CISA Known Exploited Vulnerabilities catalog (page 8)
Page 8 of 18 of the CISA Known Exploited Vulnerabilities catalog, newest additions first, with PoC counts, Metasploit and EPSS.
Known exploited CVEs, newest addition first (page 8 of 18)
| CVE | Product | Severity | Added to KEV | Due date | Ransomware use | Public PoCs | Metasploit | EPSS | Summary |
|---|---|---|---|---|---|---|---|---|---|
CVE-2020-3259 | Cisco Adaptive Security Appliance Software +2 | High 7.5 | Known | 0 | — | 0.715 (99.4th percentile) | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to… | ||
CVE-2024-21412 | Microsoft Windows 10 1809 +19 | High 8.1 | Known | 2 | — | 0.994 (99.9th percentile) | Internet Shortcut Files Security Feature Bypass Vulnerability | ||
CVE-2024-21351 | Microsoft Windows 10 1507 +23 | High 7.6 | — | 0 | — | 0.278 (98.1th percentile) | Windows SmartScreen Security Feature Bypass Vulnerability | ||
CVE-2023-43770 | Debian Debian Linux +2 | Medium 6.1 | — | 3 | — | 0.637 (99.2th percentile) | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior. | ||
CVE-2024-21762 | Fortinet Fortios +1 | Critical 9.8 | Known | 37 | — | 0.846 (99.7th percentile) | A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, For… | ||
CVE-2023-4762 | Debian Debian Linux +3 | High 8.8 | — | 4 | — | 0.414 (98.7th percentile) | Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. | ||
CVE-2024-21893 | Ivanti Connect Secure +4 | High 8.2 | Known | 2 | Yes | 1.000 (100.0th percentile) | A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access cer… | ||
CVE-2022-48618 | Apple iOS And Ipados +5 | High 7.0 | — | 0 | — | 0.005 (42.3th percentile) | The issue was addressed with improved checks. | ||
CVE-2023-22527 | Atlassian Confluence Data Center +3 | Critical 9.8 | Known | 29 | Yes | 1.000 (100.0th percentile) | A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. | ||
CVE-2024-23222 | Apple iOS And Ipados +6 | High 8.8 | — | 7 | — | 0.106 (95.8th percentile) | A type confusion issue was addressed with improved checks. | ||
CVE-2023-34048 | VMware Vcenter Server +2 | Critical 9.8 | — | 0 | — | 0.992 (99.9th percentile) | vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds write p… | ||
CVE-2023-35082 | Ivanti Endpoint Manager Mobile +1 | Critical 9.8 | Known | 1 | — | 1.000 (100.0th percentile) | An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. | ||
CVE-2024-0519 | Couchbase Couchbase Server +2 | High 8.8 | — | 3 | — | 0.038 (90.1th percentile) | Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
CVE-2023-6549 | Citrix Netscaler Application Delivery Controller +2 | High 8.2 | — | 0 | — | 0.576 (99.1th percentile) | Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read | ||
CVE-2023-6548 | Citrix Netscaler Application Delivery Controller +3 | Medium 5.5 | — | 1 | — | 0.032 (88.2th percentile) | Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticate… | ||
CVE-2018-15133 | Laravel Laravel +1 | High 8.1 | — | 15 | Yes | 0.766 (99.5th percentile) | In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. | ||
CVE-2024-21887 | Ivanti Connect Secure +3 | Critical 9.1 | Known | 12 | Yes | 1.000 (100.0th percentile) | A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests… | ||
CVE-2023-46805 | Ivanti Connect Secure +3 | High 8.2 | Known | 10 | Yes | 1.000 (100.0th percentile) | An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks. | ||
CVE-2023-29357 | Microsoft Microsoft Sharepoint Server 2019 +1 | Critical 9.8 | Known | 10 | Yes | 1.000 (100.0th percentile) | Microsoft SharePoint Server Elevation of Privilege Vulnerability | ||
CVE-2023-41990 | Apple iOS And Ipados +5 | High 7.8 | — | 0 | — | 0.014 (72.5th percentile) | The issue was addressed with improved handling of caches. | ||
CVE-2023-38203 | Adobe Coldfusion | Critical 9.8 | Known | 0 | — | 0.971 (99.9th percentile) | Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code ex… | ||
CVE-2023-29300 | Adobe Coldfusion | Critical 9.8 | Known | 0 | — | 1.000 (100.0th percentile) | Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrar… | ||
