[[1, "CVE-2021-27104", "Accellion", "FTA", "Links here", "2021-11-03", "2021-11-17", "Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints.", "Apply updates per vendor instructions.", "

"], [1, "CVE-2021-27104", "Accellion", "FTA", "Links here", "2021-11-03", "2021-11-17", "Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints.", "Apply updates per vendor instructions.", "

"], [2, "CVE-2021-27102", "Accellion", "FTA", "Links here", "2021-11-03", "2021-11-17", "Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call.", "Apply updates per vendor instructions.", "

"], [3, "CVE-2021-27101", "Accellion", "FTA", "Links here", "2021-11-03", "2021-11-17", "Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html.", "Apply updates per vendor instructions.", "

"], [4, "CVE-2021-27103", "Accellion", "FTA", "Links here", "2021-11-03", "2021-11-17", "Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html.", "Apply updates per vendor instructions.", "

"], [5, "CVE-2021-21017", "Adobe", "Acrobat and Reader", "Links here", "2021-11-03", "2021-11-17", "Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "Apply updates per vendor instructions.", "

"], [6, "CVE-2021-28550", "Adobe", "Acrobat and Reader", "Links here", "2021-11-03", "2021-11-17", "Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", "Apply updates per vendor instructions.", "

"], [7, "CVE-2018-4939", "Adobe", "ColdFusion", "Links here", "2021-11-03", "2022-05-03", "Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [8, "CVE-2018-15961", "Adobe", "ColdFusion", "Links here", "2021-11-03", "2022-05-03", "Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [9, "CVE-2018-4878", "Adobe", "Flash Player", "Links here", "2021-11-03", "2022-05-03", "A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.", "Apply updates per vendor instructions.", "

"], [10, "CVE-2020-5735", "Amcrest", "Cameras and Network Video Recorder (NVR)", "Links here", "2021-11-03", "2022-05-03", "Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.", "Apply updates per vendor instructions.", "

"], [11, "CVE-2019-2215", "Android", "Android OS", "Links here", "2021-11-03", "2022-05-03", "", "Apply updates per vendor instructions.", "

"], [12, "CVE-2020-0041", "Android", "Android OS", "Links here", "2021-11-03", "2022-05-03", "", "Apply updates per vendor instructions.", "

"], [13, "CVE-2020-0069", "Android", "Android OS", "Links here", "2021-11-03", "2022-05-03", "", "Apply updates per vendor instructions.", "

"], [14, "CVE-2017-9805", "Apache", "Struts", "Links here", "2021-11-03", "2022-05-03", "The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 contains a vulnerability which can lead to RCE.", "Apply updates per vendor instructions.", "

"], [15, "CVE-2021-42013", "Apache", "HTTP Server", "Links here", "2021-11-03", "2021-11-17", "Apache HTTP server vulnerabilities allow an attacker to use a path traversal attack to map URLs to files outside the expected document root and perform RCE.", "Apply updates per vendor instructions.", "

"], [16, "CVE-2021-41773", "Apache", "HTTP Server", "Links here", "2021-11-03", "2021-11-17", "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.", "Apply updates per vendor instructions.", "

"], [17, "CVE-2019-0211", "Apache", "HTTP Server", "Links here", "2021-11-03", "2022-05-03", "In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.", "Apply updates per vendor instructions.", "

"], [18, "CVE-2016-4437", "Apache", "Shiro", "Links here", "2021-11-03", "2022-05-03", "Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.", "Apply updates per vendor instructions.", "

"], [19, "CVE-2019-17558", "Apache", "Solr", "Links here", "2021-11-03", "2022-05-03", "Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).", "Apply updates per vendor instructions.", "

"], [20, "CVE-2020-17530", "Apache", "Struts", "Links here", "2021-11-03", "2022-05-03", "Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.", "Apply updates per vendor instructions.", "

"], [21, "CVE-2017-5638", "Apache", "Struts", "Links here", "2021-11-03", "2022-05-03", "The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.", "Apply updates per vendor instructions.", "

"], [22, "CVE-2018-11776", "Apache", "Struts", "Links here", "2021-11-03", "2022-05-03", "Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 contain a vulnerability which can allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [23, "CVE-2021-30858", "Apple", "iOS and iPadOS", "Links here", "2021-11-03", "2021-11-17", "Apple iOS and iPadOS Arbitrary Code Execution", "Apply updates per vendor instructions.", "

"], [24, "CVE-2019-6223", "Apple", "FaceTime", "Links here", "2021-11-03", "2022-05-03", "A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer.", "Apply updates per vendor instructions.", "

"], [25, "CVE-2021-30860", "Apple", "iOS", "Links here", "2021-11-03", "2021-11-17", "An integer overflow was addressed with improved input validation vulnerability affecting iOS devices that allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [26, "CVE-2020-27930", "Apple", "iOS and macOS", "Links here", "2021-11-03", "2022-05-03", "A memory corruption issue was addressed with improved input validation. Processing a maliciously crafted font may lead to arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [27, "CVE-2021-30807", "Apple", "iOS and macOS", "Links here", "2021-11-03", "2021-11-17", "", "Apply updates per vendor instructions.", "

"], [28, "CVE-2020-27950", "Apple", "iOS and macOS", "Links here", "2021-11-03", "2022-05-03", "A malicious application may be able to disclose kernel memory.", "Apply updates per vendor instructions.", "

"], [29, "CVE-2020-27932", "Apple", "iOS and macOS", "Links here", "2021-11-03", "2022-05-03", "A malicious application may be able to execute arbitrary code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [30, "CVE-2020-9818", "Apple", "iOS Mail", "Links here", "2021-11-03", "2022-05-03", "Processing a maliciously crafted mail message may lead to unexpected memory modification or application termination.", "Apply updates per vendor instructions.", "

"], [31, "CVE-2020-9819", "Apple", "iOS Mail", "Links here", "2021-11-03", "2022-05-03", "Processing a maliciously crafted mail message may lead to heap corruption.", "Apply updates per vendor instructions.", "

"], [32, "CVE-2021-30762", "Apple", "iOS", "Links here", "2021-11-03", "2021-11-17", "Use after free issue. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "Apply updates per vendor instructions.", "

"], [33, "CVE-2021-1782", "Apple", "iOS", "Links here", "2021-11-03", "2021-11-17", "A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited.", "Apply updates per vendor instructions.", "

"], [34, "CVE-2021-1870", "Apple", "iOS", "Links here", "2021-11-03", "2021-11-17", "A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "Apply updates per vendor instructions.", "

"], [35, "CVE-2021-1871", "Apple", "iOS", "Links here", "2021-11-03", "2021-11-17", "A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "Apply updates per vendor instructions.", "

"], [36, "CVE-2021-1879", "Apple", "iOS", "Links here", "2021-11-03", "2021-11-17", "Processing maliciously crafted web content may lead to universal cross site scripting. Apple is aware of a report that this issue may have been actively exploited.", "Apply updates per vendor instructions.", "

"], [37, "CVE-2021-30661", "Apple", "iOS", "Links here", "2021-11-03", "2021-11-17", "Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "Apply updates per vendor instructions.", "

"], [38, "CVE-2021-30666", "Apple", "iOS", "Links here", "2021-11-03", "2021-11-17", "Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "Apply updates per vendor instructions.", "

"], [39, "CVE-2021-30713", "Apple", "macOS", "Links here", "2021-11-03", "2021-11-17", "A malicious application may be able to bypass Privacy preferences. Apple is aware of a report that this issue may have been actively exploited.", "Apply updates per vendor instructions.", "

"], [40, "CVE-2021-30657", "Apple", "macOS", "Links here", "2021-11-03", "2021-11-17", "A malicious application may bypass Gatekeeper checks. Apple is aware of a report that this issue may have been actively exploited.", "Apply updates per vendor instructions.", "

"], [41, "CVE-2021-30665", "Apple", "Safari", "Links here", "2021-11-03", "2021-11-17", "Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "Apply updates per vendor instructions.", "

"], [42, "CVE-2021-30663", "Apple", "Safari", "Links here", "2021-11-03", "2021-11-17", "Integer overflow. Processing maliciously crafted web content may lead to arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [43, "CVE-2021-30761", "Apple", "iOS", "Links here", "2021-11-03", "2021-11-17", "Memory corruption issue. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.", "Apply updates per vendor instructions.", "

"], [44, "CVE-2021-30869", "Apple", "iOS, macOS, and iPadOS", "Links here", "2021-11-03", "2021-11-17", "Apple XNU kernel contains a type confusion vulnerability which allows a malicious application to execute arbitrary code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [45, "CVE-2020-9859", "Apple", "iOS and iPadOS", "Links here", "2021-11-03", "2022-05-03", "A memory consumption issue was addressed with improved memory handling. An application may be able to execute arbitrary code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [46, "CVE-2021-20090", "Arcadyan", "Buffalo WSR-2533DHPL2 and WSR-2533DHP3 firmware", "Links here", "2021-11-03", "2021-11-17", "A path traversal vulnerability in Arcadyan firmware could allow unauthenticated remote attackers to bypass authentication. It impacts many routers.", "Apply updates per vendor instructions.", "

"], [47, "CVE-2021-27562", "Arm", "Arm Trusted Firmware", "Links here", "2021-11-03", "2021-11-17", "In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure data when calling secure functions under the NSPE handler mode. This vulnerability has known active exploitation against Yealink Device Management servers. It is assessed this product utilizes the affected Arm firmware.", "Apply updates per vendor instructions.", "

"], [48, "CVE-2021-28664", "Arm", "Mali Graphics Processing Unit (GPU)", "Links here", "2021-11-03", "2021-11-17", "The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achieve read/write access to read-only pages. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r8p0 through r30p0.", "Apply updates per vendor instructions.", "

"], [49, "CVE-2021-28663", "Arm", "Mali Graphics Processing Unit (GPU)", "Links here", "2021-11-03", "2021-11-17", "The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.", "Apply updates per vendor instructions.", "

"], [50, "CVE-2019-3398", "Atlassian", "Confluence", "Links here", "2021-11-03", "2022-05-03", "Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.", "Apply updates per vendor instructions.", "

"], [51, "CVE-2021-26084", "Atlassian", "Confluence Server", "Links here", "2021-11-03", "2021-11-17", "Atlassian Confluence Server The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5 contains an OGNL injection vulnerability which allows an attacker to execute arbitrary code.", "Apply updates per vendor instructions.", "

"], [52, "CVE-2019-11580", "Atlassian", "Crowd and Crowd Data Center", "Links here", "2021-11-03", "2022-05-03", "Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5, from version 3.1.0 before 3.1.6, from version 3.2.0 before 3.2.8, from version 3.3.0 before 3.3.5, and from version 3.4.0 before 3.4.4 are affected by this vulnerability.", "Apply updates per vendor instructions.", "

"], [53, "CVE-2019-3396", "Atlassian", "Atlassian Confluence Server", "Links here", "2021-11-03", "2022-05-03", "Allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.", "Apply updates per vendor instructions.", "

"], [54, "CVE-2021-42258", "BQE", "BillQuick Web Suite", "Links here", "2021-11-03", "2021-11-17", "BQE BillQuick Web Suite 2018 through 2021 prior to 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation.", "Apply updates per vendor instructions.", "

"], [55, "CVE-2020-3452", "Cisco", "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)", "Links here", "2021-11-03", "2022-05-03", "A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files.", "Apply updates per vendor instructions.", "

"], [56, "CVE-2020-3580", "Cisco", "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)", "Links here", "2021-11-03", "2022-05-03", "Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations.", "Apply updates per vendor instructions.", "

"], [57, "CVE-2021-1497", "Cisco", "HyperFlex HX", "Links here", "2021-11-03", "2021-11-17", "Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.", "Apply updates per vendor instructions.", "

"], [58, "CVE-2021-1498", "Cisco", "HyperFlex HX", "Links here", "2021-11-03", "2021-11-17", "Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.", "Apply updates per vendor instructions.", "

"], [59, "CVE-2018-0171", "Cisco", "IOS and IOS XE", "Links here", "2021-11-03", "2022-05-03", "A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS) condition, or to execute arbitrary code on an affected device. The vulnerability is due to improper validation of packet data. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected device on TCP port 4786. A successful exploit could allow the attacker to cause a buffer overflow on the affected device, which could have the following impacts: Triggering a reload of the device, Allowing the attacker to execute arbitrary code on the device, Causing an indefinite loop on the affected device that triggers a watchdog crash. Cisco Bug IDs: CSCvg76186.", "Apply updates per vendor instructions.", "

