Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2018-7602 — Drupal Core Remote Code Execution Vulnerability
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
|
Drupal | Drupal Core | Apr 13, 2022 | May 4, 2022 | Ransomware |
|
CVE-2022-24521 — Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
|
Microsoft | Windows | Apr 13, 2022 | May 4, 2022 | Ransomware |
|
CVE-2017-11317 — Telerik UI for ASP.NET AJAX Unrestricted File Upload Vulnerability
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
|
Telerik | User Interface (UI) for ASP.NET AJAX | Apr 11, 2022 | May 2, 2022 | |
|
CVE-2020-2509 — QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
|
QNAP | QNAP Network-Attached Storage (NAS) | Apr 11, 2022 | May 2, 2022 | |
|
CVE-2021-22600 — Linux Kernel Privilege Escalation Vulnerability
Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
|
Linux | Kernel | Apr 11, 2022 | May 2, 2022 | |
|
CVE-2021-27852 — Checkbox Survey Deserialization of Untrusted Data Vulnerability
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.
|
Checkbox | Checkbox Survey | Apr 11, 2022 | May 2, 2022 | |
|
CVE-2021-39793 — Google Pixel Out-of-Bounds Write Vulnerability
Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.
|
Pixel | Apr 11, 2022 | May 2, 2022 | ||
|
CVE-2021-42278 — Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
|
Microsoft | Active Directory | Apr 11, 2022 | May 2, 2022 | Ransomware |
|
CVE-2021-42287 — Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
|
Microsoft | Active Directory | Apr 11, 2022 | May 2, 2022 | Ransomware |
|
CVE-2022-23176 — WatchGuard Firebox and XTM Privilege Escalation Vulnerability
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
|
WatchGuard | Firebox and XTM | Apr 11, 2022 | May 2, 2022 |
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.
Drupal Core · Apr 13, 2022
Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.
Windows · Apr 13, 2022
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
User Interface (UI) for ASP.NET AJAX · Apr 11, 2022
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.
QNAP Network-Attached Storage (NAS) · Apr 11, 2022
Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
Kernel · Apr 11, 2022
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.
Checkbox Survey · Apr 11, 2022
Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.
Pixel · Apr 11, 2022
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Active Directory · Apr 11, 2022
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.
Active Directory · Apr 11, 2022
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.
Firebox and XTM · Apr 11, 2022