Source
CISA Known Exploited Vulnerabilities
Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
1,779 results · Feed
-
Critical 9.0
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security res…
KEV Nov 3, 2021 -
Critical 9.1
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command …
KEV Nov 3, 2021 -
Medium 4.3
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directorie…
KEV Nov 3, 2021 -
Critical 9.1
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary c…
KEV Nov 3, 2021 -
Critical 9.8
An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web inte…
KEV Nov 3, 2021 -
Critical 9.8
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The …
KEV Nov 3, 2021 -
High 8.4
Microsoft Exchange Remote Code Execution Vulnerability
Microsoft Exchange Remote Code Execution Vulnerability
KEV Nov 3, 2021 -
High 7.8
Windows Kernel Local Elevation of Privilege Vulnerability
Windows Kernel Local Elevation of Privilege Vulnerability
KEV Nov 3, 2021 -
Critical 9.8
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabb…
KEV Nov 3, 2021 -
Critical 9.8
Remote code execution in Apache Struts
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
KEV Nov 3, 2021 -
High 7.8CVE-2020-24557 Exploited
A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an att…
KEV Nov 3, 2021 -
High 7.8
A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, wa…
KEV Nov 3, 2021 -
High 7.8
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS…
KEV Nov 3, 2021 -
Medium 5.5
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watc…
KEV Nov 3, 2021 -
High 7.5
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a u…
KEV Nov 3, 2021 -
Critical 10.0
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as …
KEV Nov 3, 2021 -
High 8.1CVE-2020-6820 Exploited
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of …
KEV Nov 3, 2021 -
High 8.1CVE-2020-6819 Exploited
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are a…
KEV Nov 3, 2021 -
Critical 10.0
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication …
KEV Nov 3, 2021 -
High 8.8
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corr…
KEV Nov 3, 2021 -
Critical 10.0
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform a…
KEV Nov 3, 2021 -
Critical 9.8
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Serv…
KEV Nov 3, 2021 -
Critical 9.8
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650…
KEV Nov 3, 2021 -
High 8.6CVE-2020-3569 Exploited
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerabilities
Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it co…
KEV Nov 3, 2021 -
Medium 6.1
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against …
KEV Nov 3, 2021 -
High 7.8
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for…
KEV Nov 3, 2021 -
High 8.8
Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability
A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of st…
KEV Nov 3, 2021 -
Critical 9.8
Cisco IP Phones Web Server Remote Code Execution and Denial of Service Vulnerability
A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to…
KEV Nov 3, 2021 -
High 8.6CVE-2020-3566 Exploited
Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability
A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue manageme…
KEV Nov 3, 2021 -
High 7.5
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Read-Only Path Traversal Vulnerability
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files…
KEV Nov 3, 2021 -
Critical 9.8
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). S…
KEV Nov 3, 2021 -
Critical 9.8
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in includ…
KEV Nov 3, 2021 -
Medium 6.5
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…
KEV Nov 3, 2021 -
High 7.2
A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perfor…
KEV Nov 3, 2021 -
Medium 6.5
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.…
KEV Nov 3, 2021 -
Medium 4.3
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14…
KEV Nov 3, 2021 -
High 7.2
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to uplo…
KEV Nov 3, 2021 -
High 8.8
A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow …
KEV Nov 3, 2021 -
Critical 9.8
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allo…
KEV Nov 3, 2021 -
Critical 9.8
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker t…
KEV Nov 3, 2021