CISA KEV — Known Exploited Vulnerabilities
Vulnerabilities that the US CISA has confirmed as exploited in the wild (Known Exploited Vulnerabilities), newest first, with summaries, CVSS and remediation.
| ID | Image | Title |
|---|---|---|
| CVE-2021-20016 KEV |
[KEV] SQL Injection in SonicWall SSLVPN SMA100 (CVE-2021-20016)
SQL injection in SonicWall SSLVPN SMA100 (CVE-2021-20016). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-20023 KEV |
[KEV] Path Traversal in SonicWall Email Security (CVE-2021-20023)
Path traversal in SonicWall Email Security (CVE-2021-20023). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-20022 KEV |
[KEV] Unrestricted File Upload in SonicWall Email Security (CVE-2021-20022)
Vulnerability in SonicWall Email Security (CVE-2021-20022). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-7481 KEV |
[KEV] SQL Injection in SonicWall SMA100 (CVE-2019-7481)
SQL injection in SonicWall SMA100 (CVE-2019-7481). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-20021 KEV |
[KEV] Vulnerability in SonicWall Email Security (CVE-2021-20021)
Vulnerability in SonicWall Email Security (CVE-2021-20021). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-10199 KEV |
[KEV] Vulnerability in Sonatype Nexus Repository (CVE-2020-10199)
Vulnerability in Sonatype Nexus Repository (CVE-2020-10199). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-3643 KEV |
[KEV] Vulnerability in SolarWinds Virtualization Manager (CVE-2016-3643)
Vulnerability in SolarWinds Virtualization Manager (CVE-2016-3643). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-35211 KEV |
[KEV] Out-of-Bounds Write in SolarWinds Serv-U (CVE-2021-35211)
Out-of-bounds write in SolarWinds Serv-U (CVE-2021-35211). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-10148 KEV |
[KEV] Vulnerability in SolarWinds Orion (CVE-2020-10148)
Vulnerability in SolarWinds Orion (CVE-2020-10148). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-16256 KEV |
[KEV] Vulnerability in SIMalliance Toolbox Browser (CVE-2019-16256)
Vulnerability in SIMalliance Toolbox Browser (CVE-2019-16256). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-3976 KEV |
[KEV] Path Traversal in SAP NetWeaver (CVE-2016-3976)
Path traversal in SAP NetWeaver (CVE-2016-3976). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-6207 KEV |
[KEV] Vulnerability in SAP Solution Manager (CVE-2020-6207)
Vulnerability in SAP Solution Manager (CVE-2020-6207). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-6287 KEV |
[KEV] Vulnerability in SAP NetWeaver (CVE-2020-6287)
Vulnerability in SAP NetWeaver (CVE-2020-6287). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2016-9563 KEV |
[KEV] XXE (XML External Entity) in SAP NetWeaver (CVE-2016-9563)
Vulnerability in SAP NetWeaver (CVE-2016-9563). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2010-5326 KEV |
[KEV] Vulnerability in SAP NetWeaver (CVE-2010-5326)
Vulnerability in SAP NetWeaver (CVE-2010-5326). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2018-2380 KEV |
[KEV] Path Traversal in SAP Customer Relationship Management (CRM) (CVE-2018-2380)
Path traversal in SAP Customer Relationship Management (CRM) (CVE-2018-2380). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-16846 KEV |
[KEV] OS Command Injection in Saltstack salt (CVE-2020-16846)
OS command injection in Saltstack salt (CVE-2020-16846). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 2015.8.10, 2015.8.13, 2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.6, 2016.11.10, 2017.7.4, 2017.7.8, 2018.3.5, 2019.2.5, 3000.3 or later.
|
|
| CVE-2020-11651 KEV |
[KEV] Vulnerability in Saltstack salt (CVE-2020-11651)
Vulnerability in Saltstack salt (CVE-2020-11651). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 2019.2.4, 3000.2 or later.
|
|
| CVE-2020-11652 KEV |
[KEV] Path Traversal in Saltstack salt (CVE-2020-11652)
Path traversal in Saltstack salt (CVE-2020-11652). Confidential information can be exposed externally. Listed in CISA KEV — actively exploited. Mitigation: upgrade to 2019.2.4, 3000.2 or later.
|
|
| CVE-2017-16651 KEV |
[KEV] Vulnerability in Roundcube Webmail (CVE-2017-16651)
Vulnerability in Roundcube Webmail (CVE-2017-16651). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-35395 KEV |
[KEV] Vulnerability in Realtek AP-Router SDK (CVE-2021-35395)
Vulnerability in Realtek AP-Router SDK (CVE-2021-35395). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-10221 KEV |
[KEV] OS Command Injection in rConfig (CVE-2020-10221)
OS command injection in rConfig (CVE-2020-10221). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-1905 KEV |
[KEV] Use-After-Free in Qualcomm Multiple Chipsets (CVE-2021-1905)
Vulnerability in Qualcomm Multiple Chipsets (CVE-2021-1905). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to SoCVersion:2021-05-05 or later.
|
|
| CVE-2021-1906 KEV |
[KEV] Vulnerability in Qualcomm Multiple Chipsets (CVE-2021-1906)
Vulnerability in Qualcomm Multiple Chipsets (CVE-2021-1906). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited. Mitigation: upgrade to SoCVersion:2021-05-05 or later.
