Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
1,117 results · Clear filters · Feed
-
Critical 9.1
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) coul…
KEV Jan 7, 2025 -
Critical 9.8
Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
KEV Dec 19, 2024 -
Critical 9.8
upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir pa…
KEV Dec 18, 2024 -
Critical 9.8
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can imp…
KEV Dec 17, 2024 -
High 7.8
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
KEV Dec 16, 2024 -
High 7.4
ColdFusion | Improper Access Control (CWE-284)
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify restricted files. Exploitation of this …
KEV Dec 16, 2024 -
Critical 9.8
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file u…
KEV Dec 13, 2024 -
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
KEV Dec 10, 2024 -
Critical 10.0
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers …
KEV Dec 4, 2024 -
Critical 9.8
ProjectSend Unauthenticated Configuration Modification
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's conf…
KEV Dec 3, 2024 -
High 8.8
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 1…
KEV Nov 21, 2024 -
Medium 5.9
PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or…
KEV Nov 18, 2024 -
Critical 10.0
LoadMaster Pre-Authenticated OS Command Injection
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
KEV Nov 18, 2024 -
Medium 5.9
PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this…
KEV Nov 18, 2024 -
Critical 9.2
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and…
KEV Nov 14, 2024 -
Critical 9.9
Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys…
KEV Nov 14, 2024 -
Medium 6.5
NTLM Hash Disclosure Spoofing Vulnerability
NTLM Hash Disclosure Spoofing Vulnerability
KEV Nov 12, 2024 -
High 8.8
Windows Task Scheduler Elevation of Privilege Vulnerability
Windows Task Scheduler Elevation of Privilege Vulnerability
KEV Nov 12, 2024 -
Critical 10.0
GeoJSON URL validation can expose server files and environment variables to unauthorized users
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment varia…
KEV Nov 12, 2024 -
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path t…
KEV Nov 12, 2024 -
Critical 10.0
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypa…
KEV Nov 7, 2024 -
Critical 9.3
Expedition: Missing Authentication Leads to Admin Account Takeover
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichm…
KEV Nov 7, 2024 -
High 7.3
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to pre…
KEV Nov 7, 2024 -
Critical 9.8
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote c…
KEV Nov 7, 2024 -
Medium 6.1
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
KEV Oct 24, 2024 -
Critical 9.8
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.…
KEV Oct 23, 2024 -
Critical 9.8
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exe…
KEV Oct 17, 2024 -
Critical 9.1
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
KEV Oct 15, 2024 -
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
KEV Oct 15, 2024 -
Critical 9.8
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timel…
KEV Oct 15, 2024 -
Critical 9.8
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0…
KEV Oct 9, 2024 -
Critical 10.0
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9…
KEV Oct 3, 2024 -
Critical 9.6
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated at…
KEV Oct 2, 2024 -
Critical 9.8
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a rem…
KEV Sep 24, 2024 -
Critical 9.4
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted fun…
KEV Sep 19, 2024 -
Critical 9.8
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles pag…
KEV Sep 18, 2024 -
Critical 9.8
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…
KEV Sep 18, 2024 -
Critical 9.8
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF…
KEV Sep 18, 2024 -
Critical 9.8
Apache HugeGraph-Server: Command execution in gremlin
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the…
KEV Sep 18, 2024 -
High 8.8
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and M…
KEV Sep 17, 2024