CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 1421–1430 of 1748 records

CVE Vendor Product Added Due Status
CVE-2021-33766 — Microsoft Exchange Server Information Disclosure
Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.
 Microsoft Exchange Server Jan 18, 2022 Feb 1, 2022
CVE-2021-40870 — Aviatrix Controller Unrestricted Upload of File
Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
 Aviatrix Aviatrix Controller Jan 18, 2022 Feb 1, 2022
CVE-2013-3900 — Microsoft WinVerifyTrust function Remote Code Execution
A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.
 Microsoft WinVerifyTrust function Jan 10, 2022 Jul 10, 2022
CVE-2015-7450 — IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
 IBM WebSphere Application Server and Server Hypervisor Edition Jan 10, 2022 Jul 10, 2022
CVE-2017-1000486 — Primetek Primefaces Remote Code Execution Vulnerability
Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution
 Primetek Primefaces Application Jan 10, 2022 Jul 10, 2022
CVE-2018-13382 — Fortinet FortiOS and FortiProxy Improper Authorization
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
 Fortinet FortiOS and FortiProxy Jan 10, 2022 Jul 10, 2022 Ransomware
CVE-2018-13383 — Fortinet FortiOS and FortiProxy Out-of-bounds Write
A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
 Fortinet FortiOS and FortiProxy Jan 10, 2022 Jul 10, 2022 Ransomware
CVE-2019-10149 — Exim Mail Transfer Agent (MTA) Improper Input Validation
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
 Exim Mail Transfer Agent (MTA) Jan 10, 2022 Jul 10, 2022
CVE-2019-1458 — Microsoft Win32k Privilege Escalation Vulnerability
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.
 Microsoft Win32k Jan 10, 2022 Jul 10, 2022 Ransomware
CVE-2019-1579 — Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
 Palo Alto Networks PAN-OS Jan 10, 2022 Jul 10, 2022 Ransomware