CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 1621–1630 of 1748 records

CVE Vendor Product Added Due Status
CVE-2020-6207 — SAP Solution Manager Missing Authentication for Critical Function Vulnerability
SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.
 SAP Solution Manager Nov 3, 2021 May 3, 2022
CVE-2020-6287 — SAP NetWeaver Missing Authentication for Critical Function Vulnerability
SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.
 SAP NetWeaver Nov 3, 2021 May 3, 2022
CVE-2020-6418 — Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 Engine contains a type confusion vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
 Google Chromium V8 Nov 3, 2021 May 3, 2022
CVE-2020-6819 — Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.
 Mozilla Firefox and Thunderbird Nov 3, 2021 May 3, 2022
CVE-2020-6820 — Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
Mozilla Firefox and Thunderbird contain a race condition vulnerability when handling a ReadableStream under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.
 Mozilla Firefox and Thunderbird Nov 3, 2021 May 3, 2022
CVE-2020-7961 — Liferay Portal Deserialization of Untrusted Data Vulnerability
Liferay Portal contains a deserialization of untrusted data vulnerability that allows remote attackers to execute code via JSON web services.
 Liferay Liferay Portal Nov 3, 2021 May 3, 2022
CVE-2020-8193 — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation.
 Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Nov 3, 2021 May 3, 2022
CVE-2020-8195 — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
 Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Nov 3, 2021 May 3, 2022
CVE-2020-8196 — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure Vulnerability
Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an information disclosure vulnerability.
 Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Nov 3, 2021 May 3, 2022
CVE-2020-8243 — Ivanti Pulse Connect Secure Code Execution Vulnerability
Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution.
 Ivanti Pulse Connect Secure Nov 3, 2021 May 3, 2022