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allo…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-8644 Exploited Public exploit Scanner template EPSS 86%

    PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.

    KEV Nov 3, 2021
  • Critical 9.6
    CVE-2020-15999 Exploited Public exploit EPSS 64%

    Heap buffer overflow in CefSharp

    Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Google Chrome chromium-browser firefox-esr Browsers Debian Ubuntu Azure Linux Alpine NuGet
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-15505 Exploited Public exploit Scanner template EPSS 100%

    A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,…

    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-25213 Exploited Public exploit Scanner template EPSS 97%

    The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitr…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-10148 Exploited Public exploit Scanner template EPSS 92%

    SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

    The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise …

    SolarWinds Orion Platform
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-10189 Exploited Public exploit Scanner template EPSS 100%

    Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-10987 Exploited Public exploit Scanner template EPSS 80%

    The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-5902 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-5847 Exploited Public exploit Scanner template EPSS 96%

    Unraid through 6.8.0 allows Remote Code Execution.

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-14750 Exploited Public exploit Scanner template EPSS 99%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-14882 Exploited Public exploit Scanner template EPSS 100%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-14871 Exploited Public exploit EPSS 80%

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported v…

    Oracle Solaris Operating System
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2015-4852 Exploited Public exploit EPSS 95%

    The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers…

    openjdk-8 libcommons-collections3-java Ubuntu
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-7600 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Drupal Core Remote Code Execution Vulnerability

    Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.

    drupal/core drupal/drupal drupal7 drupal7 Web / CMS Ubuntu Alpine Packagist
    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2018-13379 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5…

    Fortinet Fortinet FortiOS, FortiProxy Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-6789 Exploited · Ransomware Public exploit EPSS 82%

    An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted me…

    exim4 exim4 exim Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-15961 Exploited Public exploit Scanner template EPSS 100%

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an un…

    Adobe ColdFusion
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-20062 Exploited Public exploit Scanner template EPSS 100%

    An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PH…

    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2012-3152 Exploited Public exploit EPSS 99%

    Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2016-4437 Exploited Public exploit Scanner template EPSS 93%

    Improper Access Control in Apache Shiro

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

    shiro shiro org.apache.shiro:shiro-core Debian Ubuntu Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2017-7269 Exploited Public exploit Scanner template EPSS 100%

    Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 i…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2017-9248 Exploited Public exploit EPSS 75%

    Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does no…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2017-5638 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted …

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2021-34473 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19
    KEV Nov 3, 2021
  • Critical 9.0
    CVE-2021-34523 Exploited · Ransomware Public exploit EPSS 100%

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8
    KEV Nov 3, 2021
  • Critical 9.0
    CVE-2021-35211 Exploited · Ransomware Public exploit Scanner template EPSS 91%

    Serv-U Remote Memory Escape Vulnerability

    Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds…

    SolarWinds Serv-U Managed File Transfer Server and Serv-U Secured FTP
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-35464 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple p…

    KEV Nov 3, 2021