CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 181–190 of 390 records

CVE Vendor Product Added Due Status
CVE-2015-6175 — Microsoft Windows Kernel Privilege Escalation Vulnerability
The kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application.
 Microsoft Windows May 25, 2022 Jun 15, 2022
CVE-2016-0034 — Microsoft Silverlight Runtime Remote Code Execution Vulnerability
Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).
 Microsoft Silverlight May 25, 2022 Jun 15, 2022 Ransomware
CVE-2016-3393 — Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability
A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.
 Microsoft Windows May 25, 2022 Jun 15, 2022
CVE-2016-7256 — Microsoft Windows Open Type Font Remote Code Execution Vulnerability
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.
 Microsoft Windows May 25, 2022 Jun 15, 2022
CVE-2016-0162 — Microsoft Internet Explorer Information Disclosure Vulnerability
An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.
 Microsoft Internet Explorer May 24, 2022 Jun 14, 2022
CVE-2016-3298 — Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability
An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.
 Microsoft Internet Explorer May 24, 2022 Jun 14, 2022
CVE-2016-3351 — Microsoft Internet Explorer and Edge Information Disclosure Vulnerability
An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.
 Microsoft Internet Explorer and Edge May 24, 2022 Jun 14, 2022 Ransomware
CVE-2017-0005 — Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability
The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.
 Microsoft Windows May 24, 2022 Jun 14, 2022
CVE-2017-0022 — Microsoft XML Core Services Information Disclosure Vulnerability
Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.
 Microsoft XML Core Services May 24, 2022 Jun 14, 2022
CVE-2017-0147 — Microsoft Windows SMBv1 Information Disclosure Vulnerability
The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.
 Microsoft SMBv1 server May 24, 2022 Jun 14, 2022 Ransomware