"], [60, "CVE-2020-3118", "Cisco", "IOS XR", "Links here", "2021-11-03", "2022-05-03", "A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).", "Apply updates per vendor instructions.", "

"], [61, "CVE-2020-3566", "Cisco", "IOS XR", "Links here", "2021-11-03", "2022-05-03", "A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust process memory of an affected device. The vulnerability is due to insufficient queue management for Internet Group Management Protocol (IGMP) packets. An attacker could exploit this vulnerability by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to cause memory exhaustion, resulting in instability of other processes. These processes may include, but are not limited to, interior and exterior routing protocols.", "Apply updates per vendor instructions.", "

"], [62, "CVE-2020-3569", "Cisco", "IOS XR", "Links here", "2021-11-03", "2022-05-03", "Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to either immediately crash the Internet Group Management Protocol (IGMP) process or make it consume available memory and eventually crash. The memory consumption may negatively impact other processes that are running on the device. These vulnerabilities are due to the incorrect handling of IGMP packets. An attacker could exploit these vulnerabilities by sending crafted IGMP traffic to an affected device. A successful exploit could allow the attacker to immediately crash the IGMP process or cause memory exhaustion, resulting in other processes becoming unstable. These processes may include, but are not limited to, interior and exterior routing protocols.", "Apply updates per vendor instructions.", "

"], [63, "CVE-2020-3161", "Cisco", "IP Phones", "Links here", "2021-11-03", "2022-05-03", "A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP phone, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web server of a targeted device. A successful exploit could allow the attacker to remotely execute code with root privileges or cause a reload of an affected IP phone, resulting in a DoS condition.", "Apply updates per vendor instructions.", "

"], [64, "CVE-2019-1653", "Cisco", "RV320 and RV325 Routers", "Links here", "2021-11-03", "2022-05-03", "A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information.", "Apply updates per vendor instructions.", "

"], [65, "CVE-2018-0296", "Cisco", "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)", "Links here", "2021-11-03", "2022-05-03", "A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.", "Apply updates per vendor instructions.", "

"], [66, "CVE-2019-13608", "Citrix", "StoreFront Server", "Links here", "2021-11-03", "2022-05-03", "Citrix StoreFront Server contains a XXE processing vulnerability that could allow an unauthenticated attacker to retrieve potentially sensitive information.", "Apply updates per vendor instructions.", "

"], [67, "CVE-2020-8193", "Citrix", "Application Delivery Controller (ADC), Gateway, and SDWAN WANOP", "Links here", "2021-11-03", "2022-05-03", "Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.", "Apply updates per vendor instructions.", "

"], [68, "CVE-2020-8195", "Citrix", "Application Delivery Controller (ADC), Gateway, and SDWAN WANOP", "Links here", "2021-11-03", "2022-05-03", "Application Delivery Controller (ADC), Gateway, and SDWAN WANOP", "Apply updates per vendor instructions.", "

"], [69, "CVE-2020-8196", "Citrix", "Application Delivery Controller (ADC), Gateway, and SDWAN WANOP", "Links here", "2021-11-03", "2022-05-03", "Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.", "Apply updates per vendor instructions.", "

"], [70, "CVE-2019-19781", "Citrix", "Application Delivery Controller (ADC) and Gateway", "Links here", "2021-11-03", "2022-05-03", "Issue in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0 allowing Directory Traversal.", "Apply updates per vendor instructions.", "

"], [71, "CVE-2019-11634", "Citrix", "Workspace (for Windows)", "Links here", "2021-11-03", "2022-05-03", "Citrix Workspace app and Receiver for Windows prior to version 1904 contains an incorrect access control vulnerability which allows for code execution.", "Apply updates per vendor instructions.", "

"], [72, "CVE-2020-29557", "D-Link", "DIR-825 R1", "Links here", "2021-11-03", "2022-05-03", "D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20 contain a vulnerability in the web interface allowing for remote code execution.", "Apply updates per vendor instructions.", "

"], [73, "CVE-2020-25506", "D-Link", "DNS-320", "Links here", "2021-11-03", "2022-05-03", "D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [74, "CVE-2018-15811", "DNN", "DotNetNuke", "Links here", "2021-11-03", "2022-05-03", "DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.", "Apply updates per vendor instructions.", "

"], [75, "CVE-2018-18325", "DNN", "DotNetNuke", "Links here", "2021-11-03", "2022-05-03", "DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.", "Apply updates per vendor instructions.", "

"], [76, "CVE-2017-9822", "DNN", "DotNetNuke (DNN)", "Links here", "2021-11-03", "2022-05-03", "DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka \"2017-08 (Critical) Possible remote code execution on DNN sites.\"", "Apply updates per vendor instructions.", "

"], [77, "CVE-2019-15752", "Docker", "Desktop Community Edition", "Links here", "2021-11-03", "2022-05-03", "Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\\DockerDesktop\\version-bin\\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.", "Apply updates per vendor instructions.", "

"], [78, "CVE-2020-8515", "DrayTek", "Vigor Router(s)", "Links here", "2021-11-03", "2022-05-03", "DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI.", "Apply updates per vendor instructions.", "

"], [79, "CVE-2018-7600", "Drupal", "Drupal", "Links here", "2021-11-03", "2022-05-03", "Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.", "Apply updates per vendor instructions.", "

"], [80, "CVE-2021-22205", "ExifTool", "ExifTool", "Links here", "2021-11-03", "2021-11-17", "Anyone with the ability to upload an image that goes through the GitLab Workhorse could achieve RCE via a specially crafted file.", "Apply updates per vendor instructions.", "

"], [81, "CVE-2018-6789", "Exim", "Exim", "Links here", "2021-11-03", "2022-05-03", "Issue in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.", "Apply updates per vendor instructions.", "

"], [82, "CVE-2020-8657", "EyesOfNetwork", "EyesOfNetwork", "Links here", "2021-11-03", "2022-05-03", "Issue in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.", "Apply updates per vendor instructions.", "

"], [83, "CVE-2020-8655", "EyesOfNetwork", "EyesOfNetwork", "Links here", "2021-11-03", "2022-05-03", "Issue in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.", "Apply updates per vendor instructions.", "

"], [84, "CVE-2020-5902", "F5", "BIG IP", "Links here", "2021-11-03", "2022-05-03", "In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.", "Apply updates per vendor instructions.", "

"], [85, "CVE-2021-22986", "F5", "BIG-IP", "Links here", "2021-11-03", "2021-11-17", "The iControl REST interface has an unauthenticated remote command execution vulnerability.", "Apply updates per vendor instructions.", "

"], [86, "CVE-2021-35464", "ForgeRock", "Access Management server", "Links here", "2021-11-03", "2021-11-17", "ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server.", "Apply updates per vendor instructions.", "

"], [87, "CVE-2019-5591", "Fortinet", "FortiOS", "Links here", "2021-11-03", "2022-05-03", "A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.", "Apply updates per vendor instructions.", "

"], [88, "CVE-2020-12812", "Fortinet", "FortiOS", "Links here", "2021-11-03", "2022-05-03", "An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.", "Apply updates per vendor instructions.", "

"], [89, "CVE-2018-13379", "Fortinet", "FortiOS", "Links here", "2021-11-03", "2022-05-03", "An Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.", "Apply updates per vendor instructions.", "

"], [90, "CVE-2020-16010", "Google", "Chrome for Android", "Links here", "2021-11-03", "2022-05-03", "Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [91, "CVE-2020-15999", "Google", "Chrome", "Links here", "2021-11-03", "2021-11-17", "Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [92, "CVE-2021-21166", "Google", "Chrome", "Links here", "2021-11-03", "2021-11-17", "Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [93, "CVE-2020-16017", "Google", "Chrome", "Links here", "2021-11-03", "2022-05-03", "Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [94, "CVE-2021-37976", "Google", "Chrome", "Links here", "2021-11-03", "2021-11-17", "Information disclosure in Google Chrome that exists due to excessive data output in core.", "Apply updates per vendor instructions.", "

"], [95, "CVE-2020-16009", "Google", "Chromium V8", "Links here", "2021-11-03", "2022-05-03", "Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [96, "CVE-2021-30632", "Google", "Chrome", "Links here", "2021-11-03", "2021-11-17", "Google Chrome out-of-bounds write that allows to execute arbitrary code on the target system.", "Apply updates per vendor instructions.", "

"], [97, "CVE-2020-16013", "Google", "Chromium V8", "Links here", "2021-11-03", "2022-05-03", "Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [98, "CVE-2021-30633", "Google", "Chrome", "Links here", "2021-11-03", "2021-11-17", "Google Chrome Use-After-Free vulnerability", "Apply updates per vendor instructions.", "

"], [99, "CVE-2021-21148", "Google", "Chromium V8", "Links here", "2021-11-03", "2021-11-17", "Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [100, "CVE-2021-37973", "Google", "Chrome", "Links here", "2021-11-03", "2021-11-17", "Use-after-free weakness in Portals, Google's new web page navigation system for Chrome. Successful exploitation can let attackers to execute code.", "Apply updates per vendor instructions.", "

"], [101, "CVE-2021-30551", "Google", "Chromium V8", "Links here", "2021-11-03", "2021-11-17", "Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [102, "CVE-2021-37975", "Google", "Chrome", "Links here", "2021-11-03", "2021-11-17", "Google Chrome use-after-free error within the V8 browser engine.", "Apply updates per vendor instructions.", "

"], [103, "CVE-2020-6418", "Google", "Chromium V8", "Links here", "2021-11-03", "2022-05-03", "Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [104, "CVE-2021-30554", "Google", "Chrome", "Links here", "2021-11-03", "2021-11-17", "Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [105, "CVE-2021-21206", "Google", "Chromium Blink", "Links here", "2021-11-03", "2021-11-17", "Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [106, "CVE-2021-38000", "Google", "Chromium V8 Engine", "Links here", "2021-11-03", "2021-11-17", "", "Apply updates per vendor instructions.", "

"], [107, "CVE-2021-38003", "Google", "Chromium V8 Engine", "Links here", "2021-11-03", "2021-11-17", "", "Apply updates per vendor instructions.", "

"], [108, "CVE-2021-21224", "Google", "Chromium V8", "Links here", "2021-11-03", "2021-11-17", "Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [109, "CVE-2021-21193", "Google", "Chromium V8", "Links here", "2021-11-03", "2021-11-17", "Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [110, "CVE-2021-21220", "Google", "Chromium V8", "Links here", "2021-11-03", "2021-11-17", "Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [111, "CVE-2021-30563", "Google", "Chrome", "Links here", "2021-11-03", "2021-11-17", "Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [112, "CVE-2020-4430", "IBM", "IBM Data Risk Manager", "Links here", "2021-11-03", "2022-05-03", "IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535.", "Apply updates per vendor instructions.", "

"], [113, "CVE-2020-4427", "IBM", "IBM Data Risk Manager", "Links here", "2021-11-03", "2022-05-03", "IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532.", "Apply updates per vendor instructions.", "

"], [114, "CVE-2020-4428", "IBM", "IBM Data Risk Manager", "Links here", "2021-11-03", "2022-05-03", "IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.", "Apply updates per vendor instructions.", "

"], [115, "CVE-2019-4716", "IBM", "IBM Planning Analytics", "Links here", "2021-11-03", "2022-05-03", "IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as \"admin\", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.", "Apply updates per vendor instructions.", "

"], [116, "CVE-2016-3715", "ImageMagick", "ImageMagick", "Links here", "2021-11-03", "2022-05-03", "The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.", "Apply updates per vendor instructions.", "

"], [117, "CVE-2016-3718", "ImageMagick", "ImageMagick", "Links here", "2021-11-03", "2022-05-03", "The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.", "Apply updates per vendor instructions.", "

"], [118, "CVE-2020-15505", "Ivanti", "MobileIron Core & Connector", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability that allows remote attackers to execute arbitrary code via unspecified vectors.", "Apply updates per vendor instructions.", "

"], [119, "CVE-2021-30116", "Kaseya", "Kaseya VSA", "Links here", "2021-11-03", "2021-11-17", "Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021.", "Apply updates per vendor instructions.", "

"], [120, "CVE-2020-7961", "LifeRay", "Liferay Portal", "Links here", "2021-11-03", "2022-05-03", "Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).", "Apply updates per vendor instructions.", "

