CISA KEV Catalog

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver a

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboratio

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote att

A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet Fort

Windows SmartScreen Security Feature Bypass Vulnerability

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authen

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Comm

Windows SmartScreen Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel inform

An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory cor

Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted

Windows Mark of the Web Security Feature Bypass Vulnerability

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authent

The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive infor

A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 al

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remo

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypa

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user infor

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows

Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploi

The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2

Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, wh

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the exist

IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restri

Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1,

Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted w

Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a

Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 an

The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScr

Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Wind

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has al

An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker w

An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Win

Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to loca

A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to acce

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Sui

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscal

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3

Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via

Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authoriza

Cisco IOS XR 3.4.0 through 3.8.1 allows remote attackers to cause a denial of service (session reset) via a BGP UPDATE m

Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2760U Gateway (Rev. E1) allow remote authenticated use

Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Service