Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
1,118 results · Clear filters · Feed
-
High 7.8
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user…
KEV Apr 7, 2023 -
High 7.9
Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. …
KEV Mar 30, 2023 -
High 8.8
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service…
KEV Mar 30, 2023 -
Medium 6.1
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote at…
KEV Mar 30, 2023 -
High 8.8
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are misha…
KEV Mar 30, 2023 -
High 7.8
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects…
KEV Mar 30, 2023 -
Critical 9.8
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, all…
KEV Mar 30, 2023 -
High 8.6
Adobe ColdFusion Improper Access Control Arbitrary code execution
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does n…
KEV Mar 15, 2023 -
Critical 9.8
Microsoft Outlook Elevation of Privilege Vulnerability
Microsoft Outlook Elevation of Privilege Vulnerability
KEV Mar 14, 2023 -
High 7.2
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute ar…
KEV Mar 10, 2023 -
High 8.5
XStream is vulnerable to a Remote Command Execution attack
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affec…
KEV Mar 10, 2023 -
High 8.8
Apache Spark shell command injection vulnerability via Spark UI
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in H…
KEV Mar 7, 2023 -
Critical 9.8
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
KEV Mar 7, 2023 -
Medium 6.8
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary…
KEV Mar 7, 2023 -
High 7.5
ZK Framework vulnerable to malicious POST
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
KEV Feb 27, 2023 -
Critical 9.8
IBM Aspera Faspex code execution
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to e…
KEV Feb 21, 2023 -
Critical 9.8
Unauthenticated Command Injection
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a serve…
KEV Feb 16, 2023 -
High 7.8
Windows Graphics Component Remote Code Execution Vulnerability
Windows Graphics Component Remote Code Execution Vulnerability
KEV Feb 14, 2023 -
High 7.8
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows al…
KEV Feb 10, 2023 -
High 7.2
Fortra GoAnywhere MFT License Response Servlet Command Injection
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
KEV Feb 10, 2023 -
Critical 9.8
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Age…
KEV Feb 10, 2023 -
High 8.8
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because …
KEV Feb 2, 2023 -
Critical 9.8
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload).…
KEV Feb 2, 2023 -
Critical 9.8
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which …
KEV Jan 26, 2023 -
Critical 9.8
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due…
KEV Jan 23, 2023 -
Critical 9.8
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execu…
KEV Jan 17, 2023 -
High 8.8
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
KEV Jan 10, 2023 -
High 8.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
KEV Jan 10, 2023 -
High 7.7
TIBCO JasperReports Server Information Disclosure Vulnerability
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics …
KEV Dec 29, 2022 -
Critical 9.8
Unauthenticated remote arbitrary code execution
Unauthenticated remote arbitrary code execution
KEV Dec 13, 2022 -
Critical 9.3
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0…
KEV Dec 13, 2022 -
High 8.8
Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corr…
KEV Dec 5, 2022 -
Critical 9.8
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported ve…
KEV Nov 28, 2022 -
Medium 4.4
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted…
KEV Nov 8, 2022 -
High 7.8
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to ha…
KEV Oct 24, 2022 -
Medium 6.5
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the…
KEV Oct 24, 2022 -
Critical 9.8
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…
KEV Oct 24, 2022 -
High 7.8
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, …
KEV Oct 24, 2022 -
High 7.8
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING…
KEV Oct 24, 2022 -
Critical 9.8
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through am…
KEV Oct 20, 2022