"], [121, "CVE-2021-23874", "McAfee", "McAfee Total Protection (MTP)", "Links here", "2021-11-03", "2021-11-17", "Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.", "Apply updates per vendor instructions.", "

"], [122, "CVE-2021-22506", "Micro Focus", "Micro Focus Access Manager", "Links here", "2021-11-03", "2021-11-17", "Micro Focus Access Manager versions prior to 5.0 contain a vulnerability which allows for information leakage.", "Apply updates per vendor instructions.", "

"], [123, "CVE-2021-22502", "Micro Focus", "Micro Focus Operation Bridge Reporter (OBR)", "Links here", "2021-11-03", "2021-11-17", "Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.", "Apply updates per vendor instructions.", "

"], [124, "CVE-2014-1812", "Microsoft", "Windows Group Policy", "Links here", "2021-11-03", "2022-05-03", "Allows remote authenticated users to obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share, as exploited in the wild in May 2014, aka \"Group Policy Preferences Password Elevation of Privilege Vulnerability.\"", "Apply updates per vendor instructions.", ""], [125, "CVE-2021-38647", "Microsoft", "Microsoft Azure Open Management Infrastructure (OMI)", "Links here", "2021-11-03", "2021-11-17", "Azure Open Management Infrastructure Remote Code Execution Vulnerability", "Apply updates per vendor instructions.", "

"], [125, "CVE-2021-38647", "Microsoft", "Microsoft Azure Open Management Infrastructure (OMI)", "Links here", "2021-11-03", "2021-11-17", "Azure Open Management Infrastructure Remote Code Execution Vulnerability", "Apply updates per vendor instructions.", "

"], [126, "CVE-2016-0167", "Microsoft", "Windows Kernel", "Links here", "2021-11-03", "2022-05-03", "The kernel-mode driver allows local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability,\" a different vulnerability than CVE-2016-0143 and CVE-2016-0165.", "Apply updates per vendor instructions.", "

"], [127, "CVE-2020-0878", "Microsoft", "Microsoft Edge, Internet Explorer", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory.", "Apply updates per vendor instructions.", "

"], [128, "CVE-2021-31955", "Microsoft", "Windows Kernel", "Links here", "2021-11-03", "2021-11-17", "Windows Kernel Information Disclosure Vulnerability", "Apply updates per vendor instructions.", "

"], [129, "CVE-2021-1647", "Microsoft", "Microsoft Defender", "Links here", "2021-11-03", "2021-11-17", "Microsoft Defender Remote Code Execution Vulnerability", "Apply updates per vendor instructions.", "

"], [130, "CVE-2021-33739", "Microsoft", "Microsoft Desktop Window Manager (DWM)", "Links here", "2021-11-03", "2021-11-17", "Microsoft Desktop Window Manager (DWM) Core Library Elevation of Privilege Vulnerability", "Apply updates per vendor instructions.", "

"], [131, "CVE-2016-0185", "Microsoft", "Windows Media Center", "Links here", "2021-11-03", "2022-05-03", "Media Center allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka \"Windows Media Center Remote Code Execution Vulnerability.\"", "Apply updates per vendor instructions.", "

"], [132, "CVE-2020-0683", "Microsoft", "Windows Installer", "Links here", "2021-11-03", "2022-05-03", "An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686.", "Apply updates per vendor instructions.", "

"], [133, "CVE-2020-17087", "Microsoft", "Windows Kernel", "Links here", "2021-11-03", "2022-05-03", "Windows Kernel Local Elevation of Privilege Vulnerability", "Apply updates per vendor instructions.", "

"], [134, "CVE-2021-33742", "Microsoft", "Windows MSHTML Platform", "Links here", "2021-11-03", "2021-11-17", "Windows MSHTML Platform Remote Code Execution Vulnerability", "Apply updates per vendor instructions.", "

"], [135, "CVE-2021-31199", "Microsoft", "Microsoft Enhanced Cryptographic Provider", "Links here", "2021-11-03", "2021-11-17", "Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2021-31201.", "Apply updates per vendor instructions.", "

"], [136, "CVE-2021-33771", "Microsoft", "Windows Kernel", "Links here", "2021-11-03", "2021-11-17", "Windows Kernel Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2021-31979, CVE-2021-34514.", "Apply updates per vendor instructions.", "

"], [137, "CVE-2021-31956", "Microsoft", "Windows NTFS", "Links here", "2021-11-03", "2021-11-17", "Windows NTFS Elevation of Privilege Vulnerability", "Apply updates per vendor instructions.", "

"], [138, "CVE-2021-31201", "Microsoft", "Microsoft Enhanced Cryptographic Provider", "Links here", "2021-11-03", "2021-11-17", "Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2021-31199.", "Apply updates per vendor instructions.", "

"], [139, "CVE-2021-31979", "Microsoft", "Windows Kernel", "Links here", "2021-11-03", "2021-11-17", "Windows Kernel Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2021-33771, CVE-2021-34514.", "Apply updates per vendor instructions.", "

"], [140, "CVE-2020-0938", "Microsoft", "Windows, Windows Adobe Type Manager Library", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format. This CVE ID is unique from CVE-2020-1020.", "Apply updates per vendor instructions.", "

"], [141, "CVE-2020-17144", "Microsoft", "Microsoft Exchange Server", "Links here", "2021-11-03", "2022-05-03", "Microsoft Exchange Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2020-17117, CVE-2020-17132, CVE-2020-17141, CVE-2020-17142.", "Apply updates per vendor instructions.", "

"], [142, "CVE-2020-0986", "Microsoft", "Windows Kernel", "Links here", "2021-11-03", "2022-05-03", "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1264, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1307, CVE-2020-1316.", "Apply updates per vendor instructions.", "

"], [143, "CVE-2020-1020", "Microsoft", "Windows, Windows Adobe Type Manager Library", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format. This CVE ID is unique from CVE-2020-0938.", "Apply updates per vendor instructions.", "

"], [144, "CVE-2021-38645", "Microsoft", "Microsoft Azure Open Management Infrastructure (OMI)", "Links here", "2021-11-03", "2021-11-17", "Open Management Infrastructure Elevation of Privilege Vulnerability", "Apply updates per vendor instructions.", "

"], [145, "CVE-2021-34523", "Microsoft", "Microsoft Exchange Server", "Links here", "2021-11-03", "2021-11-17", "Microsoft Exchange Server Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2021-33768, CVE-2021-34470.", "Apply updates per vendor instructions.", "

"], [146, "CVE-2017-7269", "Microsoft", "Internet Information Services (IIS)", "Links here", "2021-11-03", "2022-05-03", "Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with \"If: "], [147, "CVE-2021-36948", "Microsoft", "Windows Update Medic Service", "Links here", "2021-11-03", "2021-11-17", "Windows Update Medic Service Elevation of Privilege Vulnerability", "Apply updates per vendor instructions.", "

"], [147, "CVE-2021-36948", "Microsoft", "Windows Update Medic Service", "Links here", "2021-11-03", "2021-11-17", "Windows Update Medic Service Elevation of Privilege Vulnerability", "Apply updates per vendor instructions.", "

"], [148, "CVE-2021-38649", "Microsoft", "Microsoft Azure Open Management Infrastructure (OMI)", "Links here", "2021-11-03", "2021-11-17", "Open Management Infrastructure Elevation of Privilege Vulnerability", "Apply updates per vendor instructions.", "

"], [149, "CVE-2020-0688", "Microsoft", "Microsoft Exchange Server", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.", "Apply updates per vendor instructions.", "

"], [150, "CVE-2017-0143", "Microsoft", "SMBv1 server", "Links here", "2021-11-03", "2022-05-03", "The SMBv1 server allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.", "Apply updates per vendor instructions.", "

"], [151, "CVE-2016-7255", "Microsoft", "Windows, Windows Server", "Links here", "2021-11-03", "2022-05-03", "The kernel-mode drivers allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability\"", "Apply updates per vendor instructions.", "

"], [152, "CVE-2019-0708", "Microsoft", "Remote Desktop Services", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests.", "Apply updates per vendor instructions.", "

"], [153, "CVE-2021-34473", "Microsoft", "Microsoft Exchange Server", "Links here", "2021-11-03", "2021-11-17", "Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2021-31196, CVE-2021-31206.", "Apply updates per vendor instructions.", "

"], [154, "CVE-2020-1464", "Microsoft", "Windows", "Links here", "2021-11-03", "2022-05-03", "A spoofing vulnerability exists when Windows incorrectly validates file signatures.", "Apply updates per vendor instructions.", "

"], [155, "CVE-2021-1732", "Microsoft", "Windows Win32k", "Links here", "2021-11-03", "2021-11-17", "Windows Win32k Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2021-1698.", "Apply updates per vendor instructions.", "

"], [156, "CVE-2021-34527", "Microsoft", "Windows", "Links here", "2021-11-03", "2021-07-20", "Windows Print Spooler Remote Code Execution Vulnerability", "Apply updates per vendor instructions.", "

"], [157, "CVE-2021-31207", "Microsoft", "Microsoft Exchange Server", "Links here", "2021-11-03", "2021-11-17", "Microsoft Exchange Server Security Feature Bypass Vulnerability", "Apply updates per vendor instructions.", "

"], [158, "CVE-2019-0803", "Microsoft", "Windows Win32k", "Links here", "2021-11-03", "2022-05-03", "An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0859.", "Apply updates per vendor instructions.", "

"], [159, "CVE-2020-1040", "Microsoft", "Hyper-V RemoteFX vGPU", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system. This CVE ID is unique from CVE-2020-1032, CVE-2020-1036, CVE-2020-1041, CVE-2020-1042, CVE-2020-1043.", "Apply updates per vendor instructions.", "

"], [160, "CVE-2021-28310", "Microsoft", "Windows Win32k", "Links here", "2021-11-03", "2021-11-17", "Win32k Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2021-27072.", "Apply updates per vendor instructions.", "

"], [161, "CVE-2020-1350", "Microsoft", "Windows Domain Name System Server", "Links here", "2021-11-03", "2020-07-24", "A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests.", "Apply updates per vendor instructions.", "

"], [162, "CVE-2021-26411", "Microsoft", "Microsoft Edge, Internet Explorer", "Links here", "2021-11-03", "2021-11-17", "Internet Explorer Memory Corruption Vulnerability", "Apply updates per vendor instructions.", "

"], [163, "CVE-2019-0859", "Microsoft", "Windows Win32k", "Links here", "2021-11-03", "2022-05-03", "An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0803.", "Apply updates per vendor instructions.", "

"], [164, "CVE-2021-40444", "Microsoft", "Microsoft MSHTML", "Links here", "2021-11-03", "2021-11-17", "Microsoft MSHTML Remote Code Execution Vulnerability", "Apply updates per vendor instructions.", "

"], [165, "CVE-2017-8759", "Microsoft", "Microsoft .NET Framework", "Links here", "2021-11-03", "2022-05-03", "Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application.", "Apply updates per vendor instructions.", "

"], [166, "CVE-2018-8653", "Microsoft", "Internet Explorer Scripting Engine", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka \"Scripting Engine Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2018-8643.", "Apply updates per vendor instructions.", "

"], [167, "CVE-2019-0797", "Microsoft", "Windows Win32k", "Links here", "2021-11-03", "2022-05-03", "An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0808.", "Apply updates per vendor instructions.", "

"], [168, "CVE-2021-36942", "Microsoft", "Windows Local Security Authority (LSA)", "Links here", "2021-11-03", "2021-11-17", "Windows Local Security Authority (LSA) Spoofing Vulnerability \"PetitPotam\"", "Apply updates per vendor instructions.", "

"], [169, "CVE-2019-1215", "Microsoft", "Windows Winsock", "Links here", "2021-11-03", "2022-05-03", "An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.", "Apply updates per vendor instructions.", "

"], [170, "CVE-2018-0798", "Microsoft", "Microsoft Office", "Links here", "2021-11-03", "2022-05-03", "Allows a remote code execution vulnerability due to the way objects are handled in memory, aka \"Microsoft Office Memory Corruption Vulnerability\".", "Apply updates per vendor instructions.", "

"], [171, "CVE-2018-0802", "Microsoft", "Microsoft Office", "Links here", "2021-11-03", "2022-05-03", "Allows a remote code execution vulnerability due to the way objects are handled in memory, aka \"Microsoft Office Memory Corruption Vulnerability\". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.", "Apply updates per vendor instructions.", "

