JASON SOAR

$ grep -i "$QUERY" cisa-kev-archive.log

KEV Archive

Every entry this site has seen from the CISA Known Exploited Vulnerabilities catalog, going back to its start in 2021. Nothing is removed. Search by CVE, vendor, product or any word in the description.

Back to the current feed

1,755 entries Clear search

cisa-kev-archive.log

  1. CVE-2023-32439

    Apple Multiple Products

    Apple Multiple Products WebKit Type Confusion Vulnerability

    Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but...

    Read the full description

    Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    Added
    2023-06-23
    Federal due date
    2023-07-14
    NVD entry

  2. CVE-2023-32435

    Apple Multiple Products

    Apple Multiple Products WebKit Memory Corruption Vulnerability

    Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but...

    Read the full description

    Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    Added
    2023-06-23
    Federal due date
    2023-07-14
    NVD entry

  3. CVE-2023-32434

    Apple Multiple Products

    Apple Multiple Products Integer Overflow Vulnerability

    Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.

    Added
    2023-06-23
    Federal due date
    2023-07-14
    NVD entryalfiecg24 on GitHub

  4. CVE-2023-27992

    Zyxel Multiple Network-Attached Storage (NAS) Devices

    Zyxel Multiple NAS Devices Command Injection Vulnerability

    Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.

    Added
    2023-06-23
    Federal due date
    2023-07-14
    NVD entry

  5. CVE-2023-20867

    VMware Tools

    VMware Tools Authentication Bypass Vulnerability

    VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the...

    Read the full description

    VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.

    Added
    2023-06-23
    Federal due date
    2023-07-14
    NVD entry

  6. CVE-2023-20887

    VMware Aria Operations for Networks

    Vmware Aria Operations for Networks Command Injection Vulnerability

    VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.

    Added
    2023-06-22
    Federal due date
    2023-07-13
    NVD entrysinsinology on GitHubMalwareman007 on GitHub

  7. CVE-2021-44026

    Roundcube Roundcube Webmail

    Roundcube Webmail SQL Injection Vulnerability

    Roundcube Webmail is vulnerable to SQL injection via search or search_params.

    Added
    2023-06-22
    Federal due date
    2023-07-13
    NVD entry

  8. CVE-2020-35730

    Roundcube Roundcube Webmail

    Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

    Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.

    Added
    2023-06-22
    Federal due date
    2023-07-13
    NVD entry

  9. CVE-2020-12641

    Roundcube Roundcube Webmail

    Roundcube Webmail Remote Code Execution Vulnerability

    Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

    Added
    2023-06-22
    Federal due date
    2023-07-13
    NVD entry

  10. CVE-2016-9079

    Mozilla Firefox, Firefox ESR, and Thunderbird

    Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

    Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.

    Added
    2023-06-22
    Federal due date
    2023-07-13
    NVD entryExploit-DBdangokyo on GitHub

  11. CVE-2016-0165

    Microsoft Win32k

    Microsoft Win32k Privilege Escalation Vulnerability

    Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

    Added
    2023-06-22
    Federal due date
    2023-07-13
    NVD entryExploit-DB

  12. CVE-2023-27997

    Ransomware

    Fortinet FortiOS and FortiProxy SSL-VPN

    Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

    Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.

    Added
    2023-06-13
    Federal due date
    2023-07-04
    NVD entryBishopFox on GitHublexfo on GitHub

  13. CVE-2023-3079

    Google Chromium V8

    Google Chromium V8 Type Confusion Vulnerability

    Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium,...

    Read the full description

    Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

    Added
    2023-06-07
    Federal due date
    2023-06-28
    NVD entrymistymntncop on GitHub

  14. CVE-2023-33010

    Zyxel Multiple Firewalls

    Zyxel Multiple Firewalls Buffer Overflow Vulnerability

    Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions...

    Read the full description

    Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.

    Added
    2023-06-05
    Federal due date
    2023-06-26
    NVD entry

  15. CVE-2023-33009

    Zyxel Multiple Firewalls

    Zyxel Multiple Firewalls Buffer Overflow Vulnerability

    Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions...

    Read the full description

    Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.

    Added
    2023-06-05
    Federal due date
    2023-06-26
    NVD entry

  16. CVE-2023-34362

    Ransomware

    Progress MOVEit Transfer

    Progress MOVEit Transfer SQL Injection Vulnerability

    Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL...

    Read the full description

    Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.

    Added
    2023-06-02
    Federal due date
    2023-06-23
    NVD entryhorizon3ai on GitHubsfewer-r7 on GitHub

  17. CVE-2023-28771

    Zyxel Multiple Firewalls

    Zyxel Multiple Firewalls OS Command Injection Vulnerability

    Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.

    Added
    2023-05-31
    Federal due date
    2023-06-21
    NVD entrybenjaminhays on GitHub

  18. CVE-2023-2868

    Barracuda Networks Email Security Gateway (ESG) Appliance

    Barracuda Networks ESG Appliance Improper Input Validation Vulnerability

    Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.

    Added
    2023-05-26
    Federal due date
    2023-06-16
    NVD entrycfielding-r7 on GitHub

  19. CVE-2023-32409

    Apple Multiple Products

    Apple Multiple Products WebKit Sandbox Escape Vulnerability

    Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit,...

    Read the full description

    Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    Added
    2023-05-22
    Federal due date
    2023-06-12
    NVD entry

  20. CVE-2023-32373

    Apple Multiple Products

    Apple Multiple Products WebKit Use-After-Free Vulnerability

    Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit,...

    Read the full description

    Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    Added
    2023-05-22
    Federal due date
    2023-06-12
    NVD entry

Exploit links go to public code from third parties, found through Exploit-DB and PoC-in-GitHub. They're there for research. Read the code before you run anything, and only test against systems you own or have permission to test.

Source CISA Known Exploited Vulnerabilities Catalog. JSON