Skip to content
OpenAdvisories

Source

CISA Known Exploited Vulnerabilities

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

All Critical High Medium Low Public exploit

468 results · Clear filters · Feed

  • Critical 10.0
    CVE-2023-46604 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

    The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class …

    Apache Software Foundation Apache ActiveMQ Apache ActiveMQ Legacy OpenWire Module activemq Debian Ubuntu Maven
    KEV Nov 2, 2023
  • Critical 9.8
    CVE-2023-46747 Exploited · Ransomware Public exploit Scanner template EPSS 97%

    BIG-IP Configuration utility unauthenticated remote code execution vulnerability

    Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have …

    F5 BIG-IP Network devices
    KEV Oct 31, 2023
  • Critical 9.4
    CVE-2023-4966 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Unauthenticated sensitive information disclosure

    Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

    Citrix NetScaler ADC  NetScaler Gateway Network devices
    KEV Oct 18, 2023
  • Critical 10.0
    CVE-2023-20198 Exploited Public exploit Scanner template EPSS 100%

    Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IO…

    Cisco Cisco IOS XE Software iOS Network devices
    KEV Oct 16, 2023
  • Critical 10.0
    CVE-2023-40044 Exploited · Ransomware Public exploit Scanner template EPSS 90%

    WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

    In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

    Progress Software WS_FTP Server
    KEV Oct 5, 2023
  • Critical 10.0
    CVE-2023-22515 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploite…

    Atlassian Confluence Data Center Confluence Server Web / CMS
    KEV Oct 5, 2023
  • Critical 9.8
    CVE-2023-42793 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

    JetBrains TeamCity
    KEV Oct 4, 2023
  • Critical 9.8
    CVE-2018-14667 Exploited Public exploit EPSS 74%

    Richfaces vulnerable to arbitrary code execution

    The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4…

    [UNKNOWN] RichFaces org.richfaces:richfaces-core Maven
    KEV Sep 28, 2023
  • Critical 9.8
    CVE-2014-8361 Exploited Public exploit EPSS 100%

    The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClie…

    KEV Sep 18, 2023
  • Critical 9.8
    CVE-2021-3129 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Unauthenticated remote code execution in Ignition

    Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Larave…

    facade/ignition Packagist
    KEV Sep 18, 2023
  • Critical 9.8
    CVE-2023-33246 Exploited Public exploit Scanner template EPSS 97%

    Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

    For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution.  Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attack…

    Apache Software Foundation Apache RocketMQ org.apache.rocketmq:rocketmq-broker org.apache.rocketmq:rocketmq-namesrv Maven
    KEV Sep 6, 2023
  • Critical 9.8
    CVE-2023-38035 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an…

    ivanti MobileIron Sentry Network devices
    KEV Aug 22, 2023
  • Critical 9.8
    CVE-2023-24489 Exploited Public exploit Scanner template EPSS 97%

    A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, cou…

    Citrix Citrix ShareFile Storage Zones Controller Network devices
    KEV Aug 16, 2023
  • Critical 9.8
    CVE-2017-18368 Exploited Public exploit EPSS 95%

    The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injec…

    KEV Aug 7, 2023
  • Critical 10.0
    CVE-2023-35078 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or r…

    ivanti Endpoint Manager Mobile Network devices
    KEV Jul 25, 2023
  • Critical 9.8
    CVE-2023-3519 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Unauthenticated remote code execution

    Citrix NetScaler ADC  NetScaler Gateway Network devices
    KEV Jul 19, 2023
  • Critical 9.8
    CVE-2022-29303 Exploited Public exploit Scanner template EPSS 98%

    SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.

