Exploited Vulnerabilities Catalog 2022(113)
H 2023(64) 2022(113) 2021(179) 2020(128)
IBM | Aspera Faspex | IBM Aspera Faspex Code Execution Vulnerability | 2023-02-21 | IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw. | |
Zoho | ManageEngine | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | 2023-01-23 | Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario. | |
Cacti | Cacti | Cacti Command Injection Vulnerability | 2023-02-16 | Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code. | |
CWP | Control Web Panel | CWP Control Web Panel OS Command Injection Vulnerability | 2023-01-17 | CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter. | |
Microsoft | Defender | Microsoft Defender SmartScreen Security Feature Bypass Vulnerability | 2022-12-13 | Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file. | |
Fortra | Cobalt Strike | Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability | 2023-03-30 | Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. | |
Apple | iOS | Apple iOS Type Confusion Vulnerability | 2022-12-14 | Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution. | |
Apple | iOS and iPadOS | Apple iOS and iPadOS Out-of-Bounds Write Vulnerability | 2022-10-25 | Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges. | |
Chromium V8 Engine | Google Chromium V8 Type Confusion Vulnerability | 2022-12-05 | Google Chromium V8 contains a type confusion vulnerability. Specific impacts from exploitation are not available at this time. | ||
Fortinet | FortiOS | Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability | 2022-12-13 | Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests. | |
Zimbra | Collaboration (ZCS) | Zimbra Collaboration (ZCS) Arbitrary File Upload Vulnerability | 2022-10-20 | Zimbra Collaboration (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts. | |
Chromium | Google Chromium Heap Buffer Overflow Vulnerability | 2022-11-28 | Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge. | ||
Fortinet | FortiOS | Fortinet FortiOS Path Traversal Vulnerability | 2023-03-14 | Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands. | |
Mitel | MiVoice Connect | Mitel MiVoice Connect Code Injection Vulnerability | 2023-02-21 | The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application. | |
Microsoft | Windows | Microsoft Windows Scripting Languages Remote Code Execution Vulnerability | 2022-11-08 | Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution. | |
Microsoft | Windows | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | 2022-11-08 | Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability which allows an attacker to gain SYSTEM-level privileges. | |
Microsoft | Windows | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | 2022-11-08 | Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. | |
Microsoft | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | 2022-09-30 | Microsoft Exchange Server contains an unspecified vulnerability which allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution. | |
Microsoft | Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | 2023-01-10 | Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution. | |
Microsoft | Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | 2022-11-08 | Microsoft Windows Print Spooler contains an unspecified vulnerability which allows an attacker to gain SYSTEM-level privileges. | |
Microsoft | Windows | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | 2022-11-14 | Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. | |
Microsoft | Exchange Server | Microsoft Exchange Server Server-Side Request Forgery Vulnerability | 2022-09-30 | Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution. | |
Microsoft | Windows COM+ Event System Service | Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability | 2022-10-11 | Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation. | |
Mitel | MiVoice Connect | Mitel MiVoice Connect Command Injection Vulnerability | 2023-02-21 | The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system. | |
Fortinet | Multiple Products | Fortinet Multiple Products Authentication Bypass Vulnerability | 2022-10-11 | Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests. | |
Trend Micro | Apex One and Apex One as a Service | Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability | 2022-09-15 | Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution. | |
Fortra | Cobalt Strike | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability | 2023-03-30 | Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely. | |
Arm | Mali Graphics Processing Unit (GPU) | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | 2023-03-30 | Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information. | |
Microsoft | Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | 2022-09-14 | Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability which allows for privilege escalation. | |
Chromium V8 Engine | Google Chromium V8 Type Confusion Vulnerability | 2022-10-28 | Google Chromium V8 contains a type confusion vulnerability. Specific impacts from exploitation are not available at this time. | ||
Zimbra | Collaboration (ZCS) | Zimbra Collaboration (ZCS) Authentication Bypass Vulnerability | 2022-08-11 | Zimbra Collaboration (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution. | |
Atlassian | Bitbucket Server and Data Center | Atlassian Bitbucket Server and Data Center Command Injection Vulnerability | 2022-09-30 | Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request. | |
ZK Framework | AuUploader | ZK Framework AuUploader Unspecified Vulnerability | 2023-02-27 | ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager. | |
Teclib | GLPI | Teclib GLPI Remote Code Execution Vulnerability | 2023-03-07 | Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed. | |
Zoho | ManageEngine | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | 2022-09-22 | Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability which allows for remote code execution. | |
Microsoft | Windows | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | 2022-08-09 | A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application. | |
Apache | Spark | Apache Spark Command Injection Vulnerability | 2023-03-07 | Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled. | |
