CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

CVE	Vendor	Product	Added	Due	Status
CVE-2009-0557 — Microsoft Office Object Record Corruption Vulnerability Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.	Microsoft	Office	Jun 8, 2022	Jun 22, 2022
CVE-2009-0563 — Microsoft Office Buffer Overflow Vulnerability Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.	Microsoft	Office	Jun 8, 2022	Jun 22, 2022
CVE-2010-2572 — Microsoft PowerPoint Buffer Overflow Vulnerability Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.	Microsoft	PowerPoint	Jun 8, 2022	Jun 22, 2022
CVE-2012-0151 — Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.	Microsoft	Windows	Jun 8, 2022	Jun 22, 2022
CVE-2012-1889 — Microsoft XML Core Services Memory Corruption Vulnerability Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.	Microsoft	XML Core Services	Jun 8, 2022	Jun 22, 2022
CVE-2012-4969 — Microsoft Internet Explorer Use-After-Free Vulnerability Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.	Microsoft	Internet Explorer	Jun 8, 2022	Jun 22, 2022
CVE-2013-1331 — Microsoft Office Buffer Overflow Vulnerability Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document.	Microsoft	Office	Jun 8, 2022	Jun 22, 2022
CVE-2013-0074 — Microsoft Silverlight Double Dereference Vulnerability Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.	Microsoft	Silverlight	May 25, 2022	Jun 15, 2022	Ransomware
CVE-2013-3896 — Microsoft Silverlight Information Disclosure Vulnerability Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.	Microsoft	Silverlight	May 25, 2022	Jun 15, 2022
CVE-2013-7331 — Microsoft Internet Explorer Information Disclosure Vulnerability An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.	Microsoft	Internet Explorer	May 25, 2022	Jun 15, 2022

Microsoft

CVE-2009-0557 — Microsoft Office Object Record Corruption Vulnerability

Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.

Office · Jun 8, 2022

Microsoft

CVE-2009-0563 — Microsoft Office Buffer Overflow Vulnerability

Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.

Office · Jun 8, 2022

Microsoft

CVE-2010-2572 — Microsoft PowerPoint Buffer Overflow Vulnerability

Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.

PowerPoint · Jun 8, 2022

Microsoft

CVE-2012-0151 — Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability

The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.

Windows · Jun 8, 2022

Microsoft

CVE-2012-1889 — Microsoft XML Core Services Memory Corruption Vulnerability

Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.

XML Core Services · Jun 8, 2022

Microsoft

CVE-2012-4969 — Microsoft Internet Explorer Use-After-Free Vulnerability

Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.

Internet Explorer · Jun 8, 2022

Microsoft

CVE-2013-1331 — Microsoft Office Buffer Overflow Vulnerability

Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document.

Office · Jun 8, 2022

Ransomware Microsoft

CVE-2013-0074 — Microsoft Silverlight Double Dereference Vulnerability

Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.

Silverlight · May 25, 2022

Microsoft

CVE-2013-3896 — Microsoft Silverlight Information Disclosure Vulnerability

Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.

Silverlight · May 25, 2022

Microsoft

CVE-2013-7331 — Microsoft Internet Explorer Information Disclosure Vulnerability

An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.

Internet Explorer · May 25, 2022