    KEV Jul 13, 2023
  • Critical 9.8
    CVE-2022-31199 Exploited · Ransomware Public exploit EPSS 36%

    Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting bo…

    KEV Jul 11, 2023
  • Critical 9.8
    CVE-2019-17621 Exploited Public exploit EPSS 91%

    The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated re…

    KEV Jun 29, 2023
  • Critical 9.8
    CVE-2020-12641 Exploited Public exploit Scanner template EPSS 84%

    rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters i…

    roundcube roundcube Debian Ubuntu
    KEV Jun 22, 2023
  • Critical 9.8
    CVE-2023-20887 Exploited Public exploit Scanner template EPSS 98%

    Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMwar…

    KEV Jun 22, 2023
  • Critical 9.8
    CVE-2021-44026 Exploited Public exploit EPSS 70%

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    roundcube roundcube Debian Ubuntu
    KEV Jun 22, 2023
  • Critical 9.2
    CVE-2023-27997 Exploited · Ransomware Public exploit EPSS 87%

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, vers…

    Fortinet FortiOS FortiProxy FortiOS-6K7K Network devices
    KEV Jun 13, 2023
  • Critical 9.8
    CVE-2023-34362 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023…

    KEV Jun 2, 2023
  • Critical 9.8
    CVE-2023-28771 Exploited Public exploit EPSS 99%

    Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware ver…

    Zyxel USG FLEX series firmware ATP series firmware VPN series Firmware Network devices
    KEV May 31, 2023
  • Critical 9.4
    CVE-2023-2868 Exploited Public exploit EPSS 87%

    Remote Code injection in Barracuda Email Security Gateway

    A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar f…

    Barracuda Networks Barracuda Email Security Gateway
    KEV May 26, 2023
  • Critical 9.0
    CVE-2021-45046 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

    It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…

    Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV May 1, 2023
  • Critical 9.8
    CVE-2023-27350 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Bu…

    PaperCut NG
    KEV Apr 21, 2023
  • Critical 9.8
    CVE-2017-7494 Exploited · Ransomware Public exploit EPSS 99%

    Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, all…

    Samba Samba samba samba Debian Ubuntu Azure Linux Alpine
    KEV Mar 30, 2023
  • Critical 9.8
    CVE-2023-23397 Exploited Public exploit EPSS 97%

    Microsoft Outlook Elevation of Privilege Vulnerability

    Microsoft Outlook Elevation of Privilege Vulnerability

    Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office 2019
    KEV Mar 14, 2023
  • Critical 9.8
    CVE-2022-35914 Exploited Public exploit Scanner template EPSS 100%

    /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

    KEV Mar 7, 2023
  • Critical 9.8
    CVE-2022-47986 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    IBM Aspera Faspex code execution

    IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to e…

    IBM Aspera Faspex
    KEV Feb 21, 2023
  • Critical 9.8
    CVE-2022-46169 Exploited Public exploit Scanner template EPSS 100%

    Unauthenticated Command Injection

    Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a serve…

    Cacti cacti cacti cacti Debian Ubuntu
    KEV Feb 16, 2023
  • Critical 9.8
    CVE-2022-24990 Exploited · Ransomware Public exploit Scanner template EPSS 83%

    TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Age…

    KEV Feb 10, 2023
  • Critical 9.8
    CVE-2022-21587 Exploited · Ransomware Public exploit Scanner template EPSS 98%

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).…

    Oracle Web Applications Desktop Integrator
    KEV Feb 2, 2023
  • Critical 9.8
    CVE-2017-11357 Exploited · Ransomware Public exploit EPSS 78%

    Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which …

    KEV Jan 26, 2023
  • Critical 9.8
    CVE-2022-47966 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due…

    KEV Jan 23, 2023
  • Critical 9.8
    CVE-2022-44877 Exploited Public exploit Scanner template EPSS 100%

    login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execu…

    KEV Jan 17, 2023
  • Critical 9.8
    CVE-2022-27518 Exploited Public exploit

    Unauthenticated remote arbitrary code execution

    Unauthenticated remote arbitrary code execution

    Citrix Citrix Gateway, Citrix ADC Network devices
    KEV Dec 13, 2022
  • Critical 9.3
    CVE-2022-42475 Exploited · Ransomware Public exploit EPSS 99%

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0…

    Fortinet FortiOS FortiProxy Network devices
    KEV Dec 13, 2022