Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
1,118 results · Clear filters · Feed
-
High 8.8
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting …
KEV Oct 20, 2022 -
Critical 9.8
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 a…
KEV Oct 11, 2022 -
High 8.8
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 be…
KEV Sep 30, 2022 -
High 8.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
KEV Sep 30, 2022 -
High 8.0
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Sep 30, 2022 -
Critical 9.8
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote cod…
KEV Sep 22, 2022 -
High 8.8
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not…
KEV Sep 15, 2022 -
High 7.8
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certai…
KEV Sep 15, 2022 -
High 8.4
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.…
KEV Sep 15, 2022 -
High 8.4
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data …
KEV Sep 15, 2022 -
High 7.8
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 al…
KEV Sep 15, 2022 -
High 7.8
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
KEV Sep 14, 2022 -
Medium 5.5
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issu…
KEV Sep 8, 2022 -
Critical 9.8
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remo…
KEV Sep 8, 2022 -
Medium 4.3
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 a…
KEV Sep 8, 2022 -
Critical 9.8
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). …
KEV Sep 8, 2022 -
High 8.1
An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, …
KEV Sep 8, 2022 -
High 7.8
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrappe…
KEV Aug 25, 2022 -
Critical 9.8
Remote Code Execution Vulnerability in Packaging
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including re…
KEV Aug 25, 2022 -
Critical 9.8
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of A…
KEV Aug 25, 2022 -
Critical 9.8
Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local …
KEV Aug 25, 2022 -
Critical 9.8
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form re…
KEV Aug 25, 2022 -
High 7.8
Windows Runtime Remote Code Execution Vulnerability
Windows Runtime Remote Code Execution Vulnerability
KEV Aug 18, 2022 -
Critical 9.8
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 an…
KEV Aug 18, 2022 -
High 8.8
Active Directory Domain Services Elevation of Privilege Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
KEV Aug 18, 2022 -
Critical 9.8
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote…
KEV Aug 18, 2022 -
High 7.2
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts fil…
KEV Aug 11, 2022 -
Critical 9.8
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts f…
KEV Aug 11, 2022 -
Critical 9.8
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) …
KEV Aug 9, 2022 -
Critical 9.8
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in t…
KEV Jul 29, 2022 -
High 7.8
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.…
KEV Jun 27, 2022 -
High 7.8
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid too…
KEV Jun 27, 2022 -
High 7.8
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.…
KEV Jun 27, 2022 -
High 7.8
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. Th…
KEV Jun 14, 2022 -
Critical 9.8
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arb…
KEV Jun 9, 2022 -
Medium 5.3
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user info…
KEV Jun 9, 2022 -
Critical 9.9
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticate…
KEV Jun 9, 2022 -
High 7.8
Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.…
KEV Jun 8, 2022 -
High 8.8
Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, …
KEV Jun 8, 2022 -
High 8.8
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbi…
KEV Jun 8, 2022