CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 1471–1480 of 1748 records

CVE Vendor Product Added Due Status
CVE-2016-3643 — SolarWinds Virtualization Manager Privilege Escalation Vulnerability
SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.
 SolarWinds Virtualization Manager Nov 3, 2021 May 3, 2022
CVE-2016-3715 — ImageMagick Arbitrary File Deletion Vulnerability
ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.
 ImageMagick ImageMagick Nov 3, 2021 May 3, 2022
CVE-2016-3718 — ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.
 ImageMagick ImageMagick Nov 3, 2021 May 3, 2022
CVE-2016-3976 — SAP NetWeaver Directory Traversal Vulnerability
SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.
 SAP NetWeaver Nov 3, 2021 May 3, 2022
CVE-2016-4437 — Apache Shiro Code Execution Vulnerability
Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.
 Apache Shiro Nov 3, 2021 May 3, 2022
CVE-2016-7255 — Microsoft Win32k Privilege Escalation Vulnerability
Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.
 Microsoft Win32k Nov 3, 2021 May 3, 2022 Ransomware
CVE-2016-9563 — SAP NetWeaver XML External Entity (XXE) Vulnerability
SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.
 SAP NetWeaver Nov 3, 2021 May 3, 2022
CVE-2017-0143 — Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability
Microsoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.
 Microsoft Windows Nov 3, 2021 May 3, 2022 Ransomware
CVE-2017-0199 — Microsoft Office and WordPad Remote Code Execution Vulnerability
Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.
 Microsoft Office and WordPad Nov 3, 2021 May 3, 2022 Ransomware
CVE-2017-11774 — Microsoft Office Outlook Security Feature Bypass Vulnerability
Microsoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.
 Microsoft Office Nov 3, 2021 May 3, 2022