"], [172, "CVE-2012-0158", "Microsoft", "MSCOMCTL.OCX", "Links here", "2021-11-03", "2022-05-03", "Allows remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers \"system state\" corruption, as exploited in the wild in April 2012, aka \"MSCOMCTL.OCX RCE Vulnerability.", "Apply updates per vendor instructions.", ""], [173, "CVE-2015-1641", "Microsoft", "Microsoft Office", "Links here", "2021-11-03", "2022-05-03", "Allows remote attackers to execute arbitrary code via a crafted RTF document, aka \"Microsoft Office Memory Corruption Vulnerability.\"", "Apply updates per vendor instructions.", ""], [174, "CVE-2021-27085", "Microsoft", "Internet Explorer", "Links here", "2021-11-03", "2021-11-17", "Internet Explorer Remote Code Execution Vulnerability", "Apply updates per vendor instructions.", "

"], [174, "CVE-2021-27085", "Microsoft", "Internet Explorer", "Links here", "2021-11-03", "2021-11-17", "Internet Explorer Remote Code Execution Vulnerability", "Apply updates per vendor instructions.", "

"], [175, "CVE-2019-0541", "Microsoft", "MSHTML engine", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input, aka \"MSHTML Engine Remote Code Execution Vulnerability.", "Apply updates per vendor instructions.", "

"], [176, "CVE-2017-11882", "Microsoft", "Microsoft Office", "Links here", "2021-11-03", "2022-05-03", "Allows an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka \"Microsoft Office Memory Corruption Vulnerability\". This CVE ID is unique from CVE-2017-11884.", "Apply updates per vendor instructions.", "

"], [177, "CVE-2020-0674", "Microsoft", "Internet Explorer Scripting Engine", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. This CVE ID is unique from CVE-2020-0673, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713, CVE-2020-0767.", "Apply updates per vendor instructions.", "

"], [178, "CVE-2021-27059", "Microsoft", "Microsoft Office", "Links here", "2021-11-03", "2021-11-17", "Microsoft Office Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2021-24108, CVE-2021-27057.", "Apply updates per vendor instructions.", "

"], [179, "CVE-2019-1367", "Microsoft", "Internet Explorer Scripting Engine", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. This CVE ID is unique from CVE-2019-1221.", "Apply updates per vendor instructions.", "

"], [180, "CVE-2017-0199", "Microsoft", "Windows, Windows Server, Microsoft Office", "Links here", "2021-11-03", "2022-05-03", "Allows remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.\"", "Apply updates per vendor instructions.", "

"], [181, "CVE-2020-1380", "Microsoft", "Internet Explorer", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-1555, CVE-2020-1570.", "Apply updates per vendor instructions.", "

"], [182, "CVE-2019-1429", "Microsoft", "Internet Explorer Scripting Engine", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1428.", "Apply updates per vendor instructions.", "

"], [183, "CVE-2017-11774", "Microsoft", "Microsoft Outlook", "Links here", "2021-11-03", "2022-05-03", "Allows an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka \"Microsoft Outlook Security Feature Bypass Vulnerability.\"", "Apply updates per vendor instructions.", "

"], [184, "CVE-2020-0968", "Microsoft", "Internet Explorer Scripting Engine", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. This CVE ID is unique from CVE-2020-0970.", "Apply updates per vendor instructions.", "

"], [185, "CVE-2020-1472", "Microsoft", "Netlogon Remote Protocol (MS-NRPC)", "Links here", "2021-11-03", "2020-09-21", "An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'.", "Apply updates per vendor instructions.", "

"], [186, "CVE-2021-26855", "Microsoft", "Microsoft Exchange Server", "Links here", "2021-11-03", "2021-04-16", "Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.", "Apply updates per vendor instructions.", "

"], [187, "CVE-2021-26858", "Microsoft", "Microsoft Exchange Server", "Links here", "2021-11-03", "2021-04-16", "Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-27065, CVE-2021-27078.", "Apply updates per vendor instructions.", "

"], [188, "CVE-2021-27065", "Microsoft", "Microsoft Exchange Server", "Links here", "2021-11-03", "2021-04-16", "Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27078.", "Apply updates per vendor instructions.", "

"], [189, "CVE-2020-1054", "Microsoft", "Windows Win32k", "Links here", "2021-11-03", "2022-05-03", "An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory", "Apply updates per vendor instructions.", "

"], [190, "CVE-2021-1675", "Microsoft", "Windows Print Spooler", "Links here", "2021-11-03", "2021-11-17", "Windows Print Spooler Elevation of Privilege Vulnerability", "Apply updates per vendor instructions.", "

"], [191, "CVE-2021-34448", "Microsoft", "Scripting Engine", "Links here", "2021-11-03", "2021-11-17", "Scripting Engine Memory Corruption Vulnerability", "Apply updates per vendor instructions.", "

"], [192, "CVE-2020-0601", "Microsoft", "Windows CryptoAPI", "Links here", "2021-11-03", "2020-01-29", "A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.", "Apply updates per vendor instructions.", "

"], [193, "CVE-2019-0604", "Microsoft", "SharePoint", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.", "Apply updates per vendor instructions.", "

"], [194, "CVE-2020-0646", "Microsoft", "Microsoft .NET Framework", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.", "Apply updates per vendor instructions.", "

"], [195, "CVE-2019-0808", "Microsoft", "Windows Win32k", "Links here", "2021-11-03", "2022-05-03", "An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0797.", "Apply updates per vendor instructions.", "

"], [196, "CVE-2021-26857", "Microsoft", "Microsoft Exchange Server", "Links here", "2021-11-03", "2021-04-16", "Microsoft Exchange Server Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2021-26412, CVE-2021-26854, CVE-2021-26855, CVE-2021-26858, CVE-2021-27065, CVE-2021-27078.", "Apply updates per vendor instructions.", "

"], [197, "CVE-2020-1147", "Microsoft", "Microsoft .NET Framework, Microsoft SharePoint, Visual Studio", "Links here", "2021-11-03", "2022-05-03", "A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input.", "Apply updates per vendor instructions.", "

"], [198, "CVE-2019-1214", "Microsoft", "Windows Common Log File System (CLFS) driver", "Links here", "2021-11-03", "2022-05-03", "An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'.", "Apply updates per vendor instructions.", "

"], [199, "CVE-2016-3235", "Microsoft", "Microsoft Visio/Office", "Links here", "2021-11-03", "2022-05-03", "Allows local users to gain privileges via a crafted application, aka \"Microsoft Office OLE DLL Side Loading Vulnerability.\"", "Apply updates per vendor instructions.", "

"], [200, "CVE-2019-0863", "Microsoft", "Windows Error Reporting (WER)", "Links here", "2021-11-03", "2022-05-03", "An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.", "Apply updates per vendor instructions.", "

"], [201, "CVE-2021-36955", "Microsoft", "Windows Common Log File System Driver", "Links here", "2021-11-03", "2021-11-17", "Microsoft Windows Common Log File System Driver contains an unspecified vulnerability which allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [202, "CVE-2021-38648", "Microsoft", "Microsoft Azure Open Management Infrastructure (OMI)", "Links here", "2021-11-03", "2021-11-17", "Open Management Infrastructure Elevation of Privilege Vulnerability", "Apply updates per vendor instructions.", "

"], [203, "CVE-2020-6819", "Mozilla", "nsDocShell destructor", "Links here", "2021-11-03", "2022-05-03", "A race condition can cause a use-after-free when running the nsDocShell destructor. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.", "Apply updates per vendor instructions.", "

"], [204, "CVE-2020-6820", "Mozilla", "ReadableStream", "Links here", "2021-11-03", "2022-05-03", "A race condition can cause a use-after-free when handling a ReadableStream. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.", "Apply updates per vendor instructions.", "

"], [205, "CVE-2019-17026", "Mozilla", "IonMonkey JIT compiler", "Links here", "2021-11-03", "2022-05-03", "Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1", "Apply updates per vendor instructions.", "

"], [206, "CVE-2019-15949", "Nagios", "Nagios XI", "Links here", "2021-11-03", "2022-05-03", "The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user", "Apply updates per vendor instructions.", "

"], [207, "CVE-2020-26919", "Netgear", "NETGEAR JGS516PE devices", "Links here", "2021-11-03", "2022-05-03", "NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.", "Apply updates per vendor instructions.", "

"], [208, "CVE-2019-19356", "Netis", "Netis WF2419", "Links here", "2021-11-03", "2022-05-03", "Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123", "Apply updates per vendor instructions.", "

"], [209, "CVE-2020-2555", "Oracle", "Oracle Coherence", "Links here", "2021-11-03", "2022-05-03", "Allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence", "Apply updates per vendor instructions.", "

"], [210, "CVE-2012-3152", "Oracle", "Oracle Reports Developer", "Links here", "2021-11-03", "2022-05-03", "Allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component.", "Apply updates per vendor instructions.", ""], [211, "CVE-2020-14871", "Oracle", "Oracle Solaris", "Links here", "2021-11-03", "2022-05-03", "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris.", "Apply updates per vendor instructions.", "

"], [211, "CVE-2020-14871", "Oracle", "Oracle Solaris", "Links here", "2021-11-03", "2022-05-03", "Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris.", "Apply updates per vendor instructions.", "

"], [212, "CVE-2015-4852", "Oracle", "Oracle WebLogic Server", "Links here", "2021-11-03", "2022-05-03", "Allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar.", "Apply updates per vendor instructions.", ""], [213, "CVE-2020-14750", "Oracle", "Oracle WebLogic Server", "Links here", "2021-11-03", "2022-05-03", "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.", "Apply updates per vendor instructions.", "

"], [214, "CVE-2020-14882", "Oracle", "Oracle WebLogic Server", "Links here", "2021-11-03", "2022-05-03", "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.", "Apply updates per vendor instructions.", "

"], [215, "CVE-2020-14883", "Oracle", "Oracle WebLogic Server", "Links here", "2021-11-03", "2022-05-03", "Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server.", "Apply updates per vendor instructions.", "

"], [216, "CVE-2020-8644", "PlaySMS", "PlaySMS", "Links here", "2021-11-03", "2022-05-03", "PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.", "Apply updates per vendor instructions.", "

"], [217, "CVE-2019-18935", "Progess", "ASP.NET AJAX", "Links here", "2021-11-03", "2022-05-03", "Contains a .NET deserialization vulnerability in the RadAsyncUpload function that can result in remote code execution.", "Apply updates per vendor instructions.", "

"], [218, "CVE-2021-22893", "Pulse", "Pulse Connect Secure", "Links here", "2021-11-03", "2021-04-23", "Vulnerability to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway.", "Apply updates per vendor instructions.", "

"], [219, "CVE-2020-8243", "Pulse", "Pulse Connect Secure", "Links here", "2021-11-03", "2021-04-23", "A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [220, "CVE-2021-22900", "Pulse", "Pulse Connect Secure", "Links here", "2021-11-03", "2021-04-23", "A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.", "Apply updates per vendor instructions.", "

"], [221, "CVE-2021-22894", "Pulse", "Pulse Connect Secure", "Links here", "2021-11-03", "2021-04-23", "A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.", "Apply updates per vendor instructions.", "

"], [222, "CVE-2020-8260", "Pulse", "Pulse Connect Secure", "Links here", "2021-11-03", "2021-04-23", "A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.", "Apply updates per vendor instructions.", "

"], [223, "CVE-2021-22899", "Pulse", "Pulse Connect Secure", "Links here", "2021-11-03", "2021-04-23", "Allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature.", "Apply updates per vendor instructions.", "

"], [224, "CVE-2019-11510", "Pulse", "Pulse Secure Pulse Connect Secure (PCS)", "Links here", "2021-11-03", "2021-04-23", "An unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability.", "Apply updates per vendor instructions.", "

"], [225, "CVE-2019-11539", "Pulse Secure", "Connect Secure, Policy Secure", "Links here", "2021-11-03", "2022-05-03", "Pulse Secure's Connect and Policy secure platforms contain a vulnerability in the admin web interface which allows an attacker to inject and execute commands.", "Apply updates per vendor instructions.", "

"], [226, "CVE-2021-1906", "Qualcomm", "Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables", "Links here", "2021-11-03", "2021-11-17", "Improper handling of address deregistration on failure can lead to new GPU address allocation failure.", "Apply updates per vendor instructions.", "

