Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
214 results · Clear filters · Feed
-
Medium 6.1
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaborati…
KEV Apr 3, 2023 -
Medium 6.1
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote at…
KEV Mar 30, 2023 -
Medium 4.4
Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
KEV Mar 14, 2023 -
Medium 6.5
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet For…
KEV Mar 14, 2023 -
Medium 6.8
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary…
KEV Mar 7, 2023 -
Medium 6.8
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authe…
KEV Feb 21, 2023 -
Medium 6.8
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to…
KEV Feb 21, 2023 -
Medium 5.4
Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
KEV Dec 13, 2022 -
Medium 5.4CVE-2022-41049 Exploited
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
KEV Nov 14, 2022 -
Medium 5.4CVE-2022-41091 Exploited · Ransomware
Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
KEV Nov 8, 2022 -
Medium 4.4
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted…
KEV Nov 8, 2022 -
Medium 6.2CVE-2021-25369 Exploited
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel infor…
KEV Nov 8, 2022 -
Medium 6.1CVE-2021-25370 Exploited
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory co…
KEV Nov 8, 2022 -
Medium 6.5
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the…
KEV Oct 24, 2022 -
Medium 5.5
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issu…
KEV Sep 8, 2022 -
Medium 5.7CVE-2011-4723 Exploited
The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive info…
KEV Sep 8, 2022 -
Medium 4.3
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 a…
KEV Sep 8, 2022 -
Medium 6.5CVE-2022-2856 Exploited
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a rem…
KEV Aug 18, 2022 -
Medium 6.5
Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to byp…
KEV Jun 27, 2022 -
Medium 5.3
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user info…
KEV Jun 9, 2022 -
Medium 6.1CVE-2012-0767 Exploited
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Window…
KEV Jun 8, 2022 -
Medium 6.5
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially explo…
KEV Jun 8, 2022 -
Medium 6.5
Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted …
KEV May 25, 2022 -
Medium 6.6
Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1…
KEV May 25, 2022 -
Medium 6.5
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the exis…
KEV May 25, 2022 -
Medium 6.5CVE-2013-3993 Exploited · Ransomware
IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restr…
KEV May 25, 2022 -
Medium 5.5
Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, w…
KEV May 25, 2022 -
Medium 5.9
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) …
KEV May 25, 2022 -
Medium 6.1
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has a…
KEV May 24, 2022 -
Medium 4.3
Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaSc…
KEV May 24, 2022 -
Medium 5.5
The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
KEV May 24, 2022 -
Medium 6.5
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via …
KEV May 24, 2022 -
Medium 6.5
Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 a…
KEV May 24, 2022 -
Medium 6.5
Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Win…
KEV May 24, 2022 -
Medium 6.5
Cisco IOS XR Software Health Check Open Port Vulnerability
A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379…
KEV May 23, 2022 -
Medium 6.4CVE-2021-0920 Exploited
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to loc…
KEV May 23, 2022 -
Medium 6.5CVE-2019-0676 Exploited
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker …
KEV May 23, 2022 -
Medium 6.5CVE-2019-0703 Exploited
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Wi…
KEV May 23, 2022 -
Medium 6.5
Use-After-Free in puppeteer
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
KEV May 23, 2022 -
Medium 6.1
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Su…
KEV Apr 19, 2022