CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 1201–1210 of 1746 records

CVE Vendor Product Added Due Status
CVE-2016-11021 — D-Link DCS-930L Devices OS Command Injection Vulnerability
setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.
 D-Link DCS-930L Devices Mar 25, 2022 Apr 15, 2022
CVE-2016-1555 — NETGEAR Multiple WAP Devices Command Injection Vulnerability
Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.
 NETGEAR Wireless Access Point (WAP) Devices Mar 25, 2022 Apr 15, 2022
CVE-2016-4171 — Adobe Flash Player Remote Code Execution Vulnerability
Unspecified vulnerability in Adobe Flash Player allows for remote code execution.
 Adobe Flash Player Mar 25, 2022 Apr 15, 2022
CVE-2016-7892 — Adobe Flash Player Use-After-Free Vulnerability
Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class.
 Adobe Flash Player Mar 25, 2022 Apr 15, 2022
CVE-2017-0146 — Microsoft Windows SMB Remote Code Execution Vulnerability
The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution.
 Microsoft Windows Mar 25, 2022 Apr 15, 2022 Ransomware
CVE-2017-12615 — Apache Tomcat on Windows Remote Code Execution Vulnerability
When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
 Apache Tomcat Mar 25, 2022 Apr 15, 2022 Ransomware
CVE-2017-12617 — Apache Tomcat Remote Code Execution Vulnerability
When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
 Apache Tomcat Mar 25, 2022 Apr 15, 2022
CVE-2017-3881 — Cisco IOS and IOS XE Remote Code Execution Vulnerability
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.
 Cisco IOS and IOS XE Mar 25, 2022 Apr 15, 2022
CVE-2017-6316 — Citrix Multiple Products Remote Code Execution Vulnerability
A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.
 Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server Mar 25, 2022 Apr 15, 2022
CVE-2017-6334 — NETGEAR DGN2200 Devices OS Command Injection Vulnerability
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands
 NETGEAR DGN2200 Devices Mar 25, 2022 Apr 15, 2022
Citrix

CVE-2017-6316 — Citrix Multiple Products Remote Code Execution Vulnerability

A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.

NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server · Mar 25, 2022