Lucene search
+L
Cisa KevRecent

1727 matches found

CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•62 views

Microsoft Windows Privilege Escalation Vulnerability

Microsoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys Winsock handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges...

7.8CVSS8.2AI score0.19254EPSS
SaveExploits3
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•88 views

Microsoft Office Memory Corruption Vulnerability

Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802...

9.3CVSS8.8AI score0.95121EPSS
SaveExploits7
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•74 views

Microsoft Office and WordPad Remote Code Execution Vulnerability

Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution...

9.3CVSS8.1AI score0.99497EPSS
SaveExploits30
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•92 views

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user...

7.6CVSS8.1AI score0.7729EPSS
SaveExploits4
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•95 views

Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution...

7.6CVSS7.8AI score0.30676EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•38 views

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain...

7.8CVSS8.8AI score0.93651EPSS
SaveExploits3
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•64 views

Microsoft SharePoint Remote Code Execution Vulnerability

Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account...

9.8CVSS8.9AI score0.99913EPSS
SaveExploits30
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•37 views

Microsoft Win32k Privilege Escalation Vulnerability

Microsoft Win32k contains a privilege escalation vulnerability due to the component failing to properly handle objects in memory. Successful exploitation allows an attacker to run code in kernel mode...

7.8CVSS7.4AI score0.53017EPSS
SaveExploits10
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•123 views

Netis WF2419 Devices Remote Code Execution Vulnerability

Netis WF2419 devices contains an unspecified vulnerability that allows an attacker to perform remote code execution as root through the router's web management page...

8.5CVSS8AI score0.28168EPSS
SaveExploits6
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•97 views

Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability

Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems...

10CVSS8.7AI score0.80157EPSS
SaveExploits12
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•44 views

Oracle WebLogic Server Remote Code Execution Vulnerability

Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750...

10CVSS9.2AI score0.99997EPSS
SaveExploits44
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•32 views

Ivanti Pulse Connect Secure Use-After-Free Vulnerability

Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services...

10CVSS9.3AI score0.47172EPSS
SaveExploits9
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•46 views

Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability

Multiple Qualcomm chipsets contain a detection of error condition without action vulnerability when improper handling of address deregistration on failure can lead to new GPU address allocation failure...

6.2CVSS6AI score0.0052EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•32 views

SaltStack Salt Path Traversal Vulnerability

SaltStack Salt contains a path traversal vulnerability in the salt-master process ClearFuncs which allows directory access to authenticated users. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability...

6.5CVSS7.7AI score0.86178EPSS
SaveExploits15
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•122 views

SolarWinds Serv-U Remote Code Execution Vulnerability

SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution...

10CVSS9.6AI score0.9116EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•68 views

SonicWall Email Security Improper Privilege Management Vulnerability

SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-200...

9.8CVSS7.2AI score0.8867EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•92 views

SonicWall SSLVPN SMA100 SQL Injection Vulnerability

SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker...

9.8CVSS9.9AI score0.40038EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•84 views

SonicWall Email Security Path Traversal Vulnerability

SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation...

4.9CVSS7.2AI score0.51407EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•45 views

TeamViewer Desktop Bypass Remote Login Vulnerability

TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended...

7CVSS7.1AI score0.04707EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•80 views

Tenda AC1900 Router AC15 Model Remote Code Execution Vulnerability

Tenda AC1900 Router AC15 Model contains an unspecified vulnerability that allows remote attackers to execute system commands via the deviceName POST parameter...

10CVSS9.3AI score0.7981EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•75 views

TVT NVMS-1000 Directory Traversal Vulnerability

TVT devices utilizing NVMS-1000 software contain a directory traversal vulnerability via GET /.. requests...

7.5CVSS7.3AI score0.96071EPSS
SaveExploits6
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•42 views

vBulletin PHP Module Remote Code Execution Vulnerability

The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfigcode parameter in an ajax/render/widgetphp routestring request...

9.8CVSS9.6AI score0.99728EPSS
SaveExploits28
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•53 views

VMware vCenter Server Improper Input Validation Vulnerability

VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution...

10CVSS9.4AI score0.99999EPSS
SaveExploits12
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•83 views

Zoho ManageEngine Desktop Central File Upload Vulnerability

Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution...

10CVSS9.7AI score0.99941EPSS
SaveExploits6
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•52 views

VMware vCenter Server Remote Code Execution Vulnerability

VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system...

10CVSS9.6AI score0.99865EPSS
SaveExploits48
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•32 views

Oracle Multiple Products Remote Code Execution Vulnerability

Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment...

9.8CVSS9.4AI score0.97116EPSS
SaveExploits26
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•34 views

Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

Atlassian Confluence Server and Data Server contain an Object-Graph Navigation Language OGNL injection vulnerability that may allow an unauthenticated attacker to execute code...