CVE-2023-27524 | Apache Superset +1 | High 8.9 | — | 22 | Yes | 0.981 (99.9th percentile) | Session Validation attacks in Apache Superset versions up to and including 2.0.1. | ||
CVE-2023-23752 | Joomla Joomla\! +1 | Medium 5.3 | — | 76 | Yes | 0.998 (100.0th percentile) | An issue was discovered in Joomla! | ||
CVE-2016-20017 | Dlink Dsl-2750b Firmware +1 | Critical 9.8 | — | 0 | Yes | 0.658 (99.3th percentile) | D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022. | ||
CVE-2023-7101 | Debian Debian Linux +3 | High 7.8 | — | 0 | Yes | 0.190 (97.3th percentile) | Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. | ||
CVE-2023-7024 | Debian Debian Linux +2 | High 8.8 | — | 2 | — | 0.067 (93.9th percentile) | Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
CVE-2023-49897 | Fxc Ae1021 Firmware +3 | High 8.8 | — | 0 | — | 0.504 (98.9th percentile) | An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. | ||
CVE-2023-47565 | QNAP Qvr Firmware +1 | High 8.0 | — | 0 | — | 0.733 (99.5th percentile) | An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. | ||
CVE-2023-6448 | Unitronics Samba 3.5 Firmware +16 | Critical 9.8 | — | 0 | — | 0.021 (81.8th percentile) | Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. | ||
CVE-2023-41266 | — | High 8.2 | Known | 0 | — | 0.848 (99.7th percentile) | A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August… | ||
CVE-2023-41265 | — | Critical 9.6 | Known | 1 | — | 0.882 (99.8th percentile) | An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, an… | ||
CVE-2023-33107 | Qualcomm 315 5g Iot Modem Firmware +242 | High 8.4 | — | 3 | — | 0.010 (63.8th percentile) | Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. | ||
CVE-2023-33106 | Qualcomm Ar8035 Firmware +153 | High 8.4 | — | 0 | — | 0.008 (56.5th percentile) | Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. | ||
CVE-2023-33063 | Qualcomm 315 5g Iot Modem Firmware +281 | High 7.8 | — | 0 | — | 0.007 (52.4th percentile) | Memory corruption in DSP Services during a remote call from HLOS to DSP. | ||
CVE-2022-22071 | Qualcomm Apq8053 Firmware +90 | High 8.4 | — | 0 | — | 0.004 (33.9th percentile) | Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrago… | ||
CVE-2023-42917 | Apple iOS And Ipados +7 | High 8.8 | — | 0 | — | 0.093 (95.4th percentile) | A memory corruption vulnerability was addressed with improved locking. | ||
CVE-2023-42916 | Apple iOS And Ipados +7 | Medium 6.5 | — | 0 | — | 0.178 (97.2th percentile) | An out-of-bounds read was addressed with improved input validation. | ||
CVE-2023-6345 | Debian Debian Linux +3 | Critical 9.6 | — | 0 | — | 0.165 (97.0th percentile) | Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. | ||
CVE-2023-49103 | — | Critical 10.0 | — | 5 | Yes | 0.778 (99.6th percentile) | An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. | ||
CVE-2023-4911 | Canonical Ubuntu Linux +38 | High 7.8 | — | 25 | Yes | 0.638 (99.2th percentile) | A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. | ||
CVE-2023-36584 | Microsoft Windows 10 1507 +31 | Medium 5.4 | — | 0 | — | 0.033 (88.4th percentile) | Windows Mark of the Web Security Feature Bypass Vulnerability | ||
CVE-2023-1671 | Sophos Sophos Web Appliance +1 | Critical 9.8 | — | 5 | — | 1.000 (100.0th percentile) | A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code. | ||
CVE-2020-2551 | Oracle Weblogic Server +1 | Critical 9.8 | — | 10 | — | 0.928 (99.8th percentile) | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). | ||
CVE-2023-36036 | Microsoft Windows 10 1507 +36 | High 7.8 | — | 0 | — | 0.167 (97.0th percentile) | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | ||
CVE-2023-36033 | Microsoft Windows 10 1809 +19 | High 7.8 | — | 0 | — | 0.109 (95.9th percentile) | Windows DWM Core Library Elevation of Privilege Vulnerability | ||
CVE-2023-36025 | Microsoft Windows 10 1507 +36 | High 8.8 | — | 3 | — | 0.882 (99.8th percentile) | Windows SmartScreen Security Feature Bypass Vulnerability | ||
CVE-2023-47246 | — | Critical 9.8 | Known | 4 | — | 0.989 (99.9th percentile) | In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023. | ||
