JASON SOAR

$ grep -i "$QUERY" cisa-kev-archive.log

KEV Archive

Every entry this site has seen from the CISA Known Exploited Vulnerabilities catalog, going back to its start in 2021. Nothing is removed. Search by CVE, vendor, product or any word in the description.

Back to the current feed

1,754 entries Clear search

cisa-kev-archive.log

  1. CVE-2023-7024

    Google Chromium WebRTC

    Google Chromium WebRTC Heap Buffer Overflow Vulnerability

    Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page....

    Read the full description

    Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.

    Added
    2024-01-02
    Federal due date
    2024-01-23
    NVD entry

  2. CVE-2023-49897

    FXC AE1021, AE1021PE

    FXC AE1021, AE1021PE OS Command Injection Vulnerability

    FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.

    Added
    2023-12-21
    Federal due date
    2024-01-11
    NVD entry

  3. CVE-2023-47565

    QNAP VioStor NVR

    QNAP VioStor NVR OS Command Injection Vulnerability

    QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.

    Added
    2023-12-21
    Federal due date
    2024-01-11
    NVD entry

  4. CVE-2023-6448

    Unitronics Vision PLC and HMI

    Unitronics Vision PLC and HMI Insecure Default Password Vulnerability

    Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.

    Added
    2023-12-11
    Federal due date
    2023-12-18
    NVD entry

  5. CVE-2023-41266

    Ransomware

    Qlik Sense

    Qlik Sense Path Traversal Vulnerability

    Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further...

    Read the full description

    Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.

    Added
    2023-12-07
    Federal due date
    2023-12-28
    NVD entry

  6. CVE-2023-41265

    Ransomware

    Qlik Sense

    Qlik Sense HTTP Tunneling Vulnerability

    Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.

    Added
    2023-12-07
    Federal due date
    2023-12-28
    NVD entrypraetorian-inc on GitHub

  7. CVE-2023-33107

    Qualcomm Multiple Chipsets

    Qualcomm Multiple Chipsets Integer Overflow Vulnerability

    Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

    Added
    2023-12-05
    Federal due date
    2023-12-26
    NVD entryketo0422 on GitHub264312431 on GitHub

  8. CVE-2023-33106

    Qualcomm Multiple Chipsets

    Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability

    Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

    Added
    2023-12-05
    Federal due date
    2023-12-26
    NVD entry

  9. CVE-2023-33063

    Qualcomm Multiple Chipsets

    Qualcomm Multiple Chipsets Use-After-Free Vulnerability

    Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.

    Added
    2023-12-05
    Federal due date
    2023-12-26
    NVD entry

  10. CVE-2022-22071

    Qualcomm Multiple Chipsets

    Qualcomm Multiple Chipsets Use-After-Free Vulnerability

    Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.

    Added
    2023-12-05
    Federal due date
    2023-12-26
    NVD entry

  11. CVE-2023-42917

    Apple Multiple Products

    Apple Multiple Products WebKit Memory Corruption Vulnerability

    Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but...

    Read the full description

    Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    Added
    2023-12-04
    Federal due date
    2023-12-25
    NVD entry

  12. CVE-2023-42916

    Apple Multiple Products

    Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability

    Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit,...

    Read the full description

    Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    Added
    2023-12-04
    Federal due date
    2023-12-25
    NVD entry

  13. CVE-2023-6345

    Google Chromium Skia

    Google Skia Integer Overflow Vulnerability

    Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome...

    Read the full description

    Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.

    Added
    2023-11-30
    Federal due date
    2023-12-21
    NVD entry

  14. CVE-2023-49103

    ownCloud ownCloud graphapi

    ownCloud graphapi Information Disclosure Vulnerability

    ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo() via GetPhpInfo.php, including administrative credentials.

    Added
    2023-11-30
    Federal due date
    2023-12-21
    NVD entrycreacitysec on GitHub

  15. CVE-2023-4911

    GNU GNU C Library

    GNU C Library Buffer Overflow Vulnerability

    GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.

    Added
    2023-11-21
    Federal due date
    2023-12-12
    NVD entryExploit-DBleesh3288 on GitHub

  16. CVE-2023-36584

    Microsoft Windows

    Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability

    Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.

    Added
    2023-11-16
    Federal due date
    2023-12-07
    NVD entry

  17. CVE-2023-1671

    Sophos Web Appliance

    Sophos Web Appliance Command Injection Vulnerability

    Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.

    Added
    2023-11-16
    Federal due date
    2023-12-07
    NVD entryExploit-DBW01fh4cker on GitHub

  18. CVE-2020-2551

    Oracle Fusion Middleware

    Oracle Fusion Middleware Unspecified Vulnerability

    Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.

    Added
    2023-11-16
    Federal due date
    2023-12-07
    NVD entry0xn0ne on GitHubY4er on GitHub

  19. CVE-2023-36036

    Microsoft Windows

    Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability

    Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.

    Added
    2023-11-14
    Federal due date
    2023-12-05
    NVD entry

  20. CVE-2023-36033

    Microsoft Windows

    Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability

    Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.

    Added
    2023-11-14
    Federal due date
    2023-12-05
    NVD entry

Exploit links go to public code from third parties, found through Exploit-DB and PoC-in-GitHub. They're there for research. Read the code before you run anything, and only test against systems you own or have permission to test.

Source CISA Known Exploited Vulnerabilities Catalog. JSON