"], [227, "CVE-2021-1905", "Qualcomm", "Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables", "Links here", "2021-11-03", "2022-05-03", "Possible use after free due to improper handling of memory mapping of multiple processes simultaneously", "Apply updates per vendor instructions.", "

"], [228, "CVE-2020-10221", "rConfig", "rConfig", "Links here", "2021-11-03", "2022-05-03", "lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.", "Apply updates per vendor instructions.", "

"], [229, "CVE-2021-35395", "Realtek", "Jungle Software Development Kit (SDK)", "Links here", "2021-11-03", "2021-11-17", "Realtek Jungle SDK version v2.x up to v3.4.14B arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [230, "CVE-2017-16651", "Roundcube", "Roundcube Webmail", "Links here", "2021-11-03", "2022-05-03", "Allows unauthorized access to arbitrary files on the host's filesystem, including configuration files. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.", "Apply updates per vendor instructions.", "

"], [231, "CVE-2020-11652", "SaltStack", "Salt", "Links here", "2021-11-03", "2022-05-03", "The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.", "Apply updates per vendor instructions.", "

"], [232, "CVE-2020-11651", "SaltStack", "Salt", "Links here", "2021-11-03", "2022-05-03", "The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication.", "Apply updates per vendor instructions.", "

"], [233, "CVE-2020-16846", "SaltStack", "Salt", "Links here", "2021-11-03", "2022-05-03", "An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.", "Apply updates per vendor instructions.", "

"], [234, "CVE-2018-2380", "SAP", "SAP CRM", "Links here", "2021-11-03", "2022-05-03", "SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.", "Apply updates per vendor instructions.", "

"], [235, "CVE-2010-5326", "SAP", "SAP NetWeaver Application Server Java platforms", "Links here", "2021-11-03", "2022-05-03", "The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request.", "Apply updates per vendor instructions.", "

"], [236, "CVE-2016-9563", "SAP", "SAP NetWeaver AS JAVA", "Links here", "2021-11-03", "2022-05-03", "BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.", "Apply updates per vendor instructions.", "

"], [237, "CVE-2020-6287", "SAP", "SAP NetWeaver AS JAVA (LM Configuration Wizard)", "Links here", "2021-11-03", "2022-05-03", "SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system.", "Apply updates per vendor instructions.", "

"], [238, "CVE-2020-6207", "SAP", "SAP Solution Manager (User Experience Monitoring)", "Links here", "2021-11-03", "2022-05-03", "SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.", "Apply updates per vendor instructions.", "

"], [239, "CVE-2016-3976", "SAP", "SAP NetWeaver AS Java", "Links here", "2021-11-03", "2022-05-03", "Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.", "Apply updates per vendor instructions.", "

"], [240, "CVE-2019-16256", "SIMalliance", "SIMalliance Toolbox (S@T) Browser", "Links here", "2021-11-03", "2022-05-03", "Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.", "Apply updates per vendor instructions.", "

"], [241, "CVE-2020-10148", "SolarWinds", "SolarWinds Orion Platform", "Links here", "2021-11-03", "2022-05-03", "The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.", "Apply updates per vendor instructions.", "

"], [242, "CVE-2021-35211", "SolarWinds", "SolarWinds nServ-U", "Links here", "2021-11-03", "2021-11-17", "Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability.", "Apply updates per vendor instructions.", "

"], [243, "CVE-2016-3643", "SolarWinds", "SolarWinds Virtualization Manager", "Links here", "2021-11-03", "2022-05-03", "SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by \"sudo cat /etc/passwd.\"", "Apply updates per vendor instructions.", "

"], [244, "CVE-2020-10199", "Sonatype", "Sonatype Nexus Repository", "Links here", "2021-11-03", "2022-05-03", "Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).", "Apply updates per vendor instructions.", "

"], [245, "CVE-2021-20021", "SonicWall", "SonicWall Email Security", "Links here", "2021-11-03", "2021-11-17", "A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.", "Apply updates per vendor instructions.", "

"], [246, "CVE-2019-7481", "SonicWall", "SMA1000", "Links here", "2021-11-03", "2022-05-03", "Vulnerability in SonicWall SMA100 versions 9.0.0.3 and earlier allow an unauthenticated user to gain read-only access to unauthorized resources.", "Apply updates per vendor instructions.", "

"], [247, "CVE-2021-20022", "SonicWall", "SonicWall Email Security", "Links here", "2021-11-03", "2021-11-17", "SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.", "Apply updates per vendor instructions.", "

"], [248, "CVE-2021-20023", "SonicWall", "SonicWall Email Security", "Links here", "2021-11-03", "2021-11-17", "SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.", "Apply updates per vendor instructions.", "

"], [249, "CVE-2021-20016", "SonicWall", "SonicWall SSLVPN SMA100", "Links here", "2021-11-03", "2021-11-17", "Allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information in SMA100 build version 10.x.", "Apply updates per vendor instructions.", "

"], [250, "CVE-2020-12271", "Sophos", "Sophos XG Firewall devices", "Links here", "2021-11-03", "2022-05-03", "A SQL injection issue that causes affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone.", "Apply updates per vendor instructions.", "

"], [251, "CVE-2020-10181", "Sumavision", "Sumavision Enhanced Multimedia Router (EMR)", "Links here", "2021-11-03", "2022-05-03", "goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.", "Apply updates per vendor instructions.", "

"], [252, "CVE-2017-6327", "Symantec", "Symantec Messaging Gateway", "Links here", "2021-11-03", "2022-05-03", "The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution.", "Apply updates per vendor instructions.", "

"], [253, "CVE-2019-18988", "TeamViewer", "TeamViewer Desktop", "Links here", "2021-11-03", "2022-05-03", "Allows a bypass of remote-login access control because the same key is used for different customers' installations.", "Apply updates per vendor instructions.", "

"], [254, "CVE-2017-9248", "Telerik", "ASP.NET AJAX and Sitefinity", "Links here", "2021-11-03", "2022-05-03", "Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.DialogParametersEncryptionKey or the MachineKey.", "Apply updates per vendor instructions.", "

"], [255, "CVE-2021-31755", "Tenda", "Tenda AC11 devices", "Links here", "2021-11-03", "2021-11-17", "Tenda AC11 devices with firmware through 02.03.01.104_CN contain a stack buffer overflow vulnerability in /goform/setmac which allows for arbitrary execution.", "Apply updates per vendor instructions.", "

"], [256, "CVE-2020-10987", "Tenda", "Tenda AC15 AC1900", "Links here", "2021-11-03", "2022-05-03", "The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.", "Apply updates per vendor instructions.", "

"], [257, "CVE-2018-14558", "Tenda", "Tenda AC7, AC9, and AC10 devices", "Links here", "2021-11-03", "2022-05-03", "Issue on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the \"formsetUsbUnload\" function executes a dosystemCmd function with untrusted input.", "Apply updates per vendor instructions.", "

"], [258, "CVE-2018-20062", "ThinkPHP", "NoneCms", "Links here", "2021-11-03", "2022-05-03", "Issue in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\\think\\Request/input&filter=phpinfo&data=1 query string.", "Apply updates per vendor instructions.", "

"], [259, "CVE-2019-9082", "ThinkPHP", "ThinkPHP", "Links here", "2021-11-03", "2022-05-03", "ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.", "Apply updates per vendor instructions.", "

"], [260, "CVE-2019-18187", "Trend Micro", "Trend Micro OfficeScan", "Links here", "2021-11-03", "2022-05-03", "Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE).", "Apply updates per vendor instructions.", "

"], [261, "CVE-2020-8467", "Trend Micro", "Trend Micro Apex One and OfficeScan XG", "Links here", "2021-11-03", "2022-05-03", "A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE).", "Apply updates per vendor instructions.", "

"], [262, "CVE-2020-8468", "Trend Micro", "Trend Micro Apex One, OfficeScan XG and Worry-Free Business Security", "Links here", "2021-11-03", "2022-05-03", "Agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components.", "Apply updates per vendor instructions.", "

"], [263, "CVE-2020-24557", "Trend Micro", "Trend Micro Apex One and Worry-Free Business Security", "Links here", "2021-11-03", "2022-05-03", "A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation", "Apply updates per vendor instructions.", "

"], [264, "CVE-2020-8599", "Trend Micro", "Trend Micro Apex One and OfficeScan XG server", "Links here", "2021-11-03", "2022-05-03", "Server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login.", "Apply updates per vendor instructions.", "

"], [265, "CVE-2021-36742", "Trend Micro", "Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security", "Links here", "2021-11-03", "2021-11-17", "An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.", "Apply updates per vendor instructions.", "

"], [266, "CVE-2021-36741", "Trend Micro", "Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security", "Links here", "2021-11-03", "2021-11-17", "An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product's management console in order to exploit this vulnerability.", "Apply updates per vendor instructions.", "

"], [267, "CVE-2019-20085", "TVT", "NVMS-1000", "Links here", "2021-11-03", "2022-05-03", "TVT NVMS-1000 devices allow GET /.. Directory Traversal", "Apply updates per vendor instructions.", "

"], [268, "CVE-2020-5849", "Unraid", "Unraid", "Links here", "2021-11-03", "2022-05-03", "Unraid 6.8.0 allows authentication bypass.", "Apply updates per vendor instructions.", "

"], [269, "CVE-2020-5847", "Unraid", "Unraid", "Links here", "2021-11-03", "2022-05-03", "Unraid through 6.8.0 allows Remote Code Execution.", "Apply updates per vendor instructions.", "

"], [270, "CVE-2019-16759", "vBulletin", "vBulletin", "Links here", "2021-11-03", "2022-05-03", "vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.", "Apply updates per vendor instructions.", "

"], [271, "CVE-2020-17496", "vBulletin", "vBulletin", "Links here", "2021-11-03", "2022-05-03", "vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.", "Apply updates per vendor instructions.", "

"], [272, "CVE-2019-5544", "VMWare", "ESXi, Horizon DaaS Appliances", "Links here", "2021-11-03", "2022-05-03", "OpenSLP as used in ESXi and the Horizon DaaS appliances have a heap overwrite issue. A malicious actor with network access to port 427 on an ESXi host or on any Horizon DaaS management appliance may be able to overwrite the heap of the OpenSLP service resulting in remote code execution.", "Apply updates per vendor instructions.", "

"], [273, "CVE-2020-3992", "VMWare", "ESXi", "Links here", "2021-11-03", "2022-05-03", "OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.", "Apply updates per vendor instructions.", "

"], [274, "CVE-2020-3950", "VMWare", "VMWare Fusion, VMware Remote Console for Mac, and Horizon Client for Mac", "Links here", "2021-11-03", "2022-05-03", "Privilege escalation vulnerability due to improper use of setuid binaries.", "Apply updates per vendor instructions.", "

"], [275, "CVE-2021-22005", "VMWare", "vCenter Server", "Links here", "2021-11-03", "2021-11-17", "VMWare vCenter Server file upload vulnerability in the vmware-analytics service that allows to execute code on vCenter Server.", "Apply updates per vendor instructions.", "

"], [276, "CVE-2020-3952", "VMWare", "vCenter Server", "Links here", "2021-11-03", "2022-05-03", "Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.", "Apply updates per vendor instructions.", "

"], [277, "CVE-2021-21972", "VMWare", "vCenter Server", "Links here", "2021-11-03", "2021-11-17", "The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.", "Apply updates per vendor instructions.", "

"], [278, "CVE-2021-21985", "VMWare", "vCenter Server", "Links here", "2021-11-03", "2021-11-17", "The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.", "Apply updates per vendor instructions.", "

"], [279, "CVE-2020-4006", "VMWare", "VMWare Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector", "Links here", "2021-11-03", "2022-05-03", "VMWare Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.", "Apply updates per vendor instructions.", "

"], [280, "CVE-2020-25213", "WordPress", "File Manager", "Links here", "2021-11-03", "2022-05-03", "The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension.", "Apply updates per vendor instructions.", "

"], [281, "CVE-2020-11738", "WordPress", "Snap Creek Duplicator", "Links here", "2021-11-03", "2022-05-03", "The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.", "Apply updates per vendor instructions.", "

"], [282, "CVE-2019-9978", "WordPress", "Social-Warfare", "Links here", "2021-11-03", "2022-05-03", "The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.", "Apply updates per vendor instructions.", "

