Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2021-38647 — Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.
|
Microsoft | Open Management Infrastructure (OMI) | Nov 3, 2021 | Nov 17, 2021 | Ransomware |
|
CVE-2021-38648 — Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
|
Microsoft | Open Management Infrastructure (OMI) | Nov 3, 2021 | Nov 17, 2021 | |
|
CVE-2021-38649 — Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
|
Microsoft | Open Management Infrastructure (OMI) | Nov 3, 2021 | Nov 17, 2021 | |
|
CVE-2021-40444 — Microsoft MSHTML Remote Code Execution Vulnerability
Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.
|
Microsoft | MSHTML | Nov 3, 2021 | Nov 17, 2021 | Ransomware |
|
CVE-2021-40539 — Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.
|
Zoho | ManageEngine | Nov 3, 2021 | Nov 17, 2021 | Ransomware |
|
CVE-2021-41773 — Apache HTTP Server Path Traversal Vulnerability
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.
|
Apache | HTTP Server | Nov 3, 2021 | Nov 17, 2021 | Ransomware |
|
CVE-2021-42013 — Apache HTTP Server Path Traversal Vulnerability
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.
|
Apache | HTTP Server | Nov 3, 2021 | Nov 17, 2021 | Ransomware |
|
CVE-2021-42258 — BQE BillQuick Web Suite SQL Injection Vulnerability
BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.
|
BQE | BillQuick Web Suite | Nov 3, 2021 | Nov 17, 2021 | Ransomware |
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.
Open Management Infrastructure (OMI) · Nov 3, 2021
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
Open Management Infrastructure (OMI) · Nov 3, 2021
Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.
Open Management Infrastructure (OMI) · Nov 3, 2021
Microsoft MSHTML contains a unspecified vulnerability that allows for remote code execution.
MSHTML · Nov 3, 2021
Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code execution.
ManageEngine · Nov 3, 2021
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.
HTTP Server · Nov 3, 2021
Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.
HTTP Server · Nov 3, 2021
BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.
BillQuick Web Suite · Nov 3, 2021