[ Exploited · 1,754 CVEs ]
Exploited in the wild.
Every CVE on CISA's Known Exploited Vulnerabilities catalogue, most recently added first. If you run one of these products, patch it now.
KEV catalogue version 2026.10.21
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2020-4428 | 7 May 2020 | CVSS 9.1 | IBM Data Risk Manager Remote Code ExecutionIBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM… | ExploitedFix |
| CVE-2020-4427 | 7 May 2020 | CVSS 9.8 | IBM Data Risk Manager Security BypassIBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with… | ExploitedFix |
| CVE-2020-4006 | 23 Nov 2020 | CVSS 9.1 | Multiple VMware Products Command InjectionVMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. | Exploited |
| CVE-2020-3992 | 20 Oct 2020 | CVSS 9.8 | VMware ESXi OpenSLP Use-After-FreeOpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a… | ExploitedFix |
| CVE-2020-3952 | 10 Apr 2020 | CVSS 9.8 | VMware vCenter Server Information DisclosureUnder certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does… | Exploited |
| CVE-2020-3950 | 17 Mar 2020 | CVSS 7.8 | VMware Multiple Products Privilege EscalationVMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before… | Exploited |
| CVE-2020-3580 | 21 Oct 2020 | CVSS 6.1 | Cisco ASA and FTD Cross-Site Scripting (XSS)Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD)… | ExploitedFix |
| CVE-2020-3569 | 23 Sep 2020 | CVSS 8.6 | Cisco IOS XR Software DVMRP Memory ExhaustionMultiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated… | Exploited |
| CVE-2020-3566 | 29 Aug 2020 | CVSS 8.6 | Cisco IOS XR Software DVMRP Memory ExhaustionA vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote… | Exploited |
| CVE-2020-3452 | 22 Jul 2020 | CVSS 7.5 | Cisco ASA and FTD Read-Only Path TraversalA vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software… | Exploited |
| CVE-2020-3161 | 15 Apr 2020 | CVSS 9.8 | Cisco IP Phones Web Server Remote Code Execution and Denial-of-ServiceA vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a… | Exploited |
| CVE-2020-3118 | 5 Feb 2020 | CVSS 8.8 | Cisco IOS XR Software Discovery Protocol Format StringA vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute… | Exploited |
| CVE-2020-29583 | 22 Dec 2020 | CVSS 9.8 | Zyxel Multiple Products Use of Hard-Coded CredentialsFirmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can… | Exploited |
| CVE-2020-29557 | 29 Jan 2021 | CVSS 9.8 | D-Link DIR-825 R1 Devices Buffer OverflowAn issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to… | Exploited |
| CVE-2020-27950 | 8 Dec 2020 | CVSS 5.5 | Apple Multiple Products Memory InitializationA memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update… | Exploited |
| CVE-2020-27932 | 8 Dec 2020 | CVSS 7.8 | Apple Multiple Products Type ConfusionA type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS… | Exploited |
| CVE-2020-27930 | 8 Dec 2020 | CVSS 7.8 | Apple Multiple Products Memory CorruptionA memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS… | Exploited |
| CVE-2020-26919 | 9 Oct 2020 | CVSS 9.8 | Netgear JGS516PE Devices Missing Function Level Access ControlNETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level. | Exploited |
| CVE-2020-2555 | 15 Jan 2020 | CVSS 9.8 | Oracle Multiple Products Remote Code ExecutionVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are… | ExploitedFix |
| CVE-2020-25506 | 2 Feb 2021 | CVSS 9.8 | D-Link DNS-320 Device Command InjectionD-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code… | Exploited |
| CVE-2020-25213 | 9 Sep 2020 | CVSS 9.8 | WordPress File Manager Plugin Remote Code ExecutionThe File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it… | ExploitedFix |
| CVE-2020-24557 | 1 Sep 2020 | CVSS 7.8 | Trend Micro Multiple Products Improper Access ControlA vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a… | Exploited |
| CVE-2020-17530 | 11 Dec 2020 | CVSS 9.8 | Apache Struts Remote Code ExecutionForced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts… | ExploitedFix |
| CVE-2020-17496 | 12 Aug 2020 | CVSS 9.8 | vBulletin PHP Module Remote Code ExecutionvBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request… | ExploitedFix |
