Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
1,779 results · Feed
-
High 7.8
Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
KEV Apr 23, 2024 -
Critical 10.0
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbi…
KEV Apr 12, 2024 -
Critical 9.8
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the co…
KEV Apr 11, 2024 -
High 7.3
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Requ…
KEV Apr 11, 2024 -
High 7.8CVE-2024-29748 Exploited
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege wi…
KEV Apr 4, 2024 -
Medium 5.5CVE-2024-29745 Exploited
there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure w…
KEV Apr 4, 2024 -
High 7.2
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
KEV Mar 26, 2024 -
Critical 9.3
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS versi…
KEV Mar 25, 2024 -
Critical 9.8
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execu…
KEV Mar 25, 2024 -
Critical 9.8
Linear eMerge E3-Series devices allow Command Injections.
KEV Mar 25, 2024 -
Critical 9.8
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
KEV Mar 7, 2024 -
High 7.8CVE-2024-23225 Exploited
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, …
KEV Mar 6, 2024 -
High 7.8
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, …
KEV Mar 6, 2024 -
Medium 6.2CVE-2023-21237 Exploited
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification…
KEV Mar 5, 2024 -
Critical 9.8
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dn…
KEV Mar 5, 2024 -
High 7.8
Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
KEV Mar 4, 2024 -
High 8.4
Microsoft Streaming Service Elevation of Privilege Vulnerability
Microsoft Streaming Service Elevation of Privilege Vulnerability
KEV Feb 29, 2024 -
Critical 10.0
Authentication bypass using an alternate path or channel
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
KEV Feb 22, 2024 -
High 7.5
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could …
KEV Feb 15, 2024 -
Critical 9.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
KEV Feb 15, 2024 -
High 8.1
Internet Shortcut Files Security Feature Bypass Vulnerability
Internet Shortcut Files Security Feature Bypass Vulnerability
KEV Feb 13, 2024 -
High 7.6
Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
KEV Feb 13, 2024 -
Medium 6.1
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craf…
KEV Feb 12, 2024 -
Critical 9.6
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0…
KEV Feb 9, 2024 -
High 8.8
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a…
KEV Feb 6, 2024 -
High 7.0CVE-2022-48618 Exploited
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPad…
KEV Jan 31, 2024 -
High 8.2
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Polic…
KEV Jan 31, 2024 -
Critical 10.0
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated att…
KEV Jan 24, 2024 -
High 8.8
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15…
KEV Jan 23, 2024 -
Critical 9.8
VMware vCenter Server Out-of-Bounds Write Vulnerability
vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.
KEV Jan 22, 2024 -
Critical 10.0
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted f…
KEV Jan 18, 2024 -
Medium 5.5CVE-2023-6548 Exploited
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker wit…
KEV Jan 17, 2024 -
High 8.2
Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows U…
KEV Jan 17, 2024 -
High 8.8
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exp…
KEV Jan 17, 2024 -
High 8.1
Laravel Framework RCE Vulnerability
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and Pendi…
KEV Jan 16, 2024 -
Critical 9.8
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft SharePoint Server Elevation of Privilege Vulnerability
KEV Jan 10, 2024 -
High 8.2
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a r…
KEV Jan 10, 2024 -
Critical 9.1
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,…
KEV Jan 10, 2024 -
Critical 9.8
Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user in…
KEV Jan 8, 2024 -
Critical 9.8
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not requir…
KEV Jan 8, 2024