Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2019-2725 — Oracle WebLogic Server, Injection
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
|
Oracle | WebLogic Server | Jan 10, 2022 | Jul 10, 2022 | Ransomware |
|
CVE-2019-7609 — Kibana Arbitrary Code Execution
Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
|
Elastic | Kibana | Jan 10, 2022 | Jul 10, 2022 | |
|
CVE-2019-9670 — Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
|
Synacor | Zimbra Collaboration Suite (ZCS) | Jan 10, 2022 | Jul 10, 2022 | |
|
CVE-2020-6572 — Google Chrome Media Use-After-Free Vulnerability
Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.
|
Chrome Media | Jan 10, 2022 | Jul 10, 2022 | ||
|
CVE-2021-22017 — VMware vCenter Server Improper Access Control
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
|
VMware | vCenter Server | Jan 10, 2022 | Jan 24, 2022 | |
|
CVE-2021-27860 — FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
|
FatPipe | WARP, IPVPN, and MPVPN software | Jan 10, 2022 | Jan 24, 2022 | |
|
CVE-2021-36260 — Hikvision Improper Input Validation
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
|
Hikvision | Security cameras web server | Jan 10, 2022 | Jan 24, 2022 | |
|
CVE-2021-4102 — Google Chromium V8 Use-After-Free Vulnerability
Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
|
Chromium V8 | Dec 15, 2021 | Dec 29, 2021 | ||
|
CVE-2021-43890 — Microsoft Windows AppX Installer Spoofing Vulnerability
Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.
|
Microsoft | Windows | Dec 15, 2021 | Dec 29, 2021 | Ransomware |
|
CVE-2010-1871 — Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.
|
Red Hat | JBoss Seam 2 | Dec 10, 2021 | Jun 10, 2022 |
Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).
WebLogic Server · Jan 10, 2022
Kibana contain an arbitrary code execution flaw in the Timelion visualizer.
Kibana · Jan 10, 2022
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
Zimbra Collaboration Suite (ZCS) · Jan 10, 2022
Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.
Chrome Media · Jan 10, 2022
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
vCenter Server · Jan 10, 2022
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.
WARP, IPVPN, and MPVPN software · Jan 10, 2022
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
Security cameras web server · Jan 10, 2022
Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Chromium V8 · Dec 15, 2021
Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.
Windows · Dec 15, 2021
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.
JBoss Seam 2 · Dec 10, 2021