CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 221–230 of 390 records

CVE Vendor Product Added Due Status
CVE-2013-3660 — Microsoft Win32k Privilege Escalation Vulnerability
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.
 Microsoft Win32k Mar 28, 2022 Apr 18, 2022
CVE-2015-1770 — Microsoft Office Uninitialized Memory Use Vulnerability
Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document.
 Microsoft Office Mar 28, 2022 Apr 18, 2022
CVE-2015-2419 — Microsoft Internet Explorer Memory Corruption Vulnerability
JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
 Microsoft Internet Explorer Mar 28, 2022 Apr 18, 2022
CVE-2015-2426 — Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.
 Microsoft Windows Mar 28, 2022 Apr 18, 2022
CVE-2016-0040 — Microsoft Windows Kernel Privilege Escalation Vulnerability
The kernel in Microsoft Windows allows local users to gain privileges via a crafted application.
 Microsoft Windows Mar 28, 2022 Apr 18, 2022
CVE-2016-0151 — Microsoft Windows CSRSS Security Feature Bypass Vulnerability
The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.
 Microsoft Client-Server Run-time Subsystem (CSRSS) Mar 28, 2022 Apr 18, 2022 Ransomware
CVE-2016-0189 — Microsoft Internet Explorer Memory Corruption Vulnerability
The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
 Microsoft Internet Explorer Mar 28, 2022 Apr 18, 2022 Ransomware
CVE-2016-7200 — Microsoft Edge Memory Corruption Vulnerability
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
 Microsoft Edge Mar 28, 2022 Apr 18, 2022
CVE-2016-7201 — Microsoft Edge Memory Corruption Vulnerability
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
 Microsoft Edge Mar 28, 2022 Apr 18, 2022
CVE-2017-0037 — Microsoft Edge and Internet Explorer Type Confusion Vulnerability
Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.
 Microsoft Edge and Internet Explorer Mar 28, 2022 Apr 18, 2022