Apple | iOS, iPadOS, and macOS | Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability | 2022-09-14 | Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges. | |
Apple | iOS and macOS | Apple iOS and macOS Out-of-Bounds Write Vulnerability | 2022-08-18 | Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges. | |
Apple | iOS and macOS | Apple iOS and macOS Out-of-Bounds Write Vulnerability | 2022-08-18 | Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content. | |
Sophos | Firewall | Sophos Firewall Code Injection Vulnerability | 2022-09-23 | A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution. | |
Owl Labs | Meeting Owl Pro and Whiteboard Owl | Meeting Owl Pro and Whiteboard Owl Hard-Coded Credentials Vulnerability | 2022-06-08 | Owl Labs Meeting Owl and Whiteboard Owl allow attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value. | |
Chromium | Google Chromium Insufficient Data Validation Vulnerability | 2022-09-08 | Google Chromium Mojo contains an insufficient data validation vulnerability. Impacts from exploitation are not yet known. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge. | ||
Zyxel | Multiple Firewalls | Zyxel Multiple Firewalls OS Command Injection Vulnerability | 2022-05-16 | A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. | |
Chrome | Google Chrome Use-After-Free Vulnerability | 2023-03-30 | Google Chrome contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption. | ||
RARLAB | UnRAR | RARLAB UnRAR Directory Traversal Vulnerability | 2022-08-09 | RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation. | |
Microsoft | Windows | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | 2022-06-14 | A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application. | |
Mitel | MiVoice Connect | Mitel MiVoice Connect Data Validation Vulnerability | 2022-06-27 | The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation. | |
WSO2 | Multiple Products | WSO2 Multiple Products Unrestrictive Upload of File Vulnerability | 2022-04-25 | Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution. | |
D-Link | DIR-816L | D-Link DIR-816L Remote Code Execution Vulnerability | 2022-09-08 | D-Link DIR-816L contains an unspecified vulnerability in the shareport.php value parameter which allows for remote code execution. | |
Zoho | ManageEngine | Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability | 2023-03-07 | Multiple Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset. | |
Chrome | Google Chrome Intents Insufficient Input Validation Vulnerability | 2022-08-18 | Google Chrome Intents allows for insufficient validation of untrusted input, causing unknown impacts. CISA will update this description if more information becomes available. | ||
Zimbra | Collaboration (ZCS) | Zimbra Collaboration (ZCS) Cross-Site Scripting (XSS) Vulnerability | 2023-04-03 | Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing. | |
Zimbra | Collaboration (ZCS) | Zimbra Collaboration (ZCS) Arbitrary File Upload Vulnerability | 2022-08-11 | Zimbra Collaboration (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution. | |
Zimbra | Collaboration (ZCS) | Zimbra Collaboration (ZCS) Command Injection Vulnerability | 2022-08-04 | Zimbra Collaboration (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries. | |
QNAP | Photo Station | QNAP Photo Station Externally Controlled Reference Vulnerability | 2022-09-08 | Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign. | |
Citrix | Application Delivery Controller (ADC) and Gateway | Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability | 2022-12-13 | Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability which allows an attacker to execute code as administrator. | |
Microsoft | Windows | Microsoft Windows LSA Spoofing Vulnerability | 2022-07-01 | Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM. | |
Microsoft | Active Directory | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | 2022-08-18 | An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM. | |
Microsoft | Windows | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 2022-04-25 | Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. | |
Trend Micro | Apex Central | Trend Micro Apex Central Arbitrary File Upload Vulnerability | 2022-03-31 | An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution. | |
Veeam | Backup & Replication | Veeam Backup & Replication Remote Code Execution Vulnerability | 2022-12-13 | The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code. | |
Veeam | Backup & Replication | Veeam Backup & Replication Remote Code Execution Vulnerability | 2022-12-13 | The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code. | |
Mozilla | Firefox | Mozilla Firefox Use-After-Free Vulnerability | 2022-03-07 | Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution. | |
Mozilla | Firefox | Mozilla Firefox Use-After-Free Vulnerability | 2022-03-07 | Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution. | |
dotCMS | dotCMS | dotCMS Unrestricted Upload of File Vulnerability | 2022-08-25 | dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution. | |
WatchGuard | Firebox and XTM Appliances | WatchGuard Firebox and XTM Appliances Arbitrary Code Execution | 2022-03-25 | On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code. | |
D-Link | DIR-820L | D-Link DIR-820L Remote Code Execution Vulnerability | 2022-09-08 | D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution. | |
Mitel | MiCollab, MiVoice Business Express | MiCollab, MiVoice Business Express Access Control Vulnerability | 2022-03-25 | A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system. | |
Atlassian | Confluence | Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability | 2022-07-29 | Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group. | |
Atlassian | Confluence Server/Data Center | Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability | 2022-06-02 | Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution. | |
TerraMaster | TerraMaster OS | TerraMaster OS Remote Command Execution Vulnerability | 2023-02-10 | TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint. | |
Apache | CouchDB | Apache CouchDB Insecure Default Initialization of Resource Vulnerability | 2022-08-25 | Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges. | |
