JASON SOAR

$ grep -i "$QUERY" cisa-kev-archive.log

KEV Archive

Every entry this site has seen from the CISA Known Exploited Vulnerabilities catalog, going back to its start in 2021. Nothing is removed. Search by CVE, vendor, product or any word in the description.

Back to the current feed

1,756 entries Clear search

cisa-kev-archive.log

  1. CVE-2022-22536

    SAP Multiple Products

    SAP Multiple Products HTTP Request Smuggling Vulnerability

    SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary...

    Read the full description

    SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.

    Added
    2022-08-18
    Federal due date
    2022-09-08
    NVD entryExploit-DBZZ-SOCMAP on GitHub

  2. CVE-2022-21971

    Microsoft Windows

    Microsoft Windows Runtime Remote Code Execution Vulnerability

    Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.

    Added
    2022-08-18
    Federal due date
    2022-09-08
    NVD entry0vercl0k on GitHubMalwareman007 on GitHub

  3. CVE-2017-15944

    Palo Alto Networks PAN-OS

    Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

    Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.

    Added
    2022-08-18
    Federal due date
    2022-09-08
    NVD entryExploit-DBsurajraghuvanshi on GitHub

  4. CVE-2022-37042

    Ransomware

    Synacor Zimbra Collaboration Suite (ZCS)

    Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

    Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.

    Added
    2022-08-11
    Federal due date
    2022-09-01
    NVD entry0xf4n9x on GitHubaels on GitHub

  5. CVE-2022-27925

    Ransomware

    Synacor Zimbra Collaboration Suite (ZCS)

    Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

    Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which...

    Read the full description

    Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.

    Added
    2022-08-11
    Federal due date
    2022-09-01
    NVD entryvnhacker1337 on GitHubJosexv1 on GitHub

  6. CVE-2022-34713

    Microsoft Windows

    Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

    A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.

    Added
    2022-08-09
    Federal due date
    2022-08-30
    NVD entry

  7. CVE-2022-30333

    Ransomware

    RARLAB UnRAR

    RARLAB UnRAR Directory Traversal Vulnerability

    RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.

    Added
    2022-08-09
    Federal due date
    2022-08-30
    NVD entryrbowes-r7 on GitHubTheL1ghtVn on GitHub

  8. CVE-2022-27924

    Ransomware

    Synacor Zimbra Collaboration Suite (ZCS)

    Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability

    Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.

    Added
    2022-08-04
    Federal due date
    2022-08-25
    NVD entry

  9. CVE-2022-26138

    Atlassian Confluence

    Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability

    Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to...

    Read the full description

    Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.

    Added
    2022-07-29
    Federal due date
    2022-08-19
    NVD entryalcaparra on GitHubz92g on GitHub

  10. CVE-2022-22047

    Microsoft Windows

    Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability

    Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.

    Added
    2022-07-12
    Federal due date
    2022-08-02
    NVD entry

  11. CVE-2022-26925

    Microsoft Windows

    Microsoft Windows LSA Spoofing Vulnerability

    Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.

    Added
    2022-07-01
    Federal due date
    2022-07-22
    NVD entry

  12. CVE-2022-29499

    Ransomware

    Mitel MiVoice Connect

    Mitel MiVoice Connect Data Validation Vulnerability

    The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.

    Added
    2022-06-27
    Federal due date
    2022-07-18
    NVD entry

  13. CVE-2021-4034

    Ransomware

    Red Hat Polkit

    Red Hat Polkit Out-of-Bounds Read and Write Vulnerability

    The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.

    Added
    2022-06-27
    Federal due date
    2022-07-18
    NVD entryExploit-DBberdav on GitHub

  14. CVE-2021-30983

    Apple iOS and iPadOS

    Apple iOS and iPadOS Buffer Overflow Vulnerability

    Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.

    Added
    2022-06-27
    Federal due date
    2022-07-18
    NVD entry

  15. CVE-2021-30533

    Google Chromium PopupBlocker

    Google Chromium PopupBlocker Security Bypass Vulnerability

    Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize...

    Read the full description

    Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

    Added
    2022-06-27
    Federal due date
    2022-07-18
    NVD entry

  16. CVE-2020-9907

    Apple Multiple Products

    Apple Multiple Products Memory Corruption Vulnerability

    Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.

    Added
    2022-06-27
    Federal due date
    2022-07-18
    NVD entry

  17. CVE-2020-3837

    Apple Multiple Products

    Apple Multiple Products Memory Corruption Vulnerability

    Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.

    Added
    2022-06-27
    Federal due date
    2022-07-18
    NVD entryExploit-DB

  18. CVE-2019-8605

    Apple Multiple Products

    Apple Multiple Products Use-After-Free Vulnerability

    A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.

    Added
    2022-06-27
    Federal due date
    2022-07-18
    NVD entryExploit-DBExploit-DB

  19. CVE-2018-4344

    Apple Multiple Products

    Apple Multiple Products Memory Corruption Vulnerability

    Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution.

    Added
    2022-06-27
    Federal due date
    2022-07-18
    NVD entry

  20. CVE-2022-30190

    Ransomware

    Microsoft Windows

    Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

    A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.

    Added
    2022-06-14
    Federal due date
    2022-07-05
    NVD entrykomomon on GitHubJMousqueton on GitHub

Exploit links go to public code from third parties, found through Exploit-DB and PoC-in-GitHub. They're there for research. Read the code before you run anything, and only test against systems you own or have permission to test.

Source CISA Known Exploited Vulnerabilities Catalog. JSON