CISA Known Exploited Vulnerabilities catalog (page 7)
Page 7 of 18 of the CISA Known Exploited Vulnerabilities catalog, newest additions first, with PoC counts, Metasploit and EPSS.
Known exploited CVEs, newest addition first (page 7 of 18)
| CVE | Product | Severity | Added to KEV | Due date | Ransomware use | Public PoCs | Metasploit | EPSS | Summary |
|---|---|---|---|---|---|---|---|---|---|
CVE-2024-8963 | Ivanti Endpoint Manager Cloud Services Appliance | Critical 9.4 | — | 1 | — | 0.986 (99.9th percentile) | Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. | ||
CVE-2024-27348 | Apache Hugegraph +1 | Critical 9.8 | — | 6 | Yes | 0.992 (99.9th percentile) | RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to versio… | ||
CVE-2022-21445 | Oracle Application Development Framework +1 | Critical 9.8 | — | 4 | — | 0.625 (99.2th percentile) | Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). | ||
CVE-2020-14644 | Oracle Weblogic Server +1 | Critical 9.8 | — | 2 | — | 0.945 (99.9th percentile) | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). | ||
CVE-2020-0618 | Microsoft Microsoft SQL Server +6 | High 8.8 | Known | 4 | Yes | 0.990 (99.9th percentile) | A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution V… | ||
CVE-2014-0502 | Adobe Adobe Air +10 | High 8.8 | — | 0 | — | 0.248 (97.9th percentile) | Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on… | ||
CVE-2014-0497 | Adobe Flash Player +9 | Critical 9.8 | — | 0 | Yes | 0.999 (100.0th percentile) | Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute ar… | ||
CVE-2013-0648 | Adobe Flash Player +8 | High 8.8 | — | 0 | — | 0.111 (96.0th percentile) | Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and… | ||
CVE-2013-0643 | Adobe Flash Player +8 | High 8.8 | — | 0 | — | 0.105 (95.8th percentile) | The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly rest… | ||
CVE-2024-6670 | Progress Whatsup Gold +1 | Critical 9.8 | Known | 1 | Yes | 0.929 (99.8th percentile) | In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. | ||
CVE-2024-43461 | Microsoft Windows 10 1507 +39 | High 8.8 | — | 0 | — | 0.542 (99.0th percentile) | Windows MSHTML Platform Spoofing Vulnerability | ||
CVE-2024-8190 | Ivanti Cloud Services Appliance | High 7.2 | — | 3 | — | 0.885 (99.8th percentile) | An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. | ||
CVE-2024-38226 | Microsoft Microsoft Office 2019 +5 | High 7.3 | — | 0 | — | 0.027 (85.9th percentile) | Microsoft Publisher Security Feature Bypass Vulnerability | ||
CVE-2024-38217 | Microsoft Windows 10 1507 +39 | Medium 5.4 | — | 0 | — | 0.100 (95.7th percentile) | Windows Mark of the Web Security Feature Bypass Vulnerability | ||
CVE-2024-38014 | Microsoft Windows 10 1507 +39 | High 7.8 | — | 0 | — | 0.063 (93.6th percentile) | Windows Installer Elevation of Privilege Vulnerability | ||
CVE-2024-40766 | SonicWall Sonicos | Critical 9.8 | Known | 0 | — | 0.184 (97.3th percentile) | An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the fi… | ||
CVE-2017-1000253 | Centos Centos +3 | High 7.8 | Known | 2 | — | 0.107 (95.9th percentile) | Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). | ||
CVE-2016-3714 | Canonical Ubuntu Linux +6 | High 8.4 | — | 7 | Yes | 0.975 (99.9th percentile) | The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code… | ||
CVE-2024-7262 | Kingsoft Wps Office +1 | High 7.8 | — | 0 | — | 0.031 (87.7th percentile) | Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows libr… | ||
CVE-2021-20124 | Draytek Vigorconnect +1 | High 7.5 | — | 0 | — | 0.959 (99.9th percentile) | A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. | ||
CVE-2021-20123 | Draytek Vigorconnect +1 | High 7.5 | — | 0 | — | 0.903 (99.8th percentile) | A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. | ||
CVE-2024-7965 | Google Chrome +1 | High 8.8 | — | 3 | — | 0.185 (97.3th percentile) | Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
CVE-2024-38856 | Apache Ofbiz +1 | Critical 9.8 | — | 13 | Yes | 0.994 (99.9th percentile) | Incorrect Authorization vulnerability in Apache OFBiz. | ||
CVE-2024-7971 | Google Chrome +1 | Critical 9.6 | — | 2 | — | 0.210 (97.6th percentile) | Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. | ||