| CVE-2020-17144 | 10 Dec 2020 | CVSS 8.4 | Microsoft Exchange Server Remote Code ExecutionMicrosoft Exchange Remote Code Execution Vulnerability | ExploitedFix |
| CVE-2020-17087 | 11 Nov 2020 | CVSS 7.8 | Microsoft Windows Kernel Privilege EscalationWindows Kernel Local Elevation of Privilege Vulnerability | ExploitedFix |
| CVE-2020-16846 | 6 Nov 2020 | CVSS 9.8 | SaltStack Salt Shell InjectionAn issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in… | Exploited |
| CVE-2020-16017 | 8 Jan 2021 | CVSS 9.6 | Google Chrome Use-After-FreeUse after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to… | Exploited |
| CVE-2020-16013 | 8 Jan 2021 | CVSS 8.8 | Google Chromium V8 Incorrect Implementation VulnerabililtyInappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a… | Exploited |
| CVE-2020-16010 | 3 Nov 2020 | CVSS 9.6 | Google Chrome for Android UI Heap Buffer OverflowHeap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to… | Exploited |
| CVE-2020-16009 | 3 Nov 2020 | CVSS 8.8 | Google Chromium V8 Type ConfusionInappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a… | Exploited |
| CVE-2020-15999 | 3 Nov 2020 | CVSS 9.6 | Google Chrome FreeType Heap Buffer OverflowHeap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a… | Exploited |
| CVE-2020-15505 | 7 Jul 2020 | CVSS 9.8 | Ivanti MobileIron Multiple Products Remote Code ExecutionA remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0… | Exploited |
| CVE-2020-14883 | 21 Oct 2020 | CVSS 7.2 | Oracle WebLogic Server UnspecifiedVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are… | Exploited |
| CVE-2020-14882 | 21 Oct 2020 | CVSS 9.8 | Oracle WebLogic Server Remote Code ExecutionVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are… | Exploited |
| CVE-2020-14871 | 21 Oct 2020 | CVSS 10.0 | Oracle Solaris and Zettabyte File System (ZFS) UnspecifiedVulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are… | ExploitedFix |
| CVE-2020-14750 | 2 Nov 2020 | CVSS 9.8 | Oracle WebLogic Server Remote Code ExecutionVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are… | ExploitedFix |
| CVE-2020-1472 | 17 Aug 2020 | CVSS 5.5 | Microsoft Netlogon Privilege EscalationAn elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller… | ExploitedFix |
| CVE-2020-1464 | 17 Aug 2020 | CVSS 7.8 | Microsoft Windows SpoofingA spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could… | ExploitedFix |
| CVE-2020-1380 | 17 Aug 2020 | CVSS 7.8 | Microsoft Internet Explorer Scripting Engine Memory CorruptionA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability… | ExploitedFix |
| CVE-2020-1350 | 14 Jul 2020 | CVSS 10.0 | Microsoft Windows DNS Server Remote Code ExecutionA remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS… | ExploitedFix |
| CVE-2020-12812 | 24 Jul 2020 | CVSS 9.8 | Fortinet FortiOS SSL VPN Improper AuthenticationAn improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in… | Exploited |
| CVE-2020-12271 | 27 Apr 2020 | CVSS 9.8 | Sophos SFOS SQL InjectionA SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April… | Exploited |
| CVE-2020-11738 | 13 Apr 2020 | CVSS 7.5 | WordPress Snap Creek Duplicator Plugin File DownloadThe Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file… | Exploited |
| CVE-2020-11652 | 30 Apr 2020 | CVSS 6.5 | SaltStack Salt Path TraversalAn issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some… | Exploited |
| CVE-2020-11651 | 30 Apr 2020 | CVSS 9.8 | SaltStack Salt Authentication BypassAn issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate… | Exploited |
| CVE-2020-1147 | 14 Jul 2020 | CVSS 7.8 | Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code ExecutionA remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source… | ExploitedFix |
| CVE-2020-10987 | 13 Jul 2020 | CVSS 9.8 | Tenda AC1900 Router AC15 Model Remote Code ExecutionThe goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the… | Exploited |
| CVE-2020-1054 | 21 May 2020 | CVSS 7.0 | Microsoft Win32k Privilege EscalationAn elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker… | ExploitedFix |
| CVE-2020-1040 | 14 Jul 2020 | CVSS 9.0 | Microsoft Hyper-V RemoteFX vGPU Remote Code ExecutionA remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user… | ExploitedFix |
