Actively Exploited Vulnerabilities

Every advisory below covers a vulnerability with exploitation observed in the wild, cross-referenced against the CISA Known Exploited Vulnerabilities (KEV) catalog and refreshed every 3 hours. If your patch queue is long, start here: KEV listing means real attacks are happening now, and US federal agencies are required to remediate these under BOD 22-01.

1,706 exploited-vulnerability advisories · page 27 / 35

CVE-2009-1123: Microsoft Windows Improper Input Validation Vulnerability

The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.

criticalexploitedCVE-2009-1123 cisa-kev2022-03-03

CVE-2017-12237: Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability

A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service.

criticalexploitedCVE-2017-12237 cisa-kev2022-03-03

CVE-2017-6739: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.

criticalexploitedCVE-2017-6739 cisa-kev2022-03-03

CVE-2017-6737: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.

criticalexploitedCVE-2017-6737 cisa-kev2022-03-03

CVE-2008-3431: Oracle VirtualBox Insufficient Input Validation Vulnerability

An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.

criticalexploitedCVE-2008-3431 cisa-kev2022-03-03

CVE-2018-0167: Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability

There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute a…

criticalexploitedCVE-2018-0167 cisa-kev2022-03-03

CVE-2017-0001: Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability

The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges

criticalexploitedCVE-2017-0001 cisa-kev2022-03-03

CVE-2013-0640: Adobe Reader and Acrobat Memory Corruption Vulnerability

An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.

criticalexploitedCVE-2013-0640 cisa-kev2022-03-03

CVE-2010-3333: Microsoft Office Stack-based Buffer Overflow Vulnerability

A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.

criticalexploitedCVE-2010-3333 cisa-kev2022-03-03

CVE-2013-0632: Adobe ColdFusion Authentication Bypass Vulnerability

An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.

criticalexploitedCVE-2013-0632 cisa-kev2022-03-03

CVE-2013-0641: Adobe Reader Buffer Overflow Vulnerability

A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.

criticalexploitedCVE-2013-0641 cisa-kev2022-03-03

CVE-2013-1347: Microsoft Internet Explorer Remote Code Execution Vulnerability

This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.

criticalexploitedCVE-2013-1347 cisa-kev2022-03-03

CVE-2012-1535: Adobe Flash Player Arbitrary Code Execution Vulnerability

Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.

criticalexploitedCVE-2012-1535 cisa-kev2022-03-03

CVE-2017-6743: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.

criticalexploitedCVE-2017-6743 cisa-kev2022-03-03

CVE-2011-0611: Adobe Flash Player Remote Code Execution Vulnerability

Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.

criticalexploitedCVE-2011-0611 cisa-kev2022-03-03

CVE-2018-0179: Cisco IOS Software Denial-of-Service Vulnerability

A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.

criticalexploitedCVE-2018-0179 cisa-kev2022-03-03

CVE-2012-4681: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.

criticalexploitedCVE-2012-4681 cisa-kev2022-03-03

CVE-2015-2387: Microsoft ATM Font Driver Privilege Escalation Vulnerability

ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.

criticalexploitedCVE-2015-2387 cisa-kev2022-03-03

CVE-2016-7262: Microsoft Office Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.

criticalexploitedCVE-2016-7262 cisa-kev2022-03-03

CVE-2017-11826: Microsoft Office Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.

criticalexploitedCVE-2017-11826 cisa-kev2022-03-03

CVE-2018-0172: Cisco IOS and IOS XE Software Improper Input Validation Vulnerability

A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS).

criticalexploitedCVE-2018-0172 cisa-kev2022-03-03

CVE-2002-0367: Microsoft Windows Privilege Escalation Vulnerability

smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.

criticalexploitedCVE-2002-0367 cisa-kev2022-03-03

CVE-2010-0232: Microsoft Windows Kernel Exception Handler Vulnerability

The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges.

criticalexploitedCVE-2010-0232 cisa-kev2022-03-03

CVE-2017-8570: Microsoft Office Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory.

criticalexploitedCVE-2017-8570 cisa-kev2022-02-25

CVE-2017-0222: Microsoft Internet Explorer Remote Code Execution Vulnerability

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.

criticalexploitedCVE-2017-0222 cisa-kev2022-02-25

CVE-2014-6352: Microsoft Windows Code Injection Vulnerability

Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object.

criticalexploitedCVE-2014-6352 cisa-kev2022-02-25

CVE-2022-24682: Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.

criticalexploitedCVE-2022-24682 cisa-kev2022-02-25

CVE-2022-23131: Zabbix Frontend Authentication Bypass Vulnerability

Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.

criticalexploitedCVE-2022-23131 cisa-kev2022-02-22

CVE-2022-23134: Zabbix Frontend Improper Access Control Vulnerability

Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.

criticalexploitedCVE-2022-23134 cisa-kev2022-02-22

CVE-2013-3906: Microsoft Graphics Component Memory Corruption Vulnerability

Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.

criticalexploitedCVE-2013-3906 cisa-kev2022-02-15

CVE-2018-8174: Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"

criticalexploitedCVE-2018-8174 cisa-kev2022-02-15

CVE-2017-9841: PHPUnit Command Injection Vulnerability

PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

criticalexploitedCVE-2017-9841 cisa-kev2022-02-15

CVE-2018-20250: WinRAR Absolute Path Traversal Vulnerability

WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution

criticalexploitedCVE-2018-20250 cisa-kev2022-02-15

CVE-2019-0752: Microsoft Internet Explorer Type Confusion Vulnerability

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer

criticalexploitedCVE-2019-0752 cisa-kev2022-02-15

CVE-2022-24086: Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

criticalexploitedCVE-2022-24086 cisa-kev2022-02-15

CVE-2018-15982: Adobe Flash Player Use-After-Free Vulnerability

Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability

criticalexploitedCVE-2018-15982 cisa-kev2022-02-15

CVE-2022-0609: Google Chromium Animation Use-After-Free Vulnerability

Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrom…

criticalexploitedCVE-2022-0609 cisa-kev2022-02-15

CVE-2014-1761: Microsoft Word Memory Corruption Vulnerability

Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.

criticalexploitedCVE-2014-1761 cisa-kev2022-02-15

CVE-2022-22620: Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability

Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products …

criticalexploitedCVE-2022-22620 cisa-kev2022-02-11

CVE-2014-4404: Apple OS X Heap-Based Buffer Overflow Vulnerability

Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context.

criticalexploitedCVE-2014-4404 cisa-kev2022-02-10

CVE-2016-3088: Apache ActiveMQ Improper Input Validation Vulnerability

The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request

criticalexploitedCVE-2016-3088 cisa-kev2022-02-10

CVE-2017-0262: Microsoft Office Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Microsoft Office.

criticalexploitedCVE-2017-0262 cisa-kev2022-02-10

CVE-2020-0796: Microsoft SMBv3 Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.

criticalexploitedCVE-2020-0796 cisa-kev2022-02-10