"], [283, "CVE-2021-27561", "Yealink", "Device Management Platform", "Links here", "2021-11-03", "2021-11-17", "Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication", "Apply updates per vendor instructions.", "

"], [284, "CVE-2021-40539", "Zoho", "ManageEngine ADSelfServicePlus", "Links here", "2021-11-03", "2021-11-17", "Zoho ManageEngine ADSelfService Plus versions 6113 and earlier contain an authentication bypass vulnerability which allows for RCE.", "Apply updates per vendor instructions.", "

"], [285, "CVE-2020-10189", "Zoho", "ManageEngine Desktop Central", "Links here", "2021-11-03", "2022-05-03", "Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.", "Apply updates per vendor instructions.", "

"], [286, "CVE-2019-8394", "Zoho", "ManageEngine ServiceDesk Plus (SDP)", "Links here", "2021-11-03", "2022-05-03", "Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.", "Apply updates per vendor instructions.", "

"], [287, "CVE-2020-29583", "ZyXEL", "Unified Security Gateway (USG)", "Links here", "2021-11-03", "2022-05-03", "Firmware version 4.60 of ZyXEL USG devices contains an undocumented account (zyfwp) with an unchangeable password.", "Apply updates per vendor instructions.", "

"], [288, "CVE-2021-22204", "Perl", "Exiftool", "Links here", "2021-11-17", "2021-12-01", "Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image", "Apply updates per vendor instructions.", "

"], [289, "CVE-2021-40449", "Microsoft", "Windows OS", "Links here", "2021-11-17", "2021-12-01", "Unspecified vulnerability allows for an authenticated user to escalate privileges.", "Apply updates per vendor instructions.", "

"], [290, "CVE-2021-42321", "Microsoft", "Exchange", "Links here", "2021-11-17", "2021-12-01", "An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.", "Apply updates per vendor instructions.", "

"], [291, "CVE-2021-42292", "Microsoft", "Office", "Links here", "2021-11-17", "2021-12-01", "A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [292, "CVE-2020-11261", "Qualcomm", "Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables", "Links here", "2021-12-01", "2022-06-01", "Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables", "Apply updates per vendor instructions.", "

"], [293, "CVE-2018-14847", "MikroTik", "RouterOS", "Links here", "2021-12-01", "2022-06-01", "MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.", "Apply updates per vendor instructions.", "

"], [294, "CVE-2021-37415", "Zoho", "ManageEngine ServiceDesk Plus (SDP)", "Links here", "2021-12-01", "2021-12-15", "Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication", "Apply updates per vendor instructions.", "

"], [295, "CVE-2021-40438", "Apache", "Apache", "Links here", "2021-12-01", "2021-12-15", "A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.", "Apply updates per vendor instructions.", "

"], [296, "CVE-2021-44077", "Zoho", "ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus", "Links here", "2021-12-01", "2021-12-15", "Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution", "Apply updates per vendor instructions.", "

"], [297, "CVE-2021-44515", "Zoho Corporation", "Desktop Central", "Links here", "2021-12-10", "2021-12-24", "Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server.", "Apply updates per vendor instructions.", "

"], [298, "CVE-2019-13272", "Linux", "Kernel", "Links here", "2021-12-10", "2022-06-10", "Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability which allows local users to obtain root access.", "Apply updates per vendor instructions.", "

"], [299, "CVE-2021-35394", "Realtek", "Jungle Software Development Kit (SDK)", "Links here", "2021-12-10", "2021-12-24", "RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution.", "Apply updates per vendor instructions.", "

"], [300, "CVE-2019-7238", "Sonatype", "Nexus Repository Manager", "Links here", "2021-12-10", "2022-06-10", "Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [301, "CVE-2019-0193", "Apache ", "Solr", "Links here", "2021-12-10", "2022-06-10", "The optional Apache Solr module DataImportHandler contains a code injection vulnerability.", "Apply updates per vendor instructions.", "

"], [302, "CVE-2021-44168", "Fortinet", "FortiOS", "Links here", "2021-12-10", "2021-12-24", "Fortinet FortiOS \"execute restore src-vis\" downloads code without integrity checking, allowing an attacker to arbitrarily download files.", "Apply updates per vendor instructions.", "

"], [303, "CVE-2017-17562", "Embedthis", "GoAhead", "Links here", "2021-12-10", "2022-06-10", "Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.", "Apply updates per vendor instructions.", "

"], [304, "CVE-2017-12149", "Red Hat", "Jboss Application Server", "Links here", "2021-12-10", "2022-06-10", "The Jboss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data.", "Apply updates per vendor instructions.", "

"], [305, "CVE-2010-1871", "Red Hat", "JBoss Seam 2", "Links here", "2021-12-10", "2022-06-10", "JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.", "Apply updates per vendor instructions.", ""], [306, "CVE-2020-17463", "Fuel CMS", "", "Links here", "2021-12-10", "2022-06-10", "FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.", "Apply updates per vendor instructions.", "

"], [307, "CVE-2020-8816", "Pi-hole", "AdminLTE", "Links here", "2021-12-10", "2022-06-10", "Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.", "Apply updates per vendor instructions.", "

"], [308, "CVE-2019-10758", "MongoDB", "mongo-express", "Links here", "2021-12-10", "2022-06-10", "mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.", "Apply updates per vendor instructions.", "

"], [309, "CVE-2021-44228", "Apache", "Log4j2", "Links here", "2021-12-10", "2021-12-24", "Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.", "Apply updates per vendor instructions.", "

"], [310, "CVE-2021-43890", "Microsoft", "Windows AppX Installer", "Links here", "2021-12-15", "2021-12-29", "Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.", "Apply updates per vendor instructions.", "

"], [311, "CVE-2021-4102", "Google", "Chromium V8 ", "Links here", "2021-12-15", "2021-12-29", "Google Chromium V8 Engine contains a use-after-free vulnerability which can allow a remote attacker to execute arbitrary code on the target system.", "Apply updates per vendor instructions.", "

"], [312, "CVE-2021-22017", "VMWare", "vCenter Server", "Links here", "2022-01-10", "2022-01-24", "Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.", "Apply updates per vendor instructions.", "

"], [313, "CVE-2021-36260", "Hikvision", "Security cameras web server", "Links here", "2022-01-10", "2022-01-24", "A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.", "Apply updates per vendor instructions.", "

"], [314, "CVE-2020-6572", "Google ", "Chrome", "Links here", "2022-01-10", "2022-07-10", "Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a Remote attacker to execute arbitrary code via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [315, "CVE-2019-1458", "Windows ", "Win32K", "Links here", "2022-01-10", "2022-07-10", "An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.", "Apply updates per vendor instructions.", "

"], [316, "CVE-2013-3900", "Windows ", "WinVerifyTrust function", "Links here", "2022-01-10", "2022-07-10", "A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.", "Apply updates per vendor instructions.", "

"], [317, "CVE-2019-2725", "Oracle ", "WebLogic Server ", "Links here", "2022-01-10", "2022-07-10", "Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).", "Apply updates per vendor instructions.", "

"], [318, "CVE-2019-9670", "Synacor", "Zimbra Collaboration Suite ", "Links here", "2022-01-10", "2022-07-10", "Improper Restriction of XML External Entity Reference vulnerability affecting Synacor Zimbra Collaboration Suite.", "Apply updates per vendor instructions.", "

"], [319, "CVE-2018-13382", "Fortinet", "FortiOS and FortiProxy", "Links here", "2022-01-10", "2022-07-10", "An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.", "Apply updates per vendor instructions.", "

"], [320, "CVE-2018-13383", "Fortinet", "FortiOS and FortiProxy", "Links here", "2022-01-10", "2022-07-10", "A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.", "Apply updates per vendor instructions.", "

"], [321, "CVE-2019-1579", "Palo Alto Networks", "PAN-OS", "Links here", "2022-01-10", "2022-07-10", "Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.", "Apply updates per vendor instructions.", "

"], [322, "CVE-2019-10149", "Exim", "Mail Transfer Agent (MTA) ", "Links here", "2022-01-10", "2022-07-10", "Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.", "Apply updates per vendor instructions.", "

"], [323, "CVE-2015-7450", "IBM", "WebSphere Application Server and Server Hypervisor Edition", "Links here", "2022-01-10", "2022-07-10", "Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands", "Apply updates per vendor instructions.", ""], [324, "CVE-2017-1000486", "Primetek", "Primefaces Application", "Links here", "2022-01-10", "2022-07-10", "Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution", "Apply updates per vendor instructions.", "

"], [325, "CVE-2019-7609", "Elastic", "Kibana", "Links here", "2022-01-10", "2022-07-10", "Kibana contain an arbitrary code execution flaw in the Timelion visualizer.", "Apply updates per vendor instructions.", "

"], [326, "CVE-2021-27860", "FatPipe", "WARP, IPVPN, and MPVPN software", "Links here", "2022-01-10", "2022-01-24", "A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem.", "Apply updates per vendor instructions.", "

"], [327, "CVE-2021-32648", "October CMS", "October CMS", "Links here", "2022-01-18", "2022-02-01", "In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.", "Apply updates per vendor instructions.", "

"], [328, "CVE-2021-25296", "Nagios", "Nagios XI", "Links here", "2022-01-18", "2022-02-01", "Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.", "Apply updates per vendor instructions.", "

"], [329, "CVE-2021-25297", "Nagios ", "Nagios XI", "Links here", "2022-01-18", "2022-02-01", "Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.", "Apply updates per vendor instructions.", "

"], [330, "CVE-2021-25298", "Nagios ", "Nagios XI", "Links here", "2022-01-18", "2022-02-01", "Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.", "Apply updates per vendor instructions.", "

"], [331, "CVE-2021-40870", "Aviatrix", "Aviatrix Controller ", "Links here", "2022-01-18", "2022-02-01", "Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.", "Apply updates per vendor instructions.", "

"], [332, "CVE-2021-33766", "Microsoft ", "Exchange Servers", "Links here", "2022-01-18", "2022-02-01", "Microsoft Exchange Servers contain an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.", "Apply updates per vendor instructions.", "

"], [333, "CVE-2021-21975", "VMware", "vRealize Operations Manager API", "Links here", "2022-01-18", "2022-02-01", "Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.", "Apply updates per vendor instructions.", "

"], [334, "CVE-2021-21315", "Npm package", "System Information Library for Node.JS", "Links here", "2022-01-18", "2022-02-01", "In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.", "Apply updates per vendor instructions.", "

"], [335, "CVE-2021-22991", "F5", "BIG-IP Traffic Management Microkernel", "Links here", "2022-01-18", "2022-02-01", "The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.", "Apply updates per vendor instructions.", "

"], [336, "CVE-2020-14864", "Oracle Corporation", "Intelligence Enterprise Edition", "Links here", "2022-01-18", "2022-07-18", "Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.", "Apply updates per vendor instructions.", "

"], [337, "CVE-2020-13671", "Drupal", "Drupal core", "Links here", "2022-01-18", "2022-07-18", "Improper sanitization in the extension file names is present in Drupal core.", "Apply updates per vendor instructions.", "

"], [338, "CVE-2020-11978", "Apache", "Airflow", "Links here", "2022-01-18", "2022-07-18", "A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.", "Apply updates per vendor instructions.", "

"], [339, "CVE-2020-13927", "Apache", "Airflow's Experimental API ", "Links here", "2022-01-18", "2022-07-18", "The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.", "Apply updates per vendor instructions.", "

"], [340, "CVE-2006-1547", "Apache", "Struts 1", "Links here", "2022-01-21", "2022-07-21", "ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability which allows for denial-of-service.", "Apply updates per vendor instructions.", ""], [341, "CVE-2012-0391", "Apache", "Struts 2", "Links here", "2022-01-21", "2022-07-21", "The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability which allows for remote code execution.", "Apply updates per vendor instructions.", ""], [342, "CVE-2018-8453", "Microsoft ", "Win32K", "Links here", "2022-01-21", "2022-07-21", "Microsoft Windows Win32k contains a vulnerability which allows an attacker to escalate privileges.", "Apply updates per vendor instructions.", "

"], [343, "CVE-2021-35247", "SolarWinds", "Serv-U", "Links here", "2022-01-21", "2022-02-04", "SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability which allows attackers to build and send queries without sanitization.", "Apply updates per vendor instructions.", "

