Lucene search
+L
Cisa KevMost viewed

1678 matches found

CISA KEV Catalog
CISA KEV Catalog
•added 2024/01/23 12:0 a.m.•55 views

Apple Multiple Products WebKit Type Confusion Vulnerability

Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products whi...

8.8CVSS8.7AI score0.10593EPSS
SaveExploits6
CISA KEV Catalog
CISA KEV Catalog
•added 2024/01/10 12:0 a.m.•55 views

Microsoft SharePoint Server Privilege Escalation Vulnerability

Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator...

9.8CVSS7.7AI score0.99649EPSS
SaveExploits10
CISA KEV Catalog
CISA KEV Catalog
•added 2023/10/04 12:0 a.m.•55 views

Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

Microsoft Windows Cryptographic Next Generation CNG Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges...

7CVSS7.1AI score0.01771EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/08/11 12:0 a.m.•55 views

Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

Synacor Zimbra Collaboration Suite ZCS contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution...

9.8CVSS8.8AI score0.98586EPSS
SaveExploits16
CISA KEV Catalog
CISA KEV Catalog
•added 2022/05/25 12:0 a.m.•55 views

Microsoft Windows Remote Code Execution Vulnerability

A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts...

9.3CVSS7.3AI score0.59776EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/05/23 12:0 a.m.•55 views

Microsoft Windows Kernel Privilege Escalation Vulnerability

An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions...

7.8CVSS3.5AI score0.04547EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/25 12:0 a.m.•55 views

Apache Tomcat Remote Code Execution Vulnerability

When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server...

8.1CVSS3.7AI score0.99988EPSS
SaveExploits23
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/25 12:0 a.m.•55 views

D-Link DIR-610 Devices Remote Command Execution

D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php...

8.8CVSS5.8AI score0.21338EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/03 12:0 a.m.•55 views

Microsoft Office Memory Corruption Vulnerability

Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution...

9.3CVSS4AI score0.57705EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:0 a.m.•55 views

Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service Vulnerability

Cisco IP Phones contain an improper input validation vulnerability for HTTP requests. Exploitation could allow an attacker to execute code remotely with root privileges or cause a denial-of-service DoS condition...

10CVSS9.5AI score0.83734EPSS
SaveExploits4
CISA KEV Catalog
CISA KEV Catalog
•added 2025/04/08 12:0 a.m.•54 views

Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key Vulnerability

Gladinet CentreStack and Triofox contains a use of hard-coded cryptographic key vulnerability in the way that the application manages keys used for ViewState integrity verification. Successful exploitation allows an attacker to forge ViewState payloads for server-side deserialization, allowing fo...

9.8CVSS9.6AI score0.93842EPSS
SaveExploits6
CISA KEV Catalog
CISA KEV Catalog
•added 2025/03/19 12:0 a.m.•54 views

NAKIVO Backup and Replication Absolute Path Traversal Vulnerability

NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files...

8.6CVSS6.9AI score0.94356EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2024/01/08 12:0 a.m.•54 views

Apache Superset Insecure Default Initialization of Resource Vulnerability

Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRETKEY according to installation instructions...

9.8CVSS7.1AI score0.97405EPSS
SaveExploits19
CISA KEV Catalog
CISA KEV Catalog
•added 2023/11/13 12:0 a.m.•54 views

Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is...

5.3CVSS7.8AI score0.95101EPSS
SaveExploits4
CISA KEV Catalog
CISA KEV Catalog
•added 2023/05/12 12:0 a.m.•54 views

Red Hat Polkit Incorrect Authorization Vulnerability

Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation...

7.8CVSS7.7AI score0.22193EPSS
SaveExploits37
CISA KEV Catalog
CISA KEV Catalog
•added 2022/07/01 12:0 a.m.•54 views

Microsoft Windows LSA Spoofing Vulnerability

Microsoft Windows Local Security Authority LSA contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM...

8.1CVSS3.5AI score0.10808EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/05/25 12:0 a.m.•54 views

Microsoft Windows Mount Manager Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links...

7.2CVSS6.6AI score0.04111EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2022/02/10 12:0 a.m.•54 views

Microsoft HTTP.sys Remote Code Execution Vulnerability

Microsoft HTTP protocol stack HTTP.sys contains a vulnerability that allows for remote code execution...

10CVSS7AI score0.99999EPSS
SaveExploits18
CISA KEV Catalog
CISA KEV Catalog
•added 2022/02/10 12:0 a.m.•54 views

Microsoft Office Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Office...

9.3CVSS3.3AI score0.81005EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2022/01/18 12:0 a.m.•54 views

Oracle Business Intelligence Enterprise Edition Path Transversal

Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file...

7.8CVSS4.5AI score0.97233EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:0 a.m.•54 views

Amcrest Cameras and NVR Stack-based Buffer Overflow Vulnerability

Amcrest cameras and NVR contain a stack-based buffer overflow vulnerability through port 37777 that allows an unauthenticated, remote attacker to crash the device and possibly execute code...