CVE-2023-36851 | Juniper Junos +1 | Medium 5.3 | — | 0 | — | 0.011 (66.5th percentile) | A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system in… | ||
CVE-2023-36847 | Juniper Junos +1 | Medium 5.3 | — | 0 | — | 0.835 (99.7th percentile) | A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system int… | ||
CVE-2023-36846 | Juniper Junos +1 | Medium 5.3 | — | 2 | — | 0.935 (99.8th percentile) | A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system in… | ||
CVE-2023-36845 | Juniper Junos +1 | Critical 9.8 | — | 28 | Yes | 0.951 (99.9th percentile) | A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. | ||
CVE-2023-36844 | Juniper Junos +1 | Medium 5.3 | — | 5 | — | 0.900 (99.8th percentile) | A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment varia… | ||
CVE-2023-29552 | — | High 7.5 | — | 0 | — | 0.640 (99.2th percentile) | The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. | ||
CVE-2023-22518 | Atlassian Confluence Data Center +3 | Critical 9.8 | Known | 13 | Yes | 1.000 (100.0th percentile) | All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. | ||
CVE-2023-46604 | Apache Activemq +7 | Critical 10.0 | Known | 50 | Yes | 1.000 (100.0th percentile) | The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. | ||
CVE-2023-46748 | F5 Big-Ip +20 | High 8.8 | — | 0 | — | 0.043 (91.1th percentile) | An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP… | ||
CVE-2023-46747 | F5 Big-Ip +20 | Critical 9.8 | Known | 16 | Yes | 0.967 (99.9th percentile) | Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arb… | ||
CVE-2023-5631 | Debian Debian Linux +3 | Medium 6.1 | — | 2 | — | 0.763 (99.5th percentile) | Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavio… | ||
CVE-2023-20273 | Cisco Cisco iOS Xe Software +1 | High 7.2 | — | 1 | Yes | 0.929 (99.8th percentile) | A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. | ||
CVE-2023-4966 | Citrix Netscaler Adc +3 | Critical 9.4 | Known | 17 | Yes | 1.000 (100.0th percentile) | Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. | ||
CVE-2023-20198 | Cisco Cisco iOS Xe Software +3 | Critical 10.0 | — | 44 | Yes | 0.998 (100.0th percentile) | Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. | ||
CVE-2023-44487 | Akka HTTP Server +165 | High 7.5 | — | 31 | — | 1.000 (100.0th percentile) | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. | ||
CVE-2023-41763 | Microsoft Skype For Business Server +2 | Medium 5.3 | — | 0 | — | 0.903 (99.8th percentile) | Skype for Business Elevation of Privilege Vulnerability | ||
CVE-2023-36563 | Microsoft Windows 10 1507 +32 | Medium 6.5 | — | 0 | — | 0.203 (97.5th percentile) | Microsoft WordPad Information Disclosure Vulnerability | ||
CVE-2023-21608 | Adobe Acrobat +4 | High 7.8 | — | 3 | — | 0.594 (99.1th percentile) | Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code… | ||
CVE-2023-20109 | Cisco Cisco iOS Xe Software +2 | Medium 6.6 | — | 0 | — | 0.025 (84.9th percentile) | A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative contr… | ||
CVE-2023-42824 | Apple iOS And Ipados +2 | High 7.8 | — | 2 | — | 0.010 (62.2th percentile) | The issue was addressed with improved checks. | ||
CVE-2023-40044 | Progress Ws FTP Server +1 | Critical 10.0 | Known | 1 | Yes | 0.904 (99.8th percentile) | In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the un… | ||
CVE-2023-22515 | Atlassian Confluence Data Center +3 | Critical 9.8 | Known | 36 | Yes | 0.992 (99.9th percentile) | Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Cent… | ||
CVE-2023-42793 | Jetbrains Teamcity | Critical 9.8 | Known | 22 | Yes | 1.000 (100.0th percentile) | In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible | ||
CVE-2023-28229 | Microsoft Windows 10 1507 +34 | High 7.0 | — | 2 | — | 0.017 (77.0th percentile) | Windows CNG Key Isolation Service Elevation of Privilege Vulnerability | ||
CVE-2023-4211 | Arm 5th Gen GPU Architecture Kernel Driver +7 | Medium 5.5 | — | 0 | — | 0.010 (62.4th percentile) | A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory. | ||
CVE-2023-5217 | Apple Ipados +11 | High 8.8 | — | 4 | — | 0.490 (98.9th percentile) | Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
