Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2020-8260 — Ivanti Pulse Connect Secure Code Execution Vulnerability
Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.
|
Ivanti | Pulse Connect Secure | Nov 3, 2021 | May 3, 2022 | |
|
CVE-2020-8467 — Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability
Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.
|
Trend Micro | Apex One and OfficeScan | Nov 3, 2021 | May 3, 2022 | |
|
CVE-2020-8468 — Trend Micro Multiple Products Content Validation Escape Vulnerability
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.
|
Trend Micro | Apex One, OfficeScan and Worry-Free Business Security Agents | Nov 3, 2021 | May 3, 2022 | |
|
CVE-2020-8515 — Multiple DrayTek Vigor Routers Web Management Page Vulnerability
DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
|
DrayTek | Multiple Vigor Routers | Nov 3, 2021 | May 3, 2022 | |
|
CVE-2020-8599 — Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.
|
Trend Micro | Apex One and OfficeScan | Nov 3, 2021 | May 3, 2022 | |
|
CVE-2020-8644 — PlaySMS Server-Side Template Injection Vulnerability
PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.
|
PlaySMS | PlaySMS | Nov 3, 2021 | May 3, 2022 | |
|
CVE-2020-8655 — EyesOfNetwork Improper Privilege Management Vulnerability
EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7.
|
EyesOfNetwork | EyesOfNetwork | Nov 3, 2021 | May 3, 2022 | |
|
CVE-2020-8657 — EyesOfNetwork Use of Hard-Coded Credentials Vulnerability
EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token.
|
EyesOfNetwork | EyesOfNetwork | Nov 3, 2021 | May 3, 2022 | |
|
CVE-2020-9818 — Apple iOS, iPadOS, and watchOS Out-of-Bounds Write Vulnerability
Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.
|
Apple | iOS, iPadOS, and watchOS | Nov 3, 2021 | May 3, 2022 | |
|
CVE-2020-9819 — Apple iOS, iPadOS, and watchOS Memory Corruption Vulnerability
Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.
|
Apple | iOS, iPadOS, and watchOS | Nov 3, 2021 | May 3, 2022 |
Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction.
Pulse Connect Secure · Nov 3, 2021
Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution.
Apex One and OfficeScan · Nov 3, 2021
Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components.
Apex One, OfficeScan and Worry-Free Business Security Agents · Nov 3, 2021
DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
Multiple Vigor Routers · Nov 3, 2021
Trend Micro Apex One and OfficeScan server contain a vulnerable EXE file that could allow a remote attacker to write data to a path on affected installations and bypass root login.
Apex One and OfficeScan · Nov 3, 2021
PlaySMS contains a server-side template injection vulnerability that allows for remote code execution.
PlaySMS · Nov 3, 2021
EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7.
EyesOfNetwork · Nov 3, 2021
EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token.
EyesOfNetwork · Nov 3, 2021
Apple iOS, iPadOS, and watchOS Mail contains an out-of-bounds write vulnerability which may allow memory modification or application termination when processing a maliciously crafted mail message.
iOS, iPadOS, and watchOS · Nov 3, 2021
Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message.
iOS, iPadOS, and watchOS · Nov 3, 2021