CVE-2024-39717 | Versa Director +1 | High 7.2 | — | 0 | — | 0.040 (90.6th percentile) | The Versa Director GUI provides an option to customize the look and feel of the user interface. | ||
CVE-2022-0185 | Linux Linux Kernel +9 | High 8.4 | — | 12 | — | 0.252 (97.9th percentile) | A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. | ||
CVE-2021-33045 | Dahuasecurity Ipc-Hum7xxx Firmware +18 | Critical 9.8 | — | 1 | — | 0.996 (99.9th percentile) | The identity authentication bypass vulnerability found in some Dahua products during the login process. | ||
CVE-2021-33044 | Dahuasecurity Ipc-Hum7xxx Firmware +19 | Critical 9.8 | — | 9 | — | 1.000 (100.0th percentile) | The identity authentication bypass vulnerability found in some Dahua products during the login process. | ||
CVE-2021-31196 | Microsoft Exchange Server +5 | High 7.2 | — | 0 | — | 0.541 (99.0th percentile) | Microsoft Exchange Server Remote Code Execution Vulnerability | ||
CVE-2024-23897 | Jenkins Jenkins | Critical 9.8 | Known | 75 | Yes | 1.000 (100.0th percentile) | Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents… | ||
CVE-2024-28986 | Solarwinds Web Help Desk +1 | Critical 9.8 | — | 0 | — | 0.846 (99.7th percentile) | SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. | ||
CVE-2024-38213 | Microsoft Windows 10 1507 +31 | Medium 6.5 | — | 0 | — | 0.136 (96.5th percentile) | Windows Mark of the Web Security Feature Bypass Vulnerability | ||
CVE-2024-38193 | Microsoft Windows 10 1507 +39 | High 7.8 | — | 1 | — | 0.285 (98.1th percentile) | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | ||
CVE-2024-38189 | Microsoft 365 Apps +7 | High 8.8 | — | 1 | — | 0.082 (94.9th percentile) | Microsoft Project Remote Code Execution Vulnerability | ||
CVE-2024-38178 | Microsoft Windows 10 1507 +31 | High 7.5 | — | 1 | — | 0.414 (98.7th percentile) | Scripting Engine Memory Corruption Vulnerability | ||
CVE-2024-38107 | Microsoft Windows 10 1507 +33 | High 7.8 | — | 0 | — | 0.016 (76.5th percentile) | Windows Power Dependency Coordinator Elevation of Privilege Vulnerability | ||
CVE-2024-38106 | Microsoft Windows 10 1507 +28 | High 7.0 | — | 0 | — | 0.063 (93.7th percentile) | Windows Kernel Elevation of Privilege Vulnerability | ||
CVE-2024-36971 | Debian Debian Linux +2 | High 7.8 | — | 2 | — | 0.027 (86.1th percentile) | In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleare… | ||
CVE-2024-32113 | Apache Ofbiz +1 | Critical 9.8 | — | 6 | Yes | 0.999 (100.0th percentile) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. | ||
CVE-2018-0824 | Microsoft Windows 10 1507 +13 | High 8.8 | — | 1 | Yes | 0.730 (99.5th percentile) | A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." T… | ||
CVE-2024-37085 | VMware Cloud Foundation +3 | Medium 6.8 | Known | 4 | — | 0.268 (98.0th percentile) | VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured t… | ||
CVE-2024-5217 | Servicenow Now Platform +1 | Critical 9.8 | — | 1 | — | 0.996 (99.9th percentile) | ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. | ||
CVE-2024-4879 | Servicenow Now Platform +1 | Critical 9.8 | — | 13 | — | 1.000 (100.0th percentile) | ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. | ||
CVE-2023-45249 | Acronis Acronis Cyber Infrastructure +1 | Critical 9.8 | — | 0 | Yes | 0.535 (99.0th percentile) | Remote command execution due to use of default passwords. | ||
CVE-2024-39891 | — | Medium 5.3 | — | 0 | — | 0.017 (77.0th percentile) | In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in Jun… | ||
CVE-2012-4792 | Microsoft Internet Explorer +1 | High 8.8 | — | 1 | Yes | 0.788 (99.6th percentile) | Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not pro… | ||
CVE-2024-34102 | Adobe Adobe Commerce +3 | Critical 9.8 | — | 36 | Yes | 1.000 (100.0th percentile) | Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary c… | ||
CVE-2024-28995 | Solarwinds Serv-U +1 | High 8.6 | — | 13 | Yes | 0.996 (99.9th percentile) | SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. | ||
CVE-2022-22948 | VMware Vcenter Server And VMware Cloud Foundation +2 | Medium 6.5 | — | 3 | Yes | 0.133 (96.4th percentile) | The vCenter Server contains an information disclosure vulnerability due to improper permission of files. | ||
