Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
1,779 results · Feed
-
High 7.5
Active Directory Domain Services Elevation of Privilege Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
KEV Apr 11, 2022 -
High 7.5
Active Directory Domain Services Elevation of Privilege Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
KEV Apr 11, 2022 -
Medium 6.6
Double Free in net/packet/af_packet.c leading to priviledge escalation
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1…
KEV Apr 11, 2022 -
High 8.1
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…
KEV Apr 6, 2022 -
Critical 9.8
HTTP Protocol Stack Remote Code Execution Vulnerability
HTTP Protocol Stack Remote Code Execution Vulnerability
KEV Apr 6, 2022 -
High 7.8
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privileg…
KEV Apr 6, 2022 -
Critical 9.8
Remote Code Execution in Spring Framework
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…
KEV Apr 4, 2022 -
Medium 5.5CVE-2022-22674 Exploited
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input…
KEV Apr 4, 2022 -
High 7.8
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6…
KEV Apr 4, 2022 -
Critical 9.8
A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826…
KEV Apr 4, 2022 -
Critical 9.8
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_a…
KEV Mar 31, 2022 -
Critical 9.8
An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?image…
KEV Mar 31, 2022 -
Critical 9.8
An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Soph…
KEV Mar 31, 2022 -
Critical 9.8
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to up…
KEV Mar 31, 2022 -
High 7.8
Windows User Profile Service Elevation of Privilege Vulnerability
Windows User Profile Service Elevation of Privilege Vulnerability
KEV Mar 31, 2022 -
Critical 10.0
Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.…
KEV Mar 31, 2022 -
High 8.8
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privil…
KEV Mar 31, 2022 -
High 8.8
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office docume…
KEV Mar 28, 2022 -
High 8.8
JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial …
KEV Mar 28, 2022 -
High 8.8
Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server …
KEV Mar 28, 2022 -
High 7.8
afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly vali…
KEV Mar 28, 2022 -
High 7.8CVE-2018-8406 Exploited · Ransomware
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles obj…
KEV Mar 28, 2022 -
High 7.8
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (…
KEV Mar 28, 2022 -
High 7.8CVE-2018-8405 Exploited · Ransomware
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles obj…
KEV Mar 28, 2022 -
High 8.8
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before…
KEV Mar 28, 2022 -
High 7.8
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Wind…
KEV Mar 28, 2022 -
High 8.8
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary c…
KEV Mar 28, 2022 -
Critical 9.8
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 …
KEV Mar 28, 2022 -
High 8.8
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attac…
KEV Mar 28, 2022 -
Medium 4.7CVE-2012-0518 Exploited
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.…
KEV Mar 28, 2022 -
High 7.8
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office…
KEV Mar 28, 2022 -
High 7.5CVE-2012-2034 Exploited
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x…
KEV Mar 28, 2022 -
Critical 9.8
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allo…
KEV Mar 28, 2022 -
Critical 10.0
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specifi…
KEV Mar 28, 2022 -
High 8.8
Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corru…
KEV Mar 28, 2022 -
High 7.8
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to …
KEV Mar 28, 2022 -
High 7.5
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other…
KEV Mar 28, 2022 -
High 7.8
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1,…
KEV Mar 28, 2022 -
High 8.8
ChakraCore RCE Vulnerability
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerabili…
KEV Mar 28, 2022 -
High 8.8
ChakraCore RCE Vulnerability
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerabili…
KEV Mar 28, 2022