A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to…
Published Aug 29, 2020 EPSS 3.7%
Known exploited vulnerabilities
Vulnerabilities CISA has confirmed are being exploited in the wild. These carry remediation deadlines for US federal agencies, and are a reasonable priority order for everyone else.
1533 in the catalogue · showing 1401–1450
Attackers can silently take over an entire network's user accounts and systems by exploiting a weakness in how domain controllers verify each other's identity
Published Aug 17, 2020 EPSS 99.4% Act now
An old flaw in the browser built into Windows lets attackers take over a computer if someone visits a specially made website, potentially allowing them to…
Published Aug 17, 2020 EPSS 24.2% Act now
Windows has a flaw that lets attackers run files the system should have blocked because their digital signatures are not valid
Published Aug 17, 2020 EPSS 38.9% Act now
A configuration oversight in certain network devices can let nearby attackers quietly steal login details that protect sensitive systems and data
Published Aug 14, 2020 EPSS 18.6% Act now
Attackers can silently take complete control of vulnerable forum websites without needing any login, putting user information and the entire server at risk
Published Aug 12, 2020 EPSS 87.5% Act now
A flaw in some versions of Fortinet's remote access software lets attackers get inside the network without completing the normal extra login step, which has…
Published Jul 24, 2020 EPSS 45.4% Act now
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow…
Published Jul 22, 2020 EPSS 100.0%
A critical flaw in Windows DNS servers lets attackers remotely take over systems handling network name lookups, risking complete network control
Published Jul 14, 2020 EPSS 96.7% Act now
A problem in how virtual machines handle graphics processing lets someone inside one virtual machine run harmful code on the main computer that hosts it
Published Jul 14, 2020 EPSS 7.4% Act now
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without…
Published Jul 14, 2020 EPSS 94.7%
A flaw in certain network devices lets attackers run any commands they want on the device just by sending a specially crafted request, giving them full control…
Published Jul 13, 2020 EPSS 79.8% Act now
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP…
Published Jul 10, 2020 EPSS 88.3%
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP…
Published Jul 10, 2020 EPSS 26.3%
Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN…
Published Jul 10, 2020 EPSS 33.0%
Attackers can remotely take over certain mobile device management servers without any login, giving them full control of company phones and data
Published Jul 7, 2020 EPSS 99.7% Act now
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also…
Published Jul 1, 2020 EPSS 100.0%
A problem in how the operating system manages memory can let someone who already has limited access on a computer take over the entire machine
Published Jun 9, 2020 EPSS 16.4% Act now
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5…
Published Jun 9, 2020 EPSS 2.3%
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, iOS 12.4.7, watchOS 6.2.5, watchOS…
Published Jun 9, 2020 EPSS 2.2%
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1, macOS Catalina 10.15.5…
Published Jun 5, 2020 EPSS 0.8%
A flaw in Windows lets attackers who already have some access on a computer take full control of it. CVE-2020-1054 is rated high (CVSS 7.8), is listed in CISA…
Published May 21, 2020 EPSS 53.9% Act now
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID…
Published May 7, 2020 EPSS 61.7%
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send…
Published May 7, 2020 EPSS 68.5%
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML…
Published May 7, 2020 EPSS 70.0%
Certain older firewall devices had a flaw that let outside attackers break in over the internet, steal login details, and take over the device, and criminals…
Published Apr 27, 2020 EPSS 42.4% Act now
Older versions of Firefox and Thunderbird contain a flaw that lets attackers take over a user's computer when they visit a malicious website or open a harmful…
Published Apr 24, 2020 EPSS 3.0% Act now
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing…
Published Apr 24, 2020 EPSS 7.1%
A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of…
Published Apr 15, 2020 EPSS 83.9%
A flaw in how Windows handles certain font files lets attackers run their own programs on your computer if you open a specially made document or email
Published Apr 15, 2020 EPSS 65.0% Act now
A flaw in an old web browser component lets attackers take over computers simply by getting someone to visit a bad webpage, which criminals have already used…
Published Apr 15, 2020 EPSS 30.7% Act now
A flaw in how Windows handles certain font files could let an attacker take over a computer when someone opens a specially made document
Published Apr 15, 2020 EPSS 69.0% Act now
A website plugin flaw lets outsiders read any file stored on the server, risking exposure of passwords and private information
Published Apr 13, 2020 EPSS 97.8% Act now
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not…
Published Apr 10, 2020 EPSS 90.4%
Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the…
Published Apr 8, 2020 EPSS 36.2%
Attackers can take over the software repository server and steal or alter the code and files that developers rely on, which can break builds and compromise…
Published Apr 1, 2020 EPSS 99.1% Act now
Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS)
Published Mar 20, 2020 EPSS 99.9%
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary…
Published Mar 18, 2020 EPSS 11.9%
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability…
Published Mar 18, 2020 EPSS 6.2%
A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary…
Published Mar 18, 2020 EPSS 10.9%
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0)…
Published Mar 17, 2020 EPSS 7.3%
Unraid through 6.8.0 allows Remote Code Execution. CVE-2020-5847 is rated critical (CVSS 9.8) and is listed in CISA KEV.
Published Mar 16, 2020 EPSS 95.8%
Unraid 6.8.0 allows authentication bypass. CVE-2020-5849 is rated high (CVSS 7.5), is listed in CISA KEV and is classified as CWE-697.
Published Mar 16, 2020 EPSS 93.2%
Attackers can create their own administrator account on the router without logging in, giving them full control over the network
Published Mar 11, 2020 EPSS 14.9% Act now
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service…
Published Mar 10, 2020 EPSS 98.1%
A software flaw in certain Android phones lets someone who already has access to the device take complete control without the owner doing anything
Published Mar 10, 2020 EPSS 1.4% Act now
A problem in the core messaging system inside Android lets an app secretly take over the whole phone without the user doing anything
Published Mar 10, 2020 EPSS 3.2% Act now
A flaw in network device configuration software lets attackers who already have a login run any commands they want on the server, potentially giving them full…
Published Mar 8, 2020 EPSS 77.1% Act now
Attackers can remotely take full control of the desktop management system without any login, potentially compromising every computer it oversees
Published Mar 6, 2020 EPSS 99.9% Act now
A problem in web browsers lets attackers take control of a computer when someone visits a harmful website. CVE-2019-17026 is rated high (CVSS 8.8), affects…
Published Mar 2, 2020 EPSS 46.3% Act now