CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 1181–1190 of 1746 records

CVE Vendor Product Added Due Status
CVE-2010-2861 — Adobe ColdFusion Directory Traversal Vulnerability
A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.
 Adobe ColdFusion Mar 25, 2022 Apr 15, 2022 Ransomware
CVE-2010-3035 — Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service Vulnerability
Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service (DoS).
 Cisco IOS XR Mar 25, 2022 Apr 15, 2022
CVE-2010-4344 — Exim Heap-Based Buffer Overflow Vulnerability
Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.
 Exim Exim Mar 25, 2022 Apr 15, 2022
CVE-2010-4345 — Exim Privilege Escalation Vulnerability
Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.
 Exim Exim Mar 25, 2022 Apr 15, 2022
CVE-2012-1823 — PHP-CGI Query String Parameter Vulnerability
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.
 PHP PHP Mar 25, 2022 Apr 15, 2022
CVE-2013-2251 — Apache Struts Improper Input Validation Vulnerability
Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.
 Apache Struts Mar 25, 2022 Apr 15, 2022
CVE-2013-4810 — HP Multiple Products Remote Code Execution Vulnerability
HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.
 Hewlett Packard (HP) ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management Mar 25, 2022 Apr 15, 2022
CVE-2013-5223 — D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability
A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.
 D-Link DSL-2760U Mar 25, 2022 Apr 15, 2022
CVE-2014-0130 — Ruby on Rails Directory Traversal Vulnerability
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.
 Rails Ruby on Rails Mar 25, 2022 Apr 15, 2022
CVE-2014-3120 — Elasticsearch Remote Code Execution Vulnerability
Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.
 Elastic Elasticsearch Mar 25, 2022 Apr 15, 2022