| CVE-2020-10221 | 8 Mar 2020 | CVSS 8.8 | rConfig OS Command Injectionlib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the… | Exploited |
| CVE-2020-1020 | 15 Apr 2020 | CVSS 8.8 | Microsoft Windows Adobe Font Manager Library Remote Code ExecutionA remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted… | ExploitedFix |
| CVE-2020-10199 | 1 Apr 2020 | CVSS 8.8 | Sonatype Nexus Repository Remote Code ExecutionSonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). | ExploitedFix |
| CVE-2020-10189 | 6 Mar 2020 | CVSS 9.8 | Zoho ManageEngine Desktop Central File UploadZoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the… | Exploited |
| CVE-2020-10181 | 11 Mar 2020 | CVSS 9.8 | Sumavision EMR Cross-Site Request Forgery (CSRF)goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator)… | Exploited |
| CVE-2020-10148 | 29 Dec 2020 | CVSS 9.8 | SolarWinds Orion Authentication BypassThe SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability… | Exploited |
| CVE-2020-0986 | 9 Jun 2020 | CVSS 7.8 | Microsoft Windows Kernel Privilege EscalationAn elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of… | ExploitedFix |
| CVE-2020-0968 | 15 Apr 2020 | CVSS 7.5 | Microsoft Internet Explorer Scripting Engine Memory CorruptionA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting… | ExploitedFix |
| CVE-2020-0938 | 15 Apr 2020 | CVSS 7.8 | Microsoft Windows Adobe Font Manager Library Remote Code ExecutionA remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted… | ExploitedFix |
| CVE-2020-0878 | 11 Sep 2020 | CVSS 4.2 | Microsoft Edge and Internet Explorer Memory Corruption<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory… | ExploitedFix |
| CVE-2020-0688 | 11 Feb 2020 | CVSS 8.8 | Microsoft Exchange Server Validation Key Remote Code ExecutionA remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka… | ExploitedFix |
| CVE-2020-0683 | 11 Feb 2020 | CVSS 7.8 | Microsoft Windows Installer Privilege EscalationAn elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of… | ExploitedFix |
| CVE-2020-0674 | 11 Feb 2020 | CVSS 7.5 | Microsoft Internet Explorer Scripting Engine Memory CorruptionA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting… | ExploitedFix |
| CVE-2020-0646 | 14 Jan 2020 | CVSS 9.8 | Microsoft .NET Framework Remote Code ExecutionA remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code… | ExploitedFix |
| CVE-2020-0601 | 14 Jan 2020 | CVSS 8.1 | Microsoft Windows CryptoAPI SpoofingA spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could… | ExploitedFix |
| CVE-2020-0069 | 10 Mar 2020 | CVSS 7.8 | Mediatek Multiple Chipsets Insufficient Input ValidationIn the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and… | Exploited |
| CVE-2020-0041 | 10 Mar 2020 | CVSS 7.8 | Android Kernel Out-of-Bounds WriteIn binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of… | Exploited |
| CVE-2019-9978 | 24 Mar 2019 | CVSS 6.1 | WordPress Social Warfare Plugin Cross-Site Scripting (XSS)The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as… | Exploited |
| CVE-2019-9082 | 24 Feb 2019 | CVSS 8.8 | ThinkPHP Remote Code ExecutionThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via… | Exploited |
| CVE-2019-8394 | 17 Feb 2019 | CVSS 6.5 | Zoho ManageEngine ServiceDesk Plus (SDP) File UploadZoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization. | Exploited |
| CVE-2019-7481 | 17 Dec 2019 | CVSS 7.5 | SonicWall SMA100 SQL InjectionVulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100… | Exploited |
| CVE-2019-6223 | 5 Mar 2019 | CVSS 7.5 | Apple iOS and macOS Group FacetimeA logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS… | Exploited |
| CVE-2019-5591 | 14 Aug 2020 | CVSS 6.5 | Fortinet FortiOS Default ConfigurationA Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by… | Exploited |
| CVE-2019-5544 | 6 Dec 2019 | CVSS 9.8 | VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer OverflowOpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the… | ExploitedFix |
| CVE-2019-4716 | 18 Dec 2019 | CVSS 9.8 | IBM Planning Analytics Remote Code ExecutionIBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and… | ExploitedFix |
| CVE-2019-3398 | 18 Apr 2019 | CVSS 8.8 | Atlassian Confluence Server and Data Center Path TraversalConfluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to… | ExploitedFix |
