JASON SOAR

$ grep -i "$QUERY" cisa-kev-archive.log

KEV Archive

Every entry this site has seen from the CISA Known Exploited Vulnerabilities catalog, going back to its start in 2021. Nothing is removed. Search by CVE, vendor, product or any word in the description.

Back to the current feed

1,756 entries Clear search

cisa-kev-archive.log

  1. CVE-2020-2555

    Oracle Multiple Products

    Oracle Multiple Products Remote Code Execution Vulnerability

    Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion...

    Read the full description

    Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entryExploit-DBY4er on GitHub

  2. CVE-2020-25506

    D-Link DNS-320 Device

    D-Link DNS-320 Device Command Injection Vulnerability

    D-Link DNS-320 device contains a command injection vulnerability in the sytem_mgr.cgi component that may allow for remote code execution.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entry

  3. CVE-2020-25213

    WordPress File Manager Plugin

    WordPress File Manager Plugin Remote Code Execution Vulnerability

    WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entryExploit-DBmansoorr123 on GitHub

  4. CVE-2020-24557

    Trend Micro Apex One, OfficeScan, and Worry-Free Business Security

    Trend Micro Multiple Products Improper Access Control Vulnerability

    Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security...

    Read the full description

    Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entry

  5. CVE-2020-17530

    Apache Struts

    Apache Struts Remote Code Execution Vulnerability

    Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entryka1n4t on GitHubwuzuowei on GitHub

  6. CVE-2020-17496

    vBulletin vBulletin

    vBulletin PHP Module Remote Code Execution Vulnerability

    The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entry

  7. CVE-2020-17144

    Microsoft Exchange Server

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entryzcgonvh on GitHubAirboi on GitHub

  8. CVE-2020-17087

    Microsoft Windows

    Microsoft Windows Kernel Privilege Escalation Vulnerability

    Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entry

  9. CVE-2020-16846

    SaltStack Salt

    SaltStack Salt Shell Injection Vulnerability

    SaltStack Salt allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt API using the SSH client. This vulnerability affects any users running the Salt API.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entry

  10. CVE-2020-16017

    Google Chrome

    Google Chrome Use-After-Free Vulnerability

    Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entry

  11. CVE-2020-16013

    Google Chromium V8

    Google Chromium V8 Incorrect Implementation Vulnerabililty

    Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that...

    Read the full description

    Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entry

  12. CVE-2020-16010

    Google Chrome for Android UI

    Google Chrome for Android UI Heap Buffer Overflow Vulnerability

    Google Chrome for Android UI contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entry

  13. CVE-2020-16009

    Google Chromium V8

    Google Chromium V8 Type Confusion Vulnerability

    Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium,...

    Read the full description

    Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entry

  14. CVE-2020-15999

    Google Chrome FreeType

    Google Chrome FreeType Heap Buffer Overflow Vulnerability

    Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of...

    Read the full description

    Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.

    Added
    2021-11-03
    Federal due date
    2021-11-17
    NVD entry

  15. CVE-2020-15505

    Ivanti MobileIron Multiple Products

    Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability

    Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entry

  16. CVE-2020-14883

    Oracle WebLogic Server

    Oracle WebLogic Server Unspecified Vulnerability

    Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entry1n7erface on GitHubmurataydemir on GitHub

  17. CVE-2020-14882

    Oracle WebLogic Server

    Oracle WebLogic Server Remote Code Execution Vulnerability

    Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entryExploit-DBzhzyker on GitHub

  18. CVE-2020-14871

    Oracle Solaris and Zettabyte File System (ZFS)

    Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability

    Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entryExploit-DBExploit-DB

  19. CVE-2020-14750

    Oracle WebLogic Server

    Oracle WebLogic Server Remote Code Execution Vulnerability

    Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entrypprietosanchez on GitHub

  20. CVE-2020-1472

    Ransomware

    Microsoft Netlogon

    Microsoft Netlogon Privilege Escalation Vulnerability

    Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the...

    Read the full description

    Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.

    Added
    2021-11-03
    Federal due date
    2022-05-03
    NVD entryExploit-DBbvcyber on GitHub

Exploit links go to public code from third parties, found through Exploit-DB and PoC-in-GitHub. They're there for research. Read the code before you run anything, and only test against systems you own or have permission to test.

Source CISA Known Exploited Vulnerabilities Catalog. JSON