Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
214 results · Clear filters · Feed
-
Medium 6.6CVE-2024-39717 Exploited
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only ava…
KEV Aug 23, 2024 -
Medium 6.5
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
KEV Aug 13, 2024 -
Medium 6.8
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) pe…
KEV Jul 30, 2024 -
Medium 5.3CVE-2024-39891 Exploited
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoi…
KEV Jul 23, 2024 -
Medium 6.5
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious ac…
KEV Jul 17, 2024 -
Medium 6.0
Cisco NX-OS Software CLI Command Injection Vulnerability
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insuff…
KEV Jul 2, 2024 -
Medium 6.3
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML att…
KEV Jun 26, 2024 -
Medium 5.3
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…
KEV Jun 26, 2024 -
Medium 6.0
A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been av…
KEV Apr 24, 2024 -
Medium 5.5CVE-2024-29745 Exploited
there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure w…
KEV Apr 4, 2024 -
Medium 6.2CVE-2023-21237 Exploited
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification…
KEV Mar 5, 2024 -
Medium 6.1
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craf…
KEV Feb 12, 2024 -
Medium 5.5CVE-2023-6548 Exploited
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker wit…
KEV Jan 17, 2024 -
Medium 5.3
[20230201] - Core - Improper access check in webservice endpoints
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
KEV Jan 8, 2024 -
Medium 6.5
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2…
KEV Dec 4, 2023 -
Medium 5.4CVE-2023-36584 Exploited
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
KEV Nov 16, 2023 -
Medium 5.3
Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify …
KEV Nov 13, 2023 -
Medium 5.3CVE-2023-36851 Exploited
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php th…
KEV Nov 13, 2023 -
Medium 5.3
Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php tha…
KEV Nov 13, 2023 -
Medium 5.3
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't re…
KEV Nov 13, 2023 -
Medium 6.1
Stored XSS vulnerability in Roundcube
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary Java…
KEV Oct 26, 2023 -
Medium 6.5
Microsoft WordPad Information Disclosure Vulnerability
Microsoft WordPad Information Disclosure Vulnerability
KEV Oct 10, 2023 -
Medium 5.3
Skype for Business Elevation of Privilege Vulnerability
Skype for Business Elevation of Privilege Vulnerability
KEV Oct 10, 2023 -
Medium 6.6CVE-2023-20109 Exploited
A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Sof…
KEV Oct 10, 2023 -
Medium 5.5CVE-2023-4211 Exploited
Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
KEV Oct 3, 2023 -
Medium 5.5
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A ma…
KEV Sep 25, 2023 -
Medium 5.0CVE-2022-22265 Exploited
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary …
KEV Sep 18, 2023 -
Medium 5.0
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepowe…
KEV Sep 13, 2023 -
Medium 6.5
Microsoft Word Information Disclosure Vulnerability
Microsoft Word Information Disclosure Vulnerability
KEV Sep 12, 2023 -
Medium 6.1
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
KEV Jul 27, 2023 -
Medium 5.5CVE-2023-38606 Exploited
This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and i…
KEV Jul 26, 2023 -
Medium 6.4CVE-2021-25394 Exploited
A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrar…
KEV Jun 29, 2023 -
Medium 6.1CVE-2021-25371 Exploited
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
KEV Jun 29, 2023 -
Medium 6.4CVE-2021-25395 Exploited
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check…
KEV Jun 29, 2023 -
Medium 6.1CVE-2021-25372 Exploited
An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.
KEV Jun 29, 2023 -
Medium 6.1
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attac…
KEV Jun 22, 2023 -
Medium 6.5
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macO…
KEV May 22, 2023 -
Medium 4.4CVE-2023-21492 Exploited
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypas…
KEV May 19, 2023 -
Medium 5.9CVE-2004-1464 Exploited
Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) con…
KEV May 19, 2023 -
Medium 5.5
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver …
KEV May 12, 2023