Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
627 results · Clear filters · Feed
-
Critical 9.8
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevat…
KEV Nov 3, 2021 -
Critical 9.8
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic…
KEV Nov 3, 2021 -
Critical 9.8
Unraid through 6.8.0 allows Remote Code Execution.
KEV Nov 3, 2021 -
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…
KEV Nov 3, 2021 -
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…
KEV Nov 3, 2021 -
Critical 10.0
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported v…
KEV Nov 3, 2021 -
Critical 9.8
NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.
KEV Nov 3, 2021 -
Critical 9.8
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers…
KEV Nov 3, 2021 -
Critical 9.8
Drupal Core Remote Code Execution Vulnerability
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
KEV Nov 3, 2021 -
Critical 9.8
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deseri…
KEV Nov 3, 2021 -
Critical 9.1
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5…
KEV Nov 3, 2021 -
Critical 9.8
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted me…
KEV Nov 3, 2021 -
Critical 9.8
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an un…
KEV Nov 3, 2021 -
Critical 9.8CVE-2018-14558 Exploited
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware thro…
KEV Nov 3, 2021 -
Critical 9.8
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PH…
KEV Nov 3, 2021 -
Critical 9.1
Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and…
KEV Nov 3, 2021 -
Critical 9.8
Improper Access Control in Apache Shiro
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
KEV Nov 3, 2021 -
Critical 10.0
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentic…
KEV Nov 3, 2021 -
Critical 9.8
Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 i…
KEV Nov 3, 2021 -
Critical 9.8
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does no…
KEV Nov 3, 2021 -
Critical 9.8
Apache Struts vulnerable to remote arbitrary command execution due to improper input validation
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted …
KEV Nov 3, 2021 -
Critical 9.1
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
Critical 9.0
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
Critical 9.0
Serv-U Remote Memory Escape Vulnerability
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds…
KEV Nov 3, 2021 -
Critical 9.8
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple p…
KEV Nov 3, 2021 -
Critical 9.8
Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be …
KEV Nov 3, 2021 -
Critical 9.6
Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary …
KEV Nov 3, 2021 -
Critical 9.8
Cisco HyperFlex HX Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…
KEV Nov 3, 2021 -
Critical 9.8CVE-2021-1871 Exploited
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021…
KEV Nov 3, 2021 -
Critical 9.8
Cisco HyperFlex HX Command Injection Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…
KEV Nov 3, 2021 -
Critical 9.8CVE-2021-1870 Exploited
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021…
KEV Nov 3, 2021 -
Critical 9.8
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
Critical 9.8
An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerabil…
KEV Nov 3, 2021 -
Critical 9.8
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root…
KEV Nov 3, 2021 -
Critical 9.8CVE-2021-27103 Exploited · Ransomware
Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed ver…
KEV Nov 3, 2021 -
Critical 9.8
Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI,…
KEV Nov 3, 2021 -
Critical 9.8
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endp…
KEV Nov 3, 2021 -
Critical 10.0
Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.…
KEV Nov 3, 2021 -
Critical 9.6
Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised t…
KEV Nov 3, 2021 -
Critical 9.8
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with result…
KEV Nov 3, 2021