Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2018-19949 — QNAP NAS File Station Command Injection Vulnerability
A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
|
QNAP | Network Attached Storage (NAS) | May 24, 2022 | Jun 14, 2022 | Ransomware |
|
CVE-2018-19953 — QNAP NAS File Station Cross-Site Scripting Vulnerability
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
|
QNAP | Network Attached Storage (NAS) | May 24, 2022 | Jun 14, 2022 | Ransomware |
|
CVE-2018-8611 — Microsoft Windows Kernel Privilege Escalation Vulnerability
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.
|
Microsoft | Windows | May 24, 2022 | Jun 14, 2022 | |
|
CVE-2018-5002 — Adobe Flash Player Stack-based Buffer Overflow Vulnerability
Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.
|
Adobe | Flash Player | May 23, 2022 | Jun 13, 2022 | |
|
CVE-2018-8589 — Microsoft Win32k Privilege Escalation Vulnerability
A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.
|
Microsoft | Win32k | May 23, 2022 | Jun 13, 2022 | |
|
CVE-2019-0676 — Microsoft Internet Explorer Information Disclosure Vulnerability
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.
|
Microsoft | Internet Explorer | May 23, 2022 | Jun 13, 2022 | |
|
CVE-2019-0703 — Microsoft Windows SMB Information Disclosure Vulnerability
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.
|
Microsoft | Windows | May 23, 2022 | Jun 13, 2022 | |
|
CVE-2019-0880 — Microsoft Windows Privilege Escalation Vulnerability
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.
|
Microsoft | Windows | May 23, 2022 | Jun 13, 2022 | |
|
CVE-2019-1130 — Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability
A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.
|
Microsoft | Windows | May 23, 2022 | Jun 13, 2022 | Ransomware |
|
CVE-2019-11707 — Mozilla Firefox and Thunderbird Type Confusion Vulnerability
Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.
|
Mozilla | Firefox and Thunderbird | May 23, 2022 | Jun 13, 2022 |
A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.
Network Attached Storage (NAS) · May 24, 2022
A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.
Network Attached Storage (NAS) · May 24, 2022
A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.
Windows · May 24, 2022
Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.
Flash Player · May 23, 2022
A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.
Win32k · May 23, 2022
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.
Internet Explorer · May 23, 2022
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.
Windows · May 23, 2022
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.
Windows · May 23, 2022
A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.
Windows · May 23, 2022
Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.
Firefox and Thunderbird · May 23, 2022