CVE-2024-36401 | Geoserver Geoserver +1 | Critical 9.8 | — | 32 | Yes | 0.998 (100.0th percentile) | GeoServer is an open source server that allows users to share and edit geospatial data. | ||
CVE-2024-38112 | Microsoft Windows 10 1507 +33 | High 7.5 | — | 1 | — | 0.842 (99.7th percentile) | Windows MSHTML Platform Spoofing Vulnerability | ||
CVE-2024-38080 | Microsoft Windows 11 21h2 +10 | High 7.8 | — | 1 | — | 0.071 (94.3th percentile) | Windows Hyper-V Elevation of Privilege Vulnerability | ||
CVE-2024-23692 | Rejetto HTTP File Server +1 | Critical 9.8 | Known | 16 | Yes | 0.995 (99.9th percentile) | Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. | ||
CVE-2024-20399 | Cisco Cisco Nx-Os Software +1 | Medium 6.0 | — | 2 | — | 0.043 (91.2th percentile) | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating syste… | ||
CVE-2022-2586 | Canonical Ubuntu Linux +4 | Medium 5.3 | — | 3 | — | 0.102 (95.7th percentile) | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. | ||
CVE-2022-24816 | Geosolutionsgroup Jai-Ext +1 | Critical 10.0 | — | 1 | — | 0.999 (100.0th percentile) | JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. | ||
CVE-2020-13965 | Debian Debian Linux +3 | Medium 6.1 | — | 1 | — | 0.766 (99.5th percentile) | An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. | ||
CVE-2024-4358 | Progress Software Corporation Telerik Report Server +1 | Critical 9.8 | — | 7 | Yes | 0.975 (99.9th percentile) | In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authenticatio… | ||
CVE-2024-32896 | Google Android | High 7.8 | — | 0 | — | 0.030 (87.4th percentile) | there is a possible way to bypass due to a logic error in the code. | ||
CVE-2024-26169 | Microsoft Windows 10 1507 +30 | High 7.8 | Known | 1 | — | 0.040 (90.7th percentile) | Windows Error Reporting Service Elevation of Privilege Vulnerability | ||
CVE-2024-4610 | Arm Bifrost GPU Kernel Driver +3 | High 7.8 | — | 0 | — | 0.008 (55.7th percentile) | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain acces… | ||
CVE-2024-4577 | Fedoraproject Fedora +2 | Critical 9.8 | Known | 106 | Yes | 1.000 (100.0th percentile) | In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" b… | ||
CVE-2017-3506 | Oracle Weblogic Server +1 | High 7.4 | — | 2 | — | 0.960 (99.9th percentile) | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). | ||
CVE-2024-24919 | Checkpoint Check Point Quantum Gateway, Spark Gateway And Cloudguard Network +3 | High 8.6 | Known | 80 | Yes | 1.000 (100.0th percentile) | Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. | ||
CVE-2024-1086 | Debian Debian Linux +18 | High 7.8 | Known | 20 | — | 0.281 (98.1th percentile) | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. | ||
CVE-2024-4978 | Javs Javs Viewer +1 | High 8.4 | — | 0 | — | 0.269 (98.1th percentile) | Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. | ||
CVE-2024-5274 | Fedoraproject Fedora +1 | Critical 9.6 | — | 3 | — | 0.077 (94.7th percentile) | Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | ||
CVE-2020-17519 | Apache Flink +1 | High 7.5 | — | 16 | Yes | 0.980 (99.9th percentile) | A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the Jo… | ||
CVE-2024-4947 | Fedoraproject Fedora +1 | Critical 9.6 | — | 3 | — | 0.152 (96.8th percentile) | Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. | ||
CVE-2023-43208 | — | Critical 9.8 | Known | 16 | Yes | 0.859 (99.7th percentile) | NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. | ||
CVE-2024-4761 | Fedoraproject Fedora +1 | High 8.8 | — | 1 | — | 0.110 (95.9th percentile) | Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. | ||
CVE-2021-40655 | Dlink Dir-605l Firmware +1 | High 7.5 | — | 0 | — | 0.870 (99.8th percentile) | An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. | ||
CVE-2014-100005 | Dlink Dir-600 Firmware +1 | High 8.0 | — | 0 | Yes | 0.435 (98.7th percentile) | Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. | ||
CVE-2024-30051 | Microsoft Windows 10 1507 +24 | High 7.8 | Known | 2 | — | 0.062 (93.5th percentile) | Windows DWM Core Library Elevation of Privilege Vulnerability | ||