CVE-2018-14667 | Red Hat Enterprise Linux +2 | Critical 9.8 | — | 8 | — | 0.742 (99.5th percentile) | The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. | ||
CVE-2023-41993 | Apple Ipados +13 | High 8.8 | — | 6 | — | 0.237 (97.8th percentile) | The issue was addressed with improved checks. | ||
CVE-2023-41992 | Apple iOS And Ipados +3 | High 7.8 | — | 1 | — | 0.116 (96.1th percentile) | The issue was addressed with improved checks. | ||
CVE-2023-41991 | Apple iOS And Ipados +3 | Medium 5.5 | — | 5 | — | 0.134 (96.5th percentile) | A certificate validation issue was addressed. | ||
CVE-2023-41179 | Trendmicro Apex One +5 | High 7.2 | — | 0 | — | 0.042 (91.1th percentile) | A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an atta… | ||
CVE-2023-28434 | Minio Minio | High 8.8 | — | 2 | — | 0.079 (94.8th percentile) | Minio is a Multi-Cloud Object Storage framework. | ||
CVE-2022-22265 | Google Android +1 | Medium 5.0 | — | 0 | — | 0.004 (36.4th percentile) | An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution. | ||
CVE-2021-3129 | Facade Ignition +1 | Critical 9.8 | Known | 42 | Yes | 0.999 (100.0th percentile) | Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(… | ||
CVE-2017-6884 | — | High 8.8 | Known | 0 | — | 0.330 (98.4th percentile) | A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. | ||
CVE-2014-8361 | Aterm W1200ex Firmware +26 | Critical 9.8 | — | 1 | Yes | 1.000 (100.0th percentile) | The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023. | ||
CVE-2023-26369 | Adobe Acrobat +4 | High 7.8 | — | 0 | — | 0.075 (94.5th percentile) | Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code… | ||
CVE-2023-4863 | Bandisoft Honeyview +12 | High 8.8 | — | 19 | — | 1.000 (100.0th percentile) | Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. | ||
CVE-2023-35674 | Google Android | High 7.8 | — | 2 | — | 0.026 (85.7th percentile) | In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. | ||
CVE-2023-20269 | Cisco Adaptive Security Appliance Software +3 | Medium 5.0 | Known | 0 | — | 0.266 (98.0th percentile) | A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker… | ||
CVE-2023-36802 | Microsoft Windows 10 1809 +14 | High 7.8 | — | 7 | — | 0.279 (98.1th percentile) | Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability | ||
CVE-2023-36761 | Microsoft 365 Apps +8 | Medium 6.5 | — | 1 | — | 0.196 (97.4th percentile) | Microsoft Word Information Disclosure Vulnerability | ||
CVE-2023-41064 | Apple iOS And Ipados +3 | High 7.8 | — | 6 | — | 0.534 (99.0th percentile) | A buffer overflow issue was addressed with improved memory handling. | ||
CVE-2023-41061 | Apple iOS And Ipados +3 | High 7.8 | — | 0 | — | 0.044 (91.4th percentile) | A validation issue was addressed with improved logic. | ||
CVE-2023-33246 | Apache Rocketmq +1 | Critical 9.8 | — | 21 | Yes | 0.966 (99.9th percentile) | For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leake… | ||
CVE-2023-38831 | — | High 7.8 | Known | 72 | Yes | 0.998 (100.0th percentile) | RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. | ||
CVE-2023-32315 | Igniterealtime Openfire | High 8.6 | — | 17 | Yes | 1.000 (100.0th percentile) | Openfire is an XMPP server licensed under the Open Source Apache License. | ||
CVE-2023-38035 | Ivanti Mobileiron Sentry +1 | Critical 9.8 | Known | 4 | Yes | 1.000 (100.0th percentile) | A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due… | ||
CVE-2023-27532 | Veeam Backup & Replication +1 | High 7.5 | Known | 4 | — | 0.806 (99.6th percentile) | Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. | ||
CVE-2023-26359 | Adobe Coldfusion | Critical 9.8 | — | 0 | — | 0.170 (97.1th percentile) | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution… | ||
CVE-2023-24489 | Citrix Citrix Sharefile Storage Zones Controller +1 | Critical 9.8 | — | 3 | — | 0.973 (99.9th percentile) | A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed… | ||
CVE-2023-38180 | Fedoraproject Fedora +9 | High 7.5 | — | 0 | — | 0.141 (96.6th percentile) | .NET and Visual Studio Denial of Service Vulnerability |