Skip to content
OpenAdvisories

Source

CISA Known Exploited Vulnerabilities

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

All Critical High Medium Low Public exploit

1,118 results · Clear filters · Feed

  • High 7.8
    CVE-2018-4878 Exploited · Ransomware Public exploit EPSS 90%

    A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to…

    flashplugin-nonfree Ubuntu
    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2018-13379 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5…

    Fortinet Fortinet FortiOS, FortiProxy Network devices
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-6789 Exploited · Ransomware Public exploit EPSS 82%

    An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted me…

    exim4 exim4 exim Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • Medium 6.6
    CVE-2018-2380 Exploited · Ransomware Public exploit EPSS 29%

    SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information p…

    SAP SAP CRM
    KEV Nov 3, 2021
  • High 7.5
    CVE-2018-15811 Exploited Public exploit Scanner template EPSS 76%

    Inadequate Encryption Strength in DotNetNuke

    DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

    DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-15961 Exploited Public exploit Scanner template EPSS 100%

    Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an un…

    Adobe ColdFusion
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2018-20062 Exploited Public exploit Scanner template EPSS 100%

    An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PH…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2012-0158 Exploited · Ransomware Public exploit EPSS 100%

    The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Control…

    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2012-3152 Exploited Public exploit EPSS 99%

    Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2014-1812 Exploited · Ransomware Public exploit EPSS 65%

    The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Wind…

    KEV Nov 3, 2021
  • High 7.8
    CVE-2016-0185 Exploited Public exploit EPSS 70%

    Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrar…

    KEV Nov 3, 2021
  • High 7.8
    CVE-2016-7255 Exploited · Ransomware Public exploit EPSS 81%

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2016-4437 Exploited Public exploit Scanner template EPSS 93%

    Improper Access Control in Apache Shiro

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

    shiro shiro org.apache.shiro:shiro-core Debian Ubuntu Maven
    KEV Nov 3, 2021
  • Medium 5.5
    CVE-2016-3715 Exploited Public exploit EPSS 75%

    The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary f…

    imagemagick imagemagick graphicsmagick graphicsmagick Debian Ubuntu
    KEV Nov 3, 2021
  • High 7.8
    CVE-2016-3235 Exploited Public exploit EPSS 43%

    Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mish…

    KEV Nov 3, 2021
  • High 7.5
    CVE-2016-3976 Exploited Public exploit EPSS 47%

    Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary fi…

    KEV Nov 3, 2021
  • High 7.8
    CVE-2016-3643 Exploited Public exploit

    SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfigurati…

    KEV Nov 3, 2021
  • Medium 5.5
    CVE-2016-3718 Exploited Public exploit EPSS 76%

    The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct…

    imagemagick imagemagick graphicsmagick graphicsmagick Debian Ubuntu
    KEV Nov 3, 2021
  • High 8.8
    CVE-2017-0143 Exploited · Ransomware Public exploit EPSS 93%

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

    Microsoft Windows SMB Windows
    KEV Nov 3, 2021
  • High 7.8
    CVE-2017-0199 Exploited · Ransomware Public exploit EPSS 99%

    Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windo…

    Microsoft Office/WordPad
    KEV Nov 3, 2021
  • High 7.8
    CVE-2017-16651 Exploited Public exploit EPSS 46%

    Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary fil…

    roundcube roundcube roundcubemail Debian Ubuntu Alpine
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2017-7269 Exploited Public exploit Scanner template EPSS 100%

    Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 i…

    KEV Nov 3, 2021
  • High 7.8
    CVE-2017-11882 Exploited · Ransomware Public exploit EPSS 100%

    Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and M…

    Microsoft Microsoft Office
    KEV Nov 3, 2021
  • High 7.8
    CVE-2017-11774 Exploited Public exploit EPSS 60%

    Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary comman…

    Microsoft Microsoft Outlook
    KEV Nov 3, 2021
  • High 8.8
    CVE-2017-6327 Exploited Public exploit EPSS 36%

    The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a sit…

    Symantec Messaging Gateway
    KEV Nov 3, 2021
  • High 7.8
    CVE-2017-8759 Exploited Public exploit EPSS 89%

    Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely v…

    Microsoft Microsoft .NET Framework
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2017-9248 Exploited Public exploit EPSS 75%

    Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does no…

    KEV Nov 3, 2021
  • High 8.1
    CVE-2017-9805 Exploited Public exploit Scanner template EPSS 99%

    REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

    The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloa…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-rest-plugin Maven
    KEV Nov 3, 2021
  • High 8.8
    CVE-2017-9822 Exploited · Ransomware Public exploit Scanner template EPSS 95%

    DNN (aka DotNetNuke) has Remote Code Execution via a cookie

    DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

    DotNetNuke DotNetNuke CMS Fixed in 9.1.1 DotNetNuke.Core NuGet
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2017-5638 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted …

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2021-34473 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19
    KEV Nov 3, 2021
  • Critical 9.0
    CVE-2021-34523 Exploited · Ransomware Public exploit EPSS 100%

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8
    KEV Nov 3, 2021
  • High 8.8
    CVE-2021-34527 Exploited · Ransomware Public exploit EPSS 100%

    Windows Print Spooler Remote Code Execution Vulnerability

    A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could th…

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 3, 2021
  • High 8.4
    CVE-2021-33739 Exploited Public exploit

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    Microsoft DWM Core Library Elevation of Privilege Vulnerability

    Microsoft Windows 10 Version 20H2 Windows 10 Version 1909 Windows Server version 20H2 Windows
    KEV Nov 3, 2021
  • Critical 9.0
    CVE-2021-35211 Exploited · Ransomware Public exploit Scanner template EPSS 91%

    Serv-U Remote Memory Escape Vulnerability

    Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds…

    SolarWinds Serv-U Managed File Transfer Server and Serv-U Secured FTP
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-35464 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple p…

    KEV Nov 3, 2021
  • High 7.8
    CVE-2021-28310 Exploited Public exploit

    Win32k Elevation of Privilege Vulnerability

    Win32k Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 3, 2021
  • High 8.8
    CVE-2021-28664 Exploited Public exploit

    The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unpriv…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2021-28663 Exploited Public exploit EPSS 12%

    The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are …

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-1497 Exploited Public exploit Scanner template EPSS 100%

    Cisco HyperFlex HX Command Injection Vulnerabilities

    Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Det…

    Cisco Cisco HyperFlex HX Data Platform Network devices
    KEV Nov 3, 2021