9.8CVSS9.6AI score0.99999EPSS
SaveExploits46
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•70 views

Microsoft Windows Kernel Privilege Escalation Vulnerability

Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation...

7.8CVSS7.8AI score0.05431EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•32 views

Drupal Core Remote Code Execution Vulnerability

Drupal Core contains a remote code execution vulnerability that could allow an attacker to exploit multiple attack vectors on a Drupal site, resulting in complete site compromise...

9.8CVSS9.4AI score0.99991EPSS
SaveExploits49
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•79 views

Apple Multiple Products Memory Corruption Vulnerability

Apple iOS, iPadOS, macOS, and watchOS IOMobileFrameBuffer contain a memory corruption vulnerability which may allow an application to execute code with kernel privileges...

9.3CVSS7.7AI score0.28839EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•50 views

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain...

7.8CVSS8.8AI score0.99876EPSS
SaveExploits31
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•41 views

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain...

7.8CVSS8.8AI score0.95762EPSS
SaveExploits5
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•25 views

Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability

Apple iOS, iPadOS, and macOS WebKit contain an unspecified logic vulnerability that allows a remote attacker to execute code. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing...

9.8CVSS9.2AI score0.07002EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•30 views

Mozilla Firefox And Thunderbird Type Confusion Vulnerability

Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements...

8.8CVSS8.3AI score0.46311EPSS
SaveExploits7
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•82 views

Accellion FTA OS Command Injection Vulnerability

Accellion FTA contains an OS command injection vulnerability exploited via a local web service call...

7.8CVSS8.8AI score0.03654EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•39 views

Adobe Acrobat and Reader Use-After-Free Vulnerability

Adobe Acrobat and Reader contains a use-after-free vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user...

9.6CVSS8.6AI score0.52005EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•68 views

Android Kernel Use-After-Free Vulnerability

Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain "AbstractEmu."...

7.8CVSS7.2AI score0.72105EPSS
SaveExploits31
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•167 views

Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability

Multiple MediaTek chipsets contain an insufficient input validation vulnerability and have missing SELinux restrictions in the Command Queue drivers ioctl handlers. This causes an out-of-bounds write leading to privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and...

7.8CVSS7.3AI score0.0137EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•79 views

Apache Struts Remote Code Execution Vulnerability

Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or...

9.3CVSS8.5AI score0.99991EPSS
SaveExploits42
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•28 views

Apple Multiple Products Race Condition Vulnerability

Apple iOS, iPadOs, macOS, watchOS, and tvOS contain a race condition vulnerability that may allow a malicious application to elevate privileges...

7CVSS7.8AI score0.02222EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•87 views

Apple iOS, iPadOS, and watchOS WebKit Cross-Site Scripting (XSS) Vulnerability

Apple iOS, iPadOS, and watchOS WebKit contain an unspecified vulnerability that allows for universal cross-site scripting XSS when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple...

6.1CVSS6.2AI score0.07082EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•80 views

Arm Trusted Firmware Out-of-Bounds Write Vulnerability

Arm Trusted Firmware contains an out-of-bounds write vulnerability allowing the non-secure NS world to trigger a system halt, overwrite secure data, or print out secure data when calling secure functions under the non-secure processing environment NSPE handler mode. This vulnerability affects...

5.5CVSS5.6AI score0.03093EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•34 views

Cisco ASA and FTD Read-Only Path Traversal Vulnerability

Cisco Adaptive Security Appliance ASA and Firepower Threat Defense FTD contain an improper input validation vulnerability when HTTP requests process URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affect...

7.5CVSS7.4AI score0.99992EPSS
SaveExploits25
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•73 views

Cisco IOS XR Software Discovery Protocol Format String Vulnerability

Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device...

8.8CVSS8.5AI score0.11685EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•77 views

DotNetNuke (DNN) Remote Code Execution Vulnerability

DotNetNuke DNN contains a vulnerability that may allow for remote code execution via cookie deserialization...

8.8CVSS8.9AI score0.94789EPSS
SaveExploits6
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•35 views

Exim Buffer Overflow Vulnerability

Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution...

9.8CVSS9.7AI score0.82137EPSS
SaveExploits19
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•69 views

Google Chrome for Android UI Heap Buffer Overflow Vulnerability

Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page...

9.6CVSS7.5AI score0.06363EPSS
SaveExploits0
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•31 views

Google Chrome FreeType Heap Buffer Overflow Vulnerability

Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function LoadSBitPng when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and...

9.6CVSS8AI score0.44303EPSS
SaveExploits2
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•100 views

Google Chromium V8 Type Confusion Vulnerability

Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and...

8.8CVSS9AI score0.84173EPSS
SaveExploits1
CISA KEV Catalog
CISA KEV Catalog
•added 2021/11/03 12:00 a.m.•62 views

Google Chromium Blink Use-After-Free Vulnerability

Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, an...

8.8CVSS8.8AI score0.0987EPSS
SaveExploits1
Total number of security vulnerabilities1727