Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
214 results · Clear filters · Feed
-
Medium 6.6
Double Free in net/packet/af_packet.c leading to priviledge escalation
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1…
KEV Apr 11, 2022 -
Medium 5.5CVE-2022-22674 Exploited
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input…
KEV Apr 4, 2022 -
Medium 4.7CVE-2012-0518 Exploited
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.…
KEV Mar 28, 2022 -
Medium 4.3
Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via…
KEV Mar 28, 2022 -
Medium 5.3
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriz…
KEV Mar 28, 2022 -
Medium 5.4
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated us…
KEV Mar 25, 2022 -
Medium 5.9CVE-2009-2055 Exploited
Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE …
KEV Mar 25, 2022 -
Medium 6.5
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Servic…
KEV Mar 7, 2022 -
Medium 5.3
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of U…
KEV Mar 7, 2022 -
Medium 5.4
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
KEV Mar 3, 2022 -
Medium 5.3
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unkno…
KEV Mar 3, 2022 -
Medium 6.3CVE-2018-0161 Exploited
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain mod…
KEV Mar 3, 2022 -
Medium 6.8CVE-2018-0179 Exploited
Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthent…
KEV Mar 3, 2022 -
Medium 6.8CVE-2018-0180 Exploited
Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthent…
KEV Mar 3, 2022 -
Medium 6.5CVE-2013-1675 Exploited
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before…
KEV Mar 3, 2022 -
Medium 5.9CVE-2017-12319 Exploited
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE S…
KEV Mar 3, 2022 -
Medium 6.5CVE-2017-12232 Exploited
A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers …
KEV Mar 3, 2022 -
Medium 6.5CVE-2017-12238 Exploited
A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 S…
KEV Mar 3, 2022 -
Medium 6.5CVE-2017-6663 Exploited
A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unau…
KEV Mar 3, 2022 -
Medium 5.5
Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
KEV Mar 3, 2022 -
Medium 6.1
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), …
KEV Feb 25, 2022 -
Medium 4.3CVE-2021-35247 Exploited
Improper Input Validation Vulnerability in Serv-U
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as t…
KEV Jan 21, 2022 -
Medium 4.3
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and …
KEV Jan 10, 2022 -
Medium 5.5
WinVerifyTrust Signature Validation Vulnerability
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Wind…
KEV Jan 10, 2022 -
Medium 5.3
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A mal…
KEV Jan 10, 2022 -
Medium 6.8
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exe…
KEV Nov 17, 2021 -
Medium 4.2CVE-2020-0878 Exploited · Ransomware
Microsoft Browser Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker…
KEV Nov 3, 2021 -
Medium 6.5
SaltStack Salt is vulnerable Arbitrary Directory Access
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
KEV Nov 3, 2021 -
Medium 5.5
Netlogon Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could ru…
KEV Nov 3, 2021 -
Medium 4.3
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directorie…
KEV Nov 3, 2021 -
Medium 5.5
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watc…
KEV Nov 3, 2021 -
Medium 6.1
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against …
KEV Nov 3, 2021 -
Medium 6.5
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…
KEV Nov 3, 2021 -
Medium 6.5
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.…
KEV Nov 3, 2021 -
Medium 4.3
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…
KEV Nov 3, 2021 -
Medium 4.3CVE-2020-9819 Exploited
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5…
KEV Nov 3, 2021 -
Medium 6.6
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information p…
KEV Nov 3, 2021 -
Medium 5.5
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary f…
KEV Nov 3, 2021 -
Medium 5.5
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct…
KEV Nov 3, 2021 -
Medium 6.5
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) atta…
KEV Nov 3, 2021