8.8CVSS8.9AI score0.36217EPSS
SaveExploits4
CISA KEV Catalog
CISA KEV Catalog
•added 2024/09/30 12:0 a.m.•53 views

Motion Spell GPAC Null Pointer Dereference Vulnerability

Motion Spell GPAC contains a null pointer dereference vulnerability that could allow a local attacker to cause a denial-of-service DoS condition...

6.5AI score
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2024/09/03 12:0 a.m.•53 views

Draytek VigorConnect Path Traversal Vulnerability

Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

7.8CVSS6.9AI score0.70659EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2024/01/08 12:0 a.m.•53 views

Joomla! Improper Access Control Vulnerability

Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints...

5.3CVSS7.1AI score0.99827EPSS
SaveExploits43
CISA KEV Catalog
CISA KEV Catalog
•added 2022/06/14 12:0 a.m.•53 views

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application...

9.3CVSS8.2AI score0.99234EPSS
SaveExploits63
CISA KEV Catalog
CISA KEV Catalog
•added 2022/05/16 12:0 a.m.•53 views

Zyxel Multiple Firewalls OS Command Injection Vulnerability

A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device...

10CVSS5.3AI score0.99944EPSS
SaveExploits27
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/25 12:0 a.m.•53 views

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation...

7.8CVSS3.5AI score0.41683EPSS
SaveExploits4
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/03 12:0 a.m.•53 views

Cisco IOS Software Denial-of-Service Vulnerability

A vulnerability in the Login Enhancements Login Block feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service DoS condition...

7.1CVSS4.5AI score0.04967EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/03 12:0 a.m.•53 views

Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability

An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor CP that allows a privileged attacker to remotely cause a denial of service...

7.5CVSS5.9AI score0.03624EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:0 a.m.•53 views

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution...

10CVSS9.2AI score0.62913EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:0 a.m.•53 views

Fortinet FortiOS SSL VPN Path Traversal Vulnerability

Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests...

9.8CVSS8.9AI score0.99999EPSS
SaveExploits22
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:0 a.m.•53 views

Oracle WebLogic Server Deserialization of Untrusted Data Vulnerability

Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution...

9.8CVSS9.3AI score0.96032EPSS
SaveExploits18
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:0 a.m.•53 views

Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability

Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login...

10CVSS8.9AI score0.11858EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:0 a.m.•53 views

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application...

7.8CVSS7.6AI score0.05729EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:0 a.m.•53 views

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode...

7.8CVSS7.6AI score0.0189EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:0 a.m.•53 views

Arm Mali Graphics Processing Unit (GPU) Use-After-Free Vulnerability

Arm Mali Graphics Processing Unit GPU kernel driver contains a use-after-free vulnerability that may allow a non-privileged user to make improper operations on GPU memory to gain root privilege, and/or disclose information...

9CVSS8.3AI score0.12084EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2024/06/13 12:0 a.m.•52 views

Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability

Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges...

7.8CVSS7.2AI score0.04014EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2023/03/30 12:0 a.m.•52 views

Linux Kernel Use-After-Free Vulnerability

Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user...

7.9CVSS8AI score0.03702EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2023/01/26 12:0 a.m.•52 views

Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability

Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution...

9.8CVSS2.7AI score0.75709EPSS
SaveExploits5
CISA KEV Catalog
CISA KEV Catalog
•added 2023/01/23 12:0 a.m.•52 views

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario...

9.8CVSS2.6AI score0.99753EPSS
SaveExploits15
CISA KEV Catalog
CISA KEV Catalog
•added 2022/12/13 12:0 a.m.•52 views

Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability

Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests...

9.8CVSS8.2AI score0.99474EPSS
SaveExploits11
CISA KEV Catalog
CISA KEV Catalog
•added 2022/11/14 12:0 a.m.•52 views

Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability

Microsoft Windows Mark of the Web MOTW contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features...

5.4CVSS2.2AI score0.02398EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/05/25 12:0 a.m.•52 views

Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability

A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system...

9.3CVSS3.8AI score0.68684EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/04/15 12:0 a.m.•52 views

Ubiquiti AirOS Command Injection Vulnerability

Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi...

9.8CVSS3.8AI score0.34641EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/04/04 12:0 a.m.•52 views

Apple macOS Out-of-Bounds Read Vulnerability

macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory...

5.5CVSS3.2AI score0.01133EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/28 12:0 a.m.•52 views

Microsoft Edge Memory Corruption Vulnerability

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service memory corruption via a crafted web site...

8.8CVSS6.2AI score0.79687EPSS
SaveExploits7
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/07 12:0 a.m.•52 views

NETGEAR DGN2200 Remote Code Execution Vulnerability

NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution...

10CVSS9.4AI score0.68201EPSS
SaveExploits6
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/03 12:0 a.m.•52 views

Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability

A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and denial of service...

7.5CVSS7.3AI score0.06042EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/03 12:0 a.m.•52 views

Microsoft Office Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user...

9.3CVSS4AI score0.81454EPSS
SaveExploits3
CISA KEV Catalog
CISA KEV Catalog
•added 2022/03/03 12:0 a.m.•52 views

Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability

The Dynamic Host Configuration Protocol DHCP relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system...

10CVSS3.4AI score0.13883EPSS
SaveExploits0
Total number of security vulnerabilities1678