"], [344, "CVE-2022-22587", "Apple", "IOMobileFrameBuffer", "Links here", "2022-01-28", "2022-02-11", "Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [345, "CVE-2021-20038", "SonicWall", "SMA 100 Appliances", "Links here", "2022-01-28", "2022-02-11", "SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution.", "Apply updates per vendor instructions.", "

"], [346, "CVE-2020-5722", "Grandstream", "UCM6200", "Links here", "2022-01-28", "2022-07-28", "Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.", "Apply updates per vendor instructions.", "

"], [347, "CVE-2020-0787", "Microsoft ", "Windows Background Intelligent Transfer Service (BITS)", "Links here", "2022-01-28", "2022-07-28", "Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.", "Apply updates per vendor instructions.", "

"], [348, "CVE-2017-5689", "Intel ", "Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability", "Links here", "2022-01-28", "2022-07-28", "Intel products contain a vulnerability which can allow attackers to perform privilege escalation.", "Apply updates per vendor instructions.", "

"], [349, "CVE-2014-1776", "Microsoft ", "Internet Explorer", "Links here", "2022-01-28", "2022-07-28", "Microsoft Internet Explorer 6 - 11 contains a use-after-free vulnerability which can allow for arbitrary code execution or denial of service.", "Apply updates per vendor instructions.", ""], [350, "CVE-2014-6271", "GNU", "Bourne-Again Shell (Bash)", "Links here", "2022-01-28", "2022-07-28", "GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.", "Apply updates per vendor instructions.", "

"], [351, "CVE-2014-7169", "GNU", "Bourne-Again Shell (Bash)", "Links here", "2022-01-28", "2022-07-28", "GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.", "Apply updates per vendor instructions.", "

"], [352, "CVE-2022-21882", "Microsoft", "Win32k", "Links here", "2022-02-04", "2022-02-18", "Microsoft Win32k contains an unspecified vulnerability which allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [353, "CVE-2021-36934", "Microsoft", "Windows SAM", "Links here", "2022-02-10", "2022-02-24", "If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.", "Apply updates per vendor instructions.", "

"], [354, "CVE-2020-0796", "Microsoft ", "SMBv3", "Links here", "2022-02-10", "2022-08-10", "A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.", "Apply updates per vendor instructions.", "

"], [355, "CVE-2018-1000861", "Jenkins ", "Jenkins Stapler Web Framework", "Links here", "2022-02-10", "2022-08-10", "A code execution vulnerability exists in the Stapler web framework used by Jenkins", "Apply updates per vendor instructions.", "

"], [356, "CVE-2017-9791", "Apache", "Struts 1", "Links here", "2022-02-10", "2022-08-10", "The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.", "Apply updates per vendor instructions.", "

"], [357, "CVE-2017-8464", "Microsoft ", "Windows Shell (.lnk)", "Links here", "2022-02-10", "2022-08-10", "Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file", "Apply updates per vendor instructions.", "

"], [358, "CVE-2017-10271", "Oracle", "WebLogic Server", "Links here", "2022-02-10", "2022-08-10", "Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [359, "CVE-2017-0263", "Microsoft", "Win32k", "Links here", "2022-02-10", "2022-08-10", "Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory. ", "Apply updates per vendor instructions.", "

"], [360, "CVE-2017-0262", "Microsoft", "Office", "Links here", "2022-02-10", "2022-08-10", "A remote code execution vulnerability exists in Microsoft Office.", "Apply updates per vendor instructions.", "

"], [361, "CVE-2017-0145", "Microsoft ", "SMBv1", "Links here", "2022-02-10", "2022-08-10", "The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.", "Apply updates per vendor instructions.", "

"], [362, "CVE-2017-0144", "Microsoft ", "SMBv1 ", "Links here", "2022-02-10", "2022-08-10", "The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.", "Apply updates per vendor instructions.", "

"], [363, "CVE-2016-3088", "Apache ", "ActiveMQ ", "Links here", "2022-02-10", "2022-08-10", "The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request", "Apply updates per vendor instructions.", "

"], [364, "CVE-2015-2051", "D-Link", "DIR-645 Router", "Links here", "2022-02-10", "2022-08-10", "D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.\n\n", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [365, "CVE-2015-1635", "Microsoft ", "HTTP.sys", "Links here", "2022-02-10", "2022-08-10", "Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability which allows for remote code execution.", "Apply updates per vendor instructions.", ""], [366, "CVE-2015-1130", "Apple", "OS X", "Links here", "2022-02-10", "2022-08-10", "The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.", "Apply updates per vendor instructions.", ""], [367, "CVE-2014-4404", "Apple", "OS X", "Links here", "2022-02-10", "2022-08-10", "Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context.", "Apply updates per vendor instructions.", ""], [368, "CVE-2022-22620", "Apple", "Webkit", "Links here", "2022-02-11", "2022-02-25", "Apple Webkit, which impacts iOS, iPadOS, and macOS, contains a vulnerability which allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [368, "CVE-2022-22620", "Apple", "Webkit", "Links here", "2022-02-11", "2022-02-25", "Apple Webkit, which impacts iOS, iPadOS, and macOS, contains a vulnerability which allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [369, "CVE-2022-24086", "Adobe", "Commerce and Magento Open Source", "Links here", "2022-02-15", "2022-03-01", "Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [370, "CVE-2022-0609", "Google ", "Chrome", "Links here", "2022-02-15", "2022-03-01", "The vulnerability exists due to a use-after-free error within the Animation component in Google Chrome.", "Apply updates per vendor instructions.", "

"], [371, "CVE-2019-0752", "Microsoft ", "Internet Explorer", "Links here", "2022-02-15", "2022-08-15", "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer", "Apply updates per vendor instructions.", "

"], [372, "CVE-2018-8174", "Microsoft ", "Windows VBScript Engine", "Links here", "2022-02-15", "2022-08-15", "A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka \"Windows VBScript Engine Remote Code Execution\"", "Apply updates per vendor instructions.", "

"], [373, "CVE-2018-20250", "RARLAB", "WinRAR", "Links here", "2022-02-15", "2022-08-15", "WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution", "Apply updates per vendor instructions.", "

"], [374, "CVE-2018-15982", "Adobe", "Flash Player", "Links here", "2022-02-15", "2022-08-15", "Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability", "Apply updates per vendor instructions.", "

"], [375, "CVE-2017-9841", "PHPUnit", "PHPUnit", "Links here", "2022-02-15", "2022-08-15", "PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \""], [375, "CVE-2017-9841", "PHPUnit", "PHPUnit", "Links here", "2022-02-15", "2022-08-15", "PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a \""], [376, "CVE-2014-1761", "Microsoft ", "Word", "Links here", "2022-02-15", "2022-08-15", "Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.", "Apply updates per vendor instructions.", ""], [377, "CVE-2013-3906", "Microsoft ", "Graphics Component", "Links here", "2022-02-15", "2022-08-15", "Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.", "Apply updates per vendor instructions.", ""], [378, "CVE-2022-23131", "Zabbix", "Frontend", "Links here", "2022-02-22", "2022-03-08", "Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.", "Apply updates per vendor instructions.", "

"], [378, "CVE-2022-23131", "Zabbix", "Frontend", "Links here", "2022-02-22", "2022-03-08", "Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML.", "Apply updates per vendor instructions.", "

"], [379, "CVE-2022-23134", "Zabbix", "Frontend", "Links here", "2022-02-22", "2022-03-08", "Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend.", "Apply updates per vendor instructions.", "

"], [380, "CVE-2022-24682", "Zimbra", "Webmail", "Links here", "2/25/2022", "3/11/2022", "Zimbra webmail clients running versions 8.8.15 P29 & P30 contain a XSS vulnerability that would allow attackers to steal session cookie files.", "Apply updates per vendor instructions.", "

"], [381, "CVE-2017-8570", "Microsoft", "Office", "Links here", "2/25/2022", "8/25/2022", "A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory.", "Apply updates per vendor instructions.", "

"], [382, "CVE-2017-0222", "Microsoft", "Internet Explorer", "Links here", "2/25/2022", "8/25/2022", "A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.", "Apply updates per vendor instructions.", "

"], [383, "CVE-2014-6352", "Microsoft", "Windows", "Links here", "2/25/2022", "8/25/2022", "Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object.", "Apply updates per vendor instructions.", ""], [384, "CVE-2022-20708", "Cisco", "Small Business RV160, RV260, RV340, and RV345 Series Routers", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).", "Apply updates per vendor instructions.", "

"], [384, "CVE-2022-20708", "Cisco", "Small Business RV160, RV260, RV340, and RV345 Series Routers", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).", "Apply updates per vendor instructions.", "

"], [385, "CVE-2022-20703", "Cisco", "Small Business RV160, RV260, RV340, and RV345 Series Routers", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).", "Apply updates per vendor instructions.", "

"], [386, "CVE-2022-20701", "Cisco", "Small Business RV160, RV260, RV340, and RV345 Series Routers", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).", "Apply updates per vendor instructions.", "

"], [387, "CVE-2022-20700", "Cisco", "Small Business RV160, RV260, RV340, and RV345 Series Routers", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).", "Apply updates per vendor instructions.", "

"], [388, "CVE-2022-20699", "Cisco", "Small Business RV160, RV260, RV340, and RV345 Series Routers", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS).", "Apply updates per vendor instructions.", "

"], [389, "CVE-2021-41379", "Microsoft", "Windows", "Links here", "3/3/2022", "3/17/2022", "Microsoft Windows Installer contains an unspecified vulnerability which allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [390, "CVE-2020-1938", "Apache", "Tomcat", "Links here", "3/3/2022", "3/17/2022", "Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.", "Apply updates per vendor instructions.", "

"], [391, "CVE-2020-11899", "Treck TCP/IP stack", "IPv6", "Links here", "3/3/2022", "3/17/2022", "The Treck TCP/IP stack contains an IPv6 out-of-bounds read vulnerability. ", "Apply updates per vendor instructions.", "

"], [392, "CVE-2019-16928", "Exim", "Exim Internet Mailer", "Links here", "3/3/2022", "3/17/2022", "Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [393, "CVE-2019-1652", "Cisco", "Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands.", "Apply updates per vendor instructions.", "

"], [394, "CVE-2019-1297", "Microsoft", "Excel", "Links here", "3/3/2022", "3/17/2022", "A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory.", "Apply updates per vendor instructions.", "

"], [395, "CVE-2018-8581", "Microsoft", "Exchange Server", "Links here", "3/3/2022", "3/17/2022", "An elevation of privilege vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.", "Apply updates per vendor instructions.", "

"], [396, "CVE-2018-8298", "ChakraCore", "ChakraCore scripting engine", "Links here", "3/3/2022", "3/17/2022", "The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [397, "CVE-2018-0180", "Cisco", "IOS Software", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.", "Apply updates per vendor instructions.", "

"], [398, "CVE-2018-0179", "Cisco", "IOS Software", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a reload of an affected system, resulting in a denial of service (DoS) condition.", "Apply updates per vendor instructions.", "

"], [399, "CVE-2018-0175", "Cisco", "IOS, XR, and XE Software", "Links here", "3/3/2022", "3/17/2022", "Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device.", "Apply updates per vendor instructions.", "

"], [400, "CVE-2018-0174", "Cisco", "IOS XE Software", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service.", "Apply updates per vendor instructions.", "

"], [401, "CVE-2018-0173", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service.", "Apply updates per vendor instructions.", "

"], [402, "CVE-2018-0172", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service.", "Apply updates per vendor instructions.", "

"], [403, "CVE-2018-0167", "Cisco", "IOS, XR, and XE Software", "Links here", "3/3/2022", "3/17/2022", "There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software which could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code. ", "Apply updates per vendor instructions.", "

"], [404, "CVE-2018-0161", "Cisco", "IOS Software", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition.", "Apply updates per vendor instructions.", "

"], [405, "CVE-2018-0159", "CIsco", "IOS Software and Cisco IOS XE Software", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.", "Apply updates per vendor instructions.", "

"], [406, "CVE-2018-0158", "Cisco", "IOS Software and Cisco IOS XE Software", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition.", "Apply updates per vendor instructions.", "

"], [407, "CVE-2018-0156", "Cisco", "IOS Software and Cisco IOS XE Software", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition.", "Apply updates per vendor instructions.", "

"], [408, "CVE-2018-0155", "Cisco", "Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service (DoS) condition.", "Apply updates per vendor instructions.", "

