CISA Known Exploited Vulnerabilities

1,779 results · Feed

• High 7.5
  CVE-2018-15811 Exploited Public exploit Scanner template EPSS 76%

  Inadequate Encryption Strength in DotNetNuke

  DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.

  DotNetNuke.Core NuGet
  Jul 3, 2019

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2018-15961 Exploited Public exploit Scanner template EPSS 100%

  Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an un…

  Adobe ColdFusion
  Sep 25, 2018

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2018-14558 Exploited

  An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware thro…

  Oct 30, 2018

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2018-20062 Exploited Public exploit Scanner template EPSS 100%

  An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PH…

  Dec 11, 2018

  KEV Nov 3, 2021
• High 8.8
  CVE-2012-0158 Exploited · Ransomware Public exploit EPSS 100%

  The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Control…

  Apr 10, 2012

  KEV Nov 3, 2021
• Critical 9.1
  CVE-2012-3152 Exploited Public exploit EPSS 99%

  Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and…

  Oct 16, 2012

  KEV Nov 3, 2021
• High 8.8
  CVE-2014-1812 Exploited · Ransomware Public exploit EPSS 65%

  The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Wind…

  May 14, 2014

  KEV Nov 3, 2021
• High 7.8
  CVE-2016-0185 Exploited Public exploit EPSS 70%

  Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrar…

  May 11, 2016

  KEV Nov 3, 2021
• High 7.8
  CVE-2016-0167 Exploited · Ransomware

  The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, …

  Apr 12, 2016

  KEV Nov 3, 2021
• High 7.8
  CVE-2016-7255 Exploited · Ransomware Public exploit EPSS 81%

  The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,…

  Nov 10, 2016

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2016-4437 Exploited Public exploit Scanner template EPSS 93%

  Improper Access Control in Apache Shiro

  Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

  shiro shiro org.apache.shiro:shiro-core Debian Ubuntu Maven
  Jun 7, 2016

  KEV Nov 3, 2021
• Medium 5.5
  CVE-2016-3715 Exploited Public exploit EPSS 75%

  The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary f…

  imagemagick imagemagick graphicsmagick graphicsmagick Debian Ubuntu
  May 5, 2016

  KEV Nov 3, 2021
• High 7.8
  CVE-2016-3235 Exploited Public exploit EPSS 43%

  Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mish…

  Jun 16, 2016

  KEV Nov 3, 2021
• High 7.5
  CVE-2016-3976 Exploited Public exploit EPSS 47%

  Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary fi…

  Apr 7, 2016

  KEV Nov 3, 2021
• High 7.8
  CVE-2016-3643 Exploited Public exploit

  SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfigurati…

  Jun 17, 2016

  KEV Nov 3, 2021
• Medium 5.5
  CVE-2016-3718 Exploited Public exploit EPSS 76%

  The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct…

  imagemagick imagemagick graphicsmagick graphicsmagick Debian Ubuntu
  May 5, 2016

  KEV Nov 3, 2021
• Medium 6.5
  CVE-2016-9563 Exploited EPSS 24%

  BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) atta…

  Nov 23, 2016

  KEV Nov 3, 2021
• Critical 10.0
  CVE-2010-5326 Exploited EPSS 18%

  The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentic…

  May 13, 2016

  KEV Nov 3, 2021
• High 8.8
  CVE-2017-0143 Exploited · Ransomware Public exploit EPSS 93%

  The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…

  Microsoft Windows SMB Windows
  Mar 17, 2017

  KEV Nov 3, 2021
• High 7.8
  CVE-2017-0199 Exploited · Ransomware Public exploit EPSS 99%

  Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windo…

  Microsoft Office/WordPad
  Apr 12, 2017

  KEV Nov 3, 2021
• High 7.8
  CVE-2017-16651 Exploited Public exploit EPSS 46%

  Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary fil…

  roundcube roundcube roundcubemail Debian Ubuntu Alpine
  Nov 9, 2017

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2017-7269 Exploited Public exploit Scanner template EPSS 100%

  Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 i…

  Mar 27, 2017

  KEV Nov 3, 2021
• High 7.8
  CVE-2017-11882 Exploited · Ransomware Public exploit EPSS 100%

  Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and M…

  Microsoft Microsoft Office
  Nov 15, 2017

  KEV Nov 3, 2021
• High 7.8
  CVE-2017-11774 Exploited Public exploit EPSS 60%

  Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary comman…

  Microsoft Microsoft Outlook
  Oct 13, 2017

  KEV Nov 3, 2021
• High 8.8
  CVE-2017-6327 Exploited Public exploit EPSS 36%

  The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a sit…

  Symantec Messaging Gateway
  Aug 11, 2017

  KEV Nov 3, 2021
• High 7.8
  CVE-2017-8759 Exploited Public exploit EPSS 89%

  Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely v…

  Microsoft Microsoft .NET Framework
  Sep 13, 2017

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2017-9248 Exploited Public exploit EPSS 75%

  Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does no…

  Jul 3, 2017

  KEV Nov 3, 2021
• High 8.1
  CVE-2017-9805 Exploited Public exploit Scanner template EPSS 99%

  REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

  The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloa…

  Apache Software Foundation Apache Struts org.apache.struts:struts2-rest-plugin Maven
  Sep 15, 2017

  KEV Nov 3, 2021
• High 8.8
  CVE-2017-9822 Exploited · Ransomware Public exploit Scanner template EPSS 95%

  DNN (aka DotNetNuke) has Remote Code Execution via a cookie

  DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

  DotNetNuke DotNetNuke CMS Fixed in 9.1.1 DotNetNuke.Core NuGet
  Jul 20, 2017

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2017-5638 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

  The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted …

  Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  Mar 11, 2017

  KEV Nov 3, 2021
• Critical 9.1
  CVE-2021-34473 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2016 Cumulative Update 19 Microsoft Exchange Server 2019 Cumulative Update 8
  Jul 14, 2021

  KEV Nov 3, 2021
• Critical 9.0
  CVE-2021-34523 Exploited · Ransomware Public exploit EPSS 100%

  Microsoft Exchange Server Elevation of Privilege Vulnerability

  Microsoft Exchange Server Elevation of Privilege Vulnerability

  Microsoft Microsoft Exchange Server 2013 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 8 Microsoft Exchange Server 2016 Cumulative Update 19
  Jul 14, 2021

  KEV Nov 3, 2021
• Medium 6.8
  CVE-2021-34448 Exploited EPSS 40%

  Scripting Engine Memory Corruption Vulnerability

  Scripting Engine Memory Corruption Vulnerability

  Microsoft Windows Server 2019 Windows 10 Version 1809 Windows Server 2016 Windows
  Jul 16, 2021

  KEV Nov 3, 2021
• High 8.8
  CVE-2021-34527 Exploited · Ransomware Public exploit EPSS 100%

  Windows Print Spooler Remote Code Execution Vulnerability

  A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could th…

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jul 2, 2021

  KEV Nov 3, 2021
• High 7.5
  CVE-2021-33742 Exploited EPSS 59%

  Windows MSHTML Platform Remote Code Execution Vulnerability

  Windows MSHTML Platform Remote Code Execution Vulnerability

  Microsoft Windows Server 2019 Windows 10 Version 1809 Windows Server 2016 Windows
  Jun 8, 2021

  KEV Nov 3, 2021
• High 8.4
  CVE-2021-33739 Exploited Public exploit

  Microsoft DWM Core Library Elevation of Privilege Vulnerability

  Microsoft DWM Core Library Elevation of Privilege Vulnerability

  Microsoft Windows 10 Version 20H2 Windows 10 Version 1909 Windows Server version 20H2 Windows
  Jun 8, 2021

  KEV Nov 3, 2021
• High 7.8
  CVE-2021-33771 Exploited EPSS 10%

  Windows Kernel Elevation of Privilege Vulnerability

  Windows Kernel Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Jul 14, 2021

  KEV Nov 3, 2021
• Critical 9.0
  CVE-2021-35211 Exploited · Ransomware Public exploit Scanner template EPSS 91%

  Serv-U Remote Memory Escape Vulnerability

  Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds…

  SolarWinds Serv-U Managed File Transfer Server and Serv-U Secured FTP
  Jul 14, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-35464 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple p…

  Jul 22, 2021

  KEV Nov 3, 2021
• Critical 9.8
  CVE-2021-35395 Exploited Scanner template EPSS 98%

  Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be …

  Aug 16, 2021

  KEV Nov 3, 2021