Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2016-6367 — Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability
A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.
|
Cisco | Adaptive Security Appliance (ASA) | May 24, 2022 | Jun 14, 2022 | |
|
CVE-2017-0005 — Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability
The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.
|
Microsoft | Windows | May 24, 2022 | Jun 14, 2022 | |
|
CVE-2017-0022 — Microsoft XML Core Services Information Disclosure Vulnerability
Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
|
Microsoft | XML Core Services | May 24, 2022 | Jun 14, 2022 | |
|
CVE-2017-0147 — Microsoft Windows SMBv1 Information Disclosure Vulnerability
The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.
|
Microsoft | SMBv1 server | May 24, 2022 | Jun 14, 2022 | Ransomware |
|
CVE-2017-0149 — Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.
|
Microsoft | Internet Explorer | May 24, 2022 | Jun 14, 2022 | |
|
CVE-2017-0210 — Microsoft Internet Explorer Privilege Escalation Vulnerability
A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.
|
Microsoft | Internet Explorer | May 24, 2022 | Jun 14, 2022 | |
|
CVE-2017-18362 — Kaseya VSA SQL Injection Vulnerability
ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.
|
Kaseya | Virtual System/Server Administrator (VSA) | May 24, 2022 | Jun 14, 2022 | Ransomware |
|
CVE-2017-8291 — Artifex Ghostscript Type Confusion Vulnerability
Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
|
Artifex | Ghostscript | May 24, 2022 | Jun 14, 2022 | |
|
CVE-2017-8543 — Microsoft Windows Search Remote Code Execution Vulnerability
Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.
|
Microsoft | Windows | May 24, 2022 | Jun 14, 2022 | |
|
CVE-2018-19943 — QNAP NAS File Station Cross-Site Scripting Vulnerability
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
|
QNAP | Network Attached Storage (NAS) | May 24, 2022 | Jun 14, 2022 | Ransomware |
A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.
Adaptive Security Appliance (ASA) · May 24, 2022
The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.
Windows · May 24, 2022
Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
XML Core Services · May 24, 2022
The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.
SMBv1 server · May 24, 2022
Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.
Internet Explorer · May 24, 2022
A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.
Internet Explorer · May 24, 2022
ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.
Virtual System/Server Administrator (VSA) · May 24, 2022
Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.
Ghostscript · May 24, 2022
Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.
Windows · May 24, 2022
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
Network Attached Storage (NAS) · May 24, 2022