| CVE-2019-3396 | 25 Mar 2019 | CVSS 9.8 | Atlassian Confluence Server and Data Center Server-Side Template InjectionThe Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the… | ExploitedFix |
| CVE-2019-2215 | 11 Oct 2019 | CVSS 7.8 | Android Kernel Use-After-FreeA use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit… | ExploitedFix |
| CVE-2019-20085 | 30 Dec 2019 | CVSS 7.5 | TVT NVMS-1000 Directory TraversalTVT NVMS-1000 devices allow GET /.. Directory Traversal | Exploited |
| CVE-2019-19781 | 27 Dec 2019 | CVSS 9.8 | Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code ExecutionAn issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal. | Exploited |
| CVE-2019-19356 | 7 Feb 2020 | CVSS 7.5 | Netis WF2419 Devices Remote Code ExecutionNetis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been… | Exploited |
| CVE-2019-18988 | 7 Feb 2020 | CVSS 7.0 | TeamViewer Desktop Bypass Remote LoginTeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers'… | Exploited |
| CVE-2019-18935 | 11 Dec 2019 | CVSS 9.8 | Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted DataProgress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is… | ExploitedFix |
| CVE-2019-18187 | 28 Oct 2019 | CVSS 7.5 | Trend Micro OfficeScan Directory TraversalTrend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files… | Exploited |
| CVE-2019-17558 | 30 Dec 2019 | CVSS 7.5 | Apache Solr VelocityResponseWriter Plug-In Remote Code ExecutionApache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be… | ExploitedFix |
| CVE-2019-17026 | 2 Mar 2020 | CVSS 8.8 | Mozilla Firefox And Thunderbird Type ConfusionIncorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in… | Exploited |
| CVE-2019-16759 | 24 Sep 2019 | CVSS 9.8 | vBulletin PHP Module Remote Code ExecutionvBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request. | Exploited |
| CVE-2019-1653 | 24 Jan 2019 | CVSS 7.5 | Cisco Small Business RV320 and RV325 Routers Information DisclosureA vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an… | Exploited |
| CVE-2019-16256 | 12 Sep 2019 | CVSS 9.8 | SIMalliance Toolbox Browser Command InjectionSome Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location… | Exploited |
| CVE-2019-15949 | 5 Sep 2019 | CVSS 8.8 | Nagios XI Remote Code ExecutionNagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin… | Exploited |
| CVE-2019-15752 | 28 Aug 2019 | CVSS 7.8 | Docker Desktop Community Edition Privilege EscalationDocker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in… | Exploited |
| CVE-2019-1429 | 12 Nov 2019 | CVSS 7.5 | Microsoft Internet Explorer Scripting Engine Memory CorruptionA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting… | ExploitedFix |
| CVE-2019-1367 | 23 Sep 2019 | CVSS 7.5 | Microsoft Internet Explorer Scripting Engine Memory CorruptionA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting… | ExploitedFix |
| CVE-2019-13608 | 29 Aug 2019 | CVSS 7.5 | Citrix StoreFront Server XML External Entity (XXE) ProcessingCitrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks. | Exploited |
| CVE-2019-1215 | 11 Sep 2019 | CVSS 7.8 | Microsoft Windows Privilege EscalationAn elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege… | ExploitedFix |
| CVE-2019-1214 | 11 Sep 2019 | CVSS 7.8 | Microsoft Windows Privilege Common Log File System (CLFS) EscalationAn elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka… | ExploitedFix |
| CVE-2019-11634 | 22 May 2019 | CVSS 9.8 | Citrix Workspace Application and Receiver for Windows Remote Code ExecutionCitrix Workspace App before 1904 for Windows has Incorrect Access Control. | Exploited |
| CVE-2019-11580 | 3 Jun 2019 | CVSS 9.8 | Atlassian Crowd and Crowd Data Center Remote Code ExecutionAtlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send… | Exploited |
| CVE-2019-11539 | 26 Apr 2019 | CVSS 7.2 | Ivanti Pulse Connect Secure and Policy Secure Command InjectionIn Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse… | Exploited |
| CVE-2019-11510 | 8 May 2019 | CVSS 10.0 | Ivanti Pulse Connect Secure Arbitrary File ReadIn Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can… | ExploitedFix |
Page 17 of 18