|
|
| CVE-2019-11539 KEV |
[KEV] OS Command Injection in Ivanti Pulse Connect Secure and Pulse Policy Secure (CVE-2019-11539)
OS command injection in Ivanti Pulse Connect Secure and Pulse Policy Secure (CVE-2019-11539). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-11510 KEV |
[KEV] Path Traversal in Ivanti Pulse Connect Secure (CVE-2019-11510)
Path traversal in Ivanti Pulse Connect Secure (CVE-2019-11510). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-22899 KEV |
[KEV] Command Injection in Ivanti Pulse Connect Secure (CVE-2021-22899)
Command injection in Ivanti Pulse Connect Secure (CVE-2021-22899). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-8260 KEV |
[KEV] Unrestricted File Upload in Ivanti Pulse Connect Secure (CVE-2020-8260)
Vulnerability in Ivanti Pulse Connect Secure (CVE-2020-8260). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-22894 KEV |
[KEV] Code Injection in Ivanti Pulse Connect Secure (CVE-2021-22894)
Code injection in Ivanti Pulse Connect Secure (CVE-2021-22894). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-22900 KEV |
[KEV] Code Injection in Ivanti Pulse Connect Secure (CVE-2021-22900)
Code injection in Ivanti Pulse Connect Secure (CVE-2021-22900). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-8243 KEV |
[KEV] Code Injection in Ivanti Pulse Connect Secure (CVE-2020-8243)
Code injection in Ivanti Pulse Connect Secure (CVE-2020-8243). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-22893 KEV |
[KEV] Authentication Bypass in Ivanti Pulse Connect Secure (CVE-2021-22893)
Authentication bypass in Ivanti Pulse Connect Secure (CVE-2021-22893). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-18935 KEV |
[KEV] Unsafe Deserialization in Progress Telerik UI for ASP.NET AJAX (CVE-2019-18935)
Vulnerability in Progress Telerik UI for ASP.NET AJAX (CVE-2019-18935). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-8644 KEV |
[KEV] Code Injection in Playsms (CVE-2020-8644)
Code injection in Playsms (CVE-2020-8644). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-14883 KEV |
[KEV] Vulnerability in Oracle WebLogic Server (CVE-2020-14883)
Vulnerability in Oracle WebLogic Server (CVE-2020-14883). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-14882 KEV |
[KEV] Vulnerability in Oracle WebLogic Server (CVE-2020-14882)
Vulnerability in Oracle WebLogic Server (CVE-2020-14882). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-14750 KEV |
[KEV] Vulnerability in Oracle WebLogic Server (CVE-2020-14750)
Vulnerability in Oracle WebLogic Server (CVE-2020-14750). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2015-4852 KEV |
[KEV] Unsafe Deserialization in Oracle WebLogic Server (CVE-2015-4852)
Vulnerability in Oracle WebLogic Server (CVE-2015-4852). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-14871 KEV |
[KEV] Out-of-Bounds Write in Oracle Solaris and Zettabyte File System (ZFS) (CVE-2020-14871)
Out-of-bounds write in Oracle Solaris and Zettabyte File System (ZFS) (CVE-2020-14871). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2012-3152 KEV |
[KEV] Vulnerability in Oracle Fusion Middleware (CVE-2012-3152)
Vulnerability in Oracle Fusion Middleware (CVE-2012-3152). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-2555 KEV |
[KEV] Unsafe Deserialization in Oracle Multiple Products (CVE-2020-2555)
Vulnerability in Oracle Multiple Products (CVE-2020-2555). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-19356 KEV |
[KEV] OS Command Injection in Netis WF2419 Devices (CVE-2019-19356)
OS command injection in Netis WF2419 Devices (CVE-2019-19356). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-26919 KEV |
[KEV] Vulnerability in NETGEAR JGS516PE Devices (CVE-2020-26919)
Vulnerability in NETGEAR JGS516PE Devices (CVE-2020-26919). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-15949 KEV |
[KEV] OS Command Injection in Nagios XI (CVE-2019-15949)
OS command injection in Nagios XI (CVE-2019-15949). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-17026 KEV |
[KEV] Vulnerability in Mozilla Firefox and Thunderbird (CVE-2019-17026)
Vulnerability in Mozilla Firefox and Thunderbird (CVE-2019-17026). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-6820 KEV |
[KEV] Vulnerability in Mozilla Firefox and Thunderbird (CVE-2020-6820)
Vulnerability in Mozilla Firefox and Thunderbird (CVE-2020-6820). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2020-6819 KEV |
[KEV] Vulnerability in Mozilla Firefox and Thunderbird (CVE-2020-6819)
Vulnerability in Mozilla Firefox and Thunderbird (CVE-2020-6819). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-38648 KEV |
[KEV] Vulnerability in Microsoft Open Management Infrastructure (OMI) (CVE-2021-38648)
Vulnerability in Microsoft Open Management Infrastructure (OMI) (CVE-2021-38648). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2021-36955 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2021-36955)
Vulnerability in Microsoft Windows (CVE-2021-36955). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.
|
|
| CVE-2019-0863 KEV |
[KEV] Vulnerability in Microsoft Windows (CVE-2019-0863)
Vulnerability in Microsoft Windows (CVE-2019-0863). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.
|