CVE-2024-30040 | Microsoft Windows 10 1507 +26 | High 8.8 | — | 0 | — | 0.039 (90.5th percentile) | Windows MSHTML Platform Security Feature Bypass Vulnerability | ||
CVE-2024-4671 | Fedoraproject Fedora +1 | Critical 9.6 | — | 0 | — | 0.083 (95.0th percentile) | Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. | ||
CVE-2023-7028 | GitLab GitLab | Critical 10.0 | — | 22 | Yes | 0.945 (99.9th percentile) | An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16… | ||
CVE-2024-29988 | Microsoft Windows 10 1809 +19 | High 8.8 | — | 4 | — | 0.452 (98.8th percentile) | SmartScreen Prompt Security Feature Bypass Vulnerability | ||
CVE-2024-4040 | Crushftp Crushftp | Critical 9.8 | — | 25 | Yes | 0.995 (99.9th percentile) | A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside… | ||
CVE-2024-20359 | Cisco Adaptive Security Appliance Software +3 | Medium 6.0 | — | 1 | — | 0.188 (97.3th percentile) | A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower… | ||
CVE-2024-20353 | Cisco Adaptive Security Appliance Software +3 | High 8.6 | — | 2 | — | 0.698 (99.4th percentile) | A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote att… | ||
CVE-2022-38028 | Microsoft Windows 10 1507 +30 | High 7.8 | — | 0 | — | 0.149 (96.7th percentile) | Windows Print Spooler Elevation of Privilege Vulnerability | ||
CVE-2024-3400 | Palo Alto Networks Pan-Os +1 | Critical 10.0 | Known | 55 | Yes | 1.000 (100.0th percentile) | A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configura… | ||
CVE-2024-3273 | D-Link Dns-320l +23 | High 7.3 | — | 12 | — | 1.000 (100.0th percentile) | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. | ||
CVE-2024-3272 | D-Link Dns-320l +23 | Critical 9.8 | — | 1 | — | 0.981 (99.9th percentile) | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. | ||
CVE-2024-29748 | Google Android | High 7.8 | — | 0 | — | 0.007 (52.6th percentile) | there is a possible way to bypass due to a logic error in the code. | ||
CVE-2024-29745 | Google Android | Medium 5.5 | — | 0 | — | 0.005 (42.2th percentile) | there is a possible Information Disclosure due to uninitialized data. | ||
CVE-2023-24955 | Microsoft Microsoft Sharepoint Enterprise Server 2016 +4 | High 7.2 | Known | 2 | Yes | 0.850 (99.7th percentile) | Microsoft SharePoint Server Remote Code Execution Vulnerability | ||
CVE-2023-48788 | Fortinet Forticlientems +1 | Critical 9.8 | Known | 5 | Yes | 0.984 (99.9th percentile) | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to e… | ||
CVE-2021-44529 | Ivanti Endpoint Manager Cloud Services Appliance +1 | Critical 9.8 | Known | 2 | Yes | 0.991 (99.9th percentile) | A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody). | ||
CVE-2019-7256 | — | Critical 9.8 | — | 1 | Yes | 0.971 (99.9th percentile) | Linear eMerge E3-Series devices allow Command Injections. | ||
CVE-2024-27198 | Jetbrains Teamcity | Critical 9.8 | Known | 30 | Yes | 0.999 (100.0th percentile) | In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible | ||
CVE-2024-23296 | Apple iOS And Ipados +6 | High 7.8 | — | 1 | — | 0.014 (72.9th percentile) | A memory corruption issue was addressed with improved validation. | ||
CVE-2024-23225 | Apple iOS And Ipados +6 | High 7.8 | — | 0 | — | 0.015 (74.2th percentile) | A memory corruption issue was addressed with improved validation. | ||
CVE-2023-21237 | Google Android +1 | Medium 5.5 | — | 0 | — | 0.003 (18.6th percentile) | In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. | ||
CVE-2021-36380 | — | Critical 9.8 | — | 0 | — | 0.978 (99.9th percentile) | Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi. | ||
CVE-2024-21338 | Microsoft Windows 10 1809 +19 | High 7.8 | Known | 12 | — | 0.622 (99.2th percentile) | Windows Kernel Elevation of Privilege Vulnerability | ||
CVE-2023-29360 | Microsoft Windows 10 1607 +19 | High 8.4 | — | 3 | — | 0.216 (97.6th percentile) | Microsoft Streaming Service Elevation of Privilege Vulnerability | ||
CVE-2024-1709 | Connectwise Screenconnect | Critical 10.0 | Known | 11 | Yes | 1.000 (100.0th percentile) | ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential infor… | ||
CVE-2024-21410 | Microsoft Exchange Server +3 | Critical 9.8 | — | 3 | — | 0.127 (96.3th percentile) | Microsoft Exchange Server Elevation of Privilege Vulnerability |