Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
928 results · Clear filters · Feed
-
High 8.8CVE-2021-30554 Exploited
Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap c…
KEV Nov 3, 2021 -
High 8.8
Microsoft MSHTML Remote Code Execution Vulnerability
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An a…
KEV Nov 3, 2021 -
High 8.2CVE-2021-23874 Exploited
McAfee Total Protection (MTP) privilege escalation vulnerability
Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.
KEV Nov 3, 2021 -
High 8.8
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corrupt…
KEV Nov 3, 2021 -
High 8.8
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit hea…
KEV Nov 3, 2021 -
High 8.8
Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to p…
KEV Nov 3, 2021 -
High 8.8
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside …
KEV Nov 3, 2021 -
High 8.8
Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution
Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achiev…
KEV Nov 3, 2021 -
High 8.8
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap co…
KEV Nov 3, 2021 -
High 8.8CVE-2021-21206 Exploited
Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap c…
KEV Nov 3, 2021 -
High 7.5
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not…
KEV Nov 3, 2021 -
High 8.8
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corru…
KEV Nov 3, 2021 -
High 7.5
Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all ver…
KEV Nov 3, 2021 -
High 7.2
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an aut…
KEV Nov 3, 2021 -
High 8.8
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker t…
KEV Nov 3, 2021 -
High 8.8
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker…
KEV Nov 3, 2021 -
High 8.8
Internet Explorer Memory Corruption Vulnerability
Internet Explorer Memory Corruption Vulnerability
KEV Nov 3, 2021 -
High 7.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
High 7.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
High 7.2
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload …
KEV Nov 3, 2021 -
High 7.8
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileg…
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Err…
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Nov 3, 2021 -
High 8.8
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML …
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Nov 3, 2021 -
High 7.8CVE-2019-0797 Exploited
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in…
KEV Nov 3, 2021 -
High 8.8
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vu…
KEV Nov 3, 2021 -
High 7.0
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for di…
KEV Nov 3, 2021 -
High 7.5
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This v…
KEV Nov 3, 2021 -
High 8.0
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1…
KEV Nov 3, 2021 -
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Nov 3, 2021 -
High 7.8
An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Wi…
KEV Nov 3, 2021 -
High 7.5
Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls …
KEV Nov 3, 2021 -
High 7.5
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet…
KEV Nov 3, 2021 -
High 7.8CVE-2019-1214 Exploited
An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles…
KEV Nov 3, 2021 -
High 8.8
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are…
KEV Nov 3, 2021 -
High 7.5
Improper Input Validation in Apache Solr
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configse…
KEV Nov 3, 2021 -
High 7.5
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE a…
KEV Nov 3, 2021 -
High 7.5CVE-2019-6223 Exploited
A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. …
KEV Nov 3, 2021