Zimbra | Webmail | Zimbra Webmail Cross-Site Scripting Vulnerability | 2022-02-25 | Zimbra webmail clients running versions 8.8.15 P29 & P30 contain a XSS vulnerability that would allow attackers to steal session cookie files. | |
Microsoft | Windows | Microsoft Windows CLFS Driver Privilege Escalation Vulnerability | 2022-04-13 | Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation. | |
Apache | APISIX | Apache APISIX Authentication Bypass Vulnerability | 2022-08-25 | Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution. | |
Adobe | Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability | 2022-02-15 | Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution. | |
WatchGuard | Firebox and XTM | WatchGuard Firebox and XTM Privilege Escalation Vulnerability | 2022-04-11 | WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. | |
Zabbix | Frontend | Zabbix Frontend Improper Access Control Vulnerability | 2022-02-22 | Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend. | |
Zabbix | Frontend | Zabbix Frontend Authentication Bypass Vulnerability | 2022-02-22 | Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML. | |
VMware | Spring Framework | Spring Framework JDK 9+ Remote Code Execution Vulnerability | 2022-04-04 | Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. | |
VMware Tanzu | Spring Cloud | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability | 2022-08-25 | When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources. | |
VMware | Multiple Products | VMware Multiple Products Privilege Escalation Vulnerability | 2022-04-15 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. | |
VMware | Workspace ONE Access and Identity Manager | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | 2022-04-14 | VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection. | |
VMware | Spring Cloud Gateway | VMware Spring Cloud Gateway Code Injection Vulnerability | 2022-05-16 | Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. | |
WebRTC | WebRTC | WebRTC Heap Buffer Overflow Vulnerability | 2022-08-25 | WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability which allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome. | |
Microsoft | Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | 2022-04-19 | Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation. | |
Arm | Mali Graphics Processing Unit (GPU) | Arm Mali GPU Kernel Driver Unspecified Vulnerability | 2023-03-30 | Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages. | |
Apple | macOS | Apple macOS Out-of-Bounds Write Vulnerability | 2022-04-04 | macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges. | |
Apple | macOS | Apple macOS Out-of-Bounds Read Vulnerability | 2022-04-04 | macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory. | |
Apple | Webkit | Apple Webkit Remote Code Execution Vulnerability | 2022-02-11 | Apple Webkit, which impacts iOS, iPadOS, and macOS, contains a vulnerability which allows for remote code execution. | |
Apple | iOS and macOS | Apple Memory Corruption Vulnerability | 2022-01-28 | Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges. | |
SAP | Multiple Products | SAP Multiple Products HTTP Request Smuggling Vulnerability | 2022-08-18 | SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches. | |
Microsoft | Windows | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability | 2022-07-12 | Microsoft Windows CSRSS contains an unspecified vulnerability which allows for privilege escalation to SYSTEM privileges. | |
Microsoft | Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | 2022-03-25 | Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation. | |
Microsoft | Windows | Microsoft Windows Runtime Remote Code Execution Vulnerability | 2022-08-18 | Microsoft Windows Runtime contains an unspecified vulnerability which allows for remote code execution. | |
Microsoft | Windows | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | 2022-04-25 | Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. | |
Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | 2022-02-04 | Microsoft Win32k contains an unspecified vulnerability which allows for privilege escalation. | |
Oracle | E-Business Suite | Oracle E-Business Suite Unspecified Vulnerability | 2023-02-02 | Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. | |
Cisco | IOS XR | Cisco IOS XR Open Port Vulnerability | 2022-05-23 | Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container. | |
Cisco | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). | |
Cisco | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). | |
Cisco | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). | |
Cisco | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). | |
Cisco | Small Business RV160, RV260, RV340, and RV345 Series Routers | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | 2022-03-03 | A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). | |
F5 | BIG-IP | F5 BIG-IP Missing Authentication Vulnerability | 2022-05-10 | F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services. | |
Chromium V8 Engine | Google Chromium V8 Type Confusion Vulnerability | 2022-04-15 | Google Chromium V8 engine contains a type confusion vulnerability. | ||
Chromium V8 | Google Chromium V8 Type Confusion Vulnerability | 2022-03-28 | The vulnerability exists due to a type confusion error within the V8 component in Chromium, affecting all Chromium-based browsers. | ||
Sophos | Firewall | Sophos Firewall Authentication Bypass Vulnerability | 2022-03-31 | An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution. | |
Linux | Kernel | Linux Kernel Privilege Escalation Vulnerability | 2022-04-25 | Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of "Dirty Pipe." | |
Chrome | Google Chrome Use-After-Free Vulnerability | 2022-02-15 | The vulnerability exists due to a use-after-free error within the Animation component in Google Chrome. | ||
Redis | Debian-specific Redis Servers | Debian-specific Redis Server Lua Sandbox Escape Vulnerability | 2022-03-28 | Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution. | |
Palo Alto Networks | PAN-OS | Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability | 2022-08-22 | A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. |