"], [409, "CVE-2018-0154", "Cisco", "IOS Software", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition.", "Apply updates per vendor instructions.", "

"], [410, "CVE-2018-0151", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/17/2022", "A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges.", "Apply updates per vendor instructions.", "

"], [411, "CVE-2017-8540", "Microsoft", "Malware Protection Engine", "Links here", "3/3/2022", "3/24/2022", "The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka \"Microsoft Malware Protection Engine Remote Code Execution Vulnerability\".", "Apply updates per vendor instructions.", "

"], [412, "CVE-2017-6744", "Cisco", "IOS software", "Links here", "3/3/2022", "3/24/2022", "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 1 contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. ", "Apply updates per vendor instructions.", "

"], [413, "CVE-2017-6743", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/24/2022", "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.", "Apply updates per vendor instructions.", "

"], [414, "CVE-2017-6740", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/24/2022", "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.", "Apply updates per vendor instructions.", "

"], [415, "CVE-2017-6739", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/24/2022", "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. ", "Apply updates per vendor instructions.", "

"], [416, "CVE-2017-6738", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/24/2022", "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.", "Apply updates per vendor instructions.", "

"], [417, "CVE-2017-6737", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/24/2022", "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.", "Apply updates per vendor instructions.", "

"], [418, "CVE-2017-6736", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/24/2022", "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code.", "Apply updates per vendor instructions.", "

"], [419, "CVE-2017-6663", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/24/2022", "A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause autonomic nodes of an affected system to reload, resulting in denial-of-service (DoS).", "Apply updates per vendor instructions.", "

"], [420, "CVE-2017-6627", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/24/2022", "A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, causing an interface queue wedge and denial of service.", "Apply updates per vendor instructions.", "

"], [421, "CVE-2017-12319", "Cisco", "IOS XE Software", "Links here", "3/3/2022", "3/24/2022", "A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability.", "Apply updates per vendor instructions.", "

"], [422, "CVE-2017-12240", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/24/2022", "The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code and gain full control of an affected system.", "Apply updates per vendor instructions.", "

"], [423, "CVE-2017-12238", "Cisco", "Catalyst 6800 Series Switches", "Links here", "3/3/2022", "3/24/2022", "A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a denial of service.", "Apply updates per vendor instructions.", "

"], [424, "CVE-2017-12237", "Cisco", "IOS and IOS XE Software", "Links here", "3/3/2022", "3/24/2022", "A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service.", "Apply updates per vendor instructions.", "

"], [425, "CVE-2017-12235", "Cisco", "IOS software", "Links here", "3/3/2022", "3/24/2022", "A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.", "Apply updates per vendor instructions.", "

"], [426, "CVE-2017-12234", "Cisco", "IOS software", "Links here", "3/3/2022", "3/24/2022", "There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.", "Apply updates per vendor instructions.", "

"], [427, "CVE-2017-12233", "Cisco", "IOS software", "Links here", "3/3/2022", "3/24/2022", "There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service.", "Apply updates per vendor instructions.", "

"], [428, "CVE-2017-12232", "Cisco", "IOS software", "Links here", "3/3/2022", "3/24/2022", "A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS could allow an unauthenticated, adjacent attacker to cause an affected device to reload, resulting in a denial of service.", "Apply updates per vendor instructions.", "

"], [429, "CVE-2017-12231", "Cisco", "IOS software", "Links here", "3/3/2022", "3/24/2022", "A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS could allow an unauthenticated, remote attacker to cause a denial of service.", "Apply updates per vendor instructions.", "

"], [430, "CVE-2017-11826", "Microsoft", "Office", "Links here", "3/3/2022", "3/24/2022", "A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.", "Apply updates per vendor instructions.", "

"], [431, "CVE-2017-11292", "Adobe", "Flash Player", "Links here", "3/3/2022", "3/24/2022", "Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [432, "CVE-2017-0261", "Microsoft", "Office", "Links here", "3/3/2022", "3/24/2022", "Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [433, "CVE-2017-0001", "Microsoft", "Graphics Device Interface (GDI)", "Links here", "3/3/2022", "3/24/2022", "The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges", "Apply updates per vendor instructions.", "

"], [434, "CVE-2016-8562", "Siemens", "SIMATIC CP", "Links here", "3/3/2022", "3/24/2022", "An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service.", "Apply updates per vendor instructions.", "

"], [435, "CVE-2016-7855", "Adobe", "Flash Player", "Links here", "3/3/2022", "3/24/2022", "Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code.", "Apply updates per vendor instructions.", "

"], [436, "CVE-2016-7262", "Microsoft", "Excel", "Links here", "3/3/2022", "3/24/2022", "A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.", "Apply updates per vendor instructions.", "

"], [437, "CVE-2016-7193", "Microsoft", "Office", "Links here", "3/3/2022", "3/24/2022", "Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [438, "CVE-2016-5195", "Linux", "Kernel", "Links here", "3/3/2022", "3/24/2022", "Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.", "Apply updates per vendor instructions.", "

"], [439, "CVE-2016-4117", "Adobe", "Flash Player", "Links here", "3/3/2022", "3/24/2022", "An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.", "Apply updates per vendor instructions.", "

"], [440, "CVE-2016-1019", "Adobe", "Flash Player", "Links here", "3/3/2022", "3/24/2022", "Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.", "Apply updates per vendor instructions.", "

"], [441, "CVE-2016-0099", "Microsoft", "Windows", "Links here", "3/3/2022", "3/24/2022", "An elevation of privilege vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.", "Apply updates per vendor instructions.", "

"], [442, "CVE-2015-7645", "Adobe", "Flash Player", "Links here", "3/3/2022", "3/24/2022", "Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.", "Apply updates per vendor instructions.", ""], [443, "CVE-2015-5119", "Adobe", "Flash Player", "Links here", "3/3/2022", "3/24/2022", "A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution.", "Apply updates per vendor instructions.", ""], [444, "CVE-2015-4902", "Oracle", "Java SE", "Links here", "3/3/2022", "3/24/2022", "Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via unknown vectors related to deployment.", "Apply updates per vendor instructions.", "

"], [445, "CVE-2015-3043", "Adobe", "Flash Player", "Links here", "3/3/2022", "3/24/2022", "A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.", "Apply updates per vendor instructions.", ""], [446, "CVE-2015-2590", "Oracle", "Java SE", "Links here", "3/3/2022", "3/24/2022", "An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.", "Apply updates per vendor instructions.", "

"], [447, "CVE-2015-2545", "Microsoft", "Office", "Links here", "3/3/2022", "3/24/2022", "Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image.", "Apply updates per vendor instructions.", ""], [448, "CVE-2015-2424", "Microsoft", "PowerPoint", "Links here", "3/3/2022", "3/24/2022", "Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document.", "Apply updates per vendor instructions.", ""], [449, "CVE-2015-2387", "Microsoft", "ATM Font Driver", "Links here", "3/3/2022", "3/24/2022", "ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.", "Apply updates per vendor instructions.", ""], [450, "CVE-2015-1701", "Microsoft", "Win32K", "Links here", "3/3/2022", "3/24/2022", "An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.", "Apply updates per vendor instructions.", ""], [451, "CVE-2015-1642", "Microsoft", "Office", "Links here", "3/3/2022", "3/24/2022", "Microsoft Office contains a memory corruption vulnerability which allows remote attackers to execute arbitrary code via a crafted document.", "Apply updates per vendor instructions.", ""], [452, "CVE-2014-4114", "Microsoft", "Windows Object Linking & Embedding (OLE)", "Links here", "3/3/2022", "3/24/2022", "A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.", "Apply updates per vendor instructions.", ""], [453, "CVE-2014-0496", "Adobe", "Reader and Acrobat", "Links here", "3/3/2022", "3/24/2022", "Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution.", "Apply updates per vendor instructions.", ""], [454, "CVE-2013-5065", "Microsoft", "Windows Kernel", "Links here", "3/3/2022", "3/24/2022", "Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.", "Apply updates per vendor instructions.", ""], [455, "CVE-2013-3897", "Microsoft", "Internet Explorer", "Links here", "3/3/2022", "3/24/2022", "A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.", "Apply updates per vendor instructions.", ""], [456, "CVE-2013-3346", "Adobe", "Reader and Acrobat", "Links here", "3/3/2022", "3/24/2022", "Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service. ", "Apply updates per vendor instructions.", ""], [457, "CVE-2013-1675", "Mozilla", "Firefox", "Links here", "3/3/2022", "3/24/2022", "Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.", "Apply updates per vendor instructions.", ""], [458, "CVE-2013-1347", "Microsoft", "Internet Explorer", "Links here", "3/3/2022", "3/24/2022", "This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.", "Apply updates per vendor instructions.", ""], [459, "CVE-2013-0641", "Adobe", "Reader", "Links here", "3/3/2022", "3/24/2022", "A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.", "Apply updates per vendor instructions.", ""], [460, "CVE-2013-0640", "Adobe", "Reader and Acrobat", "Links here", "3/3/2022", "3/24/2022", "An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.", "Apply updates per vendor instructions.", ""], [461, "CVE-2013-0632", "Adobe", "ColdFusion", "Links here", "3/3/2022", "3/24/2022", "An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.", "Apply updates per vendor instructions.", ""], [462, "CVE-2012-4681", "Oracle", "Java SE", "Links here", "3/3/2022", "3/24/2022", "The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [463, "CVE-2012-1856", "Microsoft", "Office", "Links here", "3/3/2022", "3/24/2022", "The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.", "Apply updates per vendor instructions.", ""], [464, "CVE-2012-1723", "Oracle", "Java SE", "Links here", "3/3/2022", "3/24/2022", "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.", "Apply updates per vendor instructions.", "

"], [465, "CVE-2012-1535", "Adobe", "Flash Player", "Links here", "3/3/2022", "3/24/2022", "Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.", "Apply updates per vendor instructions.", ""], [466, "CVE-2012-0507", "Oracle", "Java SE", "Links here", "3/3/2022", "3/24/2022", "An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.", "Apply updates per vendor instructions.", "

"], [467, "CVE-2011-3544", "Oracle", "Java SE JDK and JRE", "Links here", "3/3/2022", "3/24/2022", "An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.", "Apply updates per vendor instructions.", ""], [468, "CVE-2011-1889", "Microsoft", "Forefront Threat Management Gateway (TMG)", "Links here", "3/3/2022", "3/24/2022", "A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.", "Apply updates per vendor instructions.", ""], [469, "CVE-2011-0611", "Adobe", "Flash Player", "Links here", "3/3/2022", "3/24/2022", "Adobe Flash Player contains a vulnerability which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.", "Apply updates per vendor instructions.", "

"], [470, "CVE-2010-3333", "Microsoft", "Office", "Links here", "3/3/2022", "3/24/2022", "A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.", "Apply updates per vendor instructions.", ""], [471, "CVE-2010-0232", "Microsoft", "Windows Kernel", "Links here", "3/3/2022", "3/24/2022", "The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges.", "Apply updates per vendor instructions.", ""], [472, "CVE-2010-0188", "Adobe", "Reader and Acrobat", "Links here", "3/3/2022", "3/24/2022", "Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.", "Apply updates per vendor instructions.", ""], [473, "CVE-2009-3129", "Microsoft", "Excel", "Links here", "3/3/2022", "3/24/2022", "Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.", "Apply updates per vendor instructions.", ""], [474, "CVE-2009-1123", "Microsoft", "Windows", "Links here", "3/3/2022", "3/24/2022", "The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.", "Apply updates per vendor instructions.", ""], [475, "CVE-2008-3431", "Oracle", "VirtualBox", "Links here", "3/3/2022", "3/24/2022", "An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.", "Apply updates per vendor instructions.", ""], [476, "CVE-2008-2992", "Adobe", "Acrobat and Reader", "Links here", "3/3/2022", "3/24/2022", "Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.", "Apply updates per vendor instructions.", ""], [477, "CVE-2004-0210", "Microsoft", "Windows", "Links here", "3/3/2022", "3/24/2022", "A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system.", "Apply updates per vendor instructions.", ""], [478, "CVE-2002-0367", "Microsoft", "Windows", "Links here", "3/3/2022", "3/24/2022", "smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.", "Apply updates per vendor instructions.", ""], [479, "CVE-2022-26486", "Mozilla", "Firefox", "Links here", "3/7/2022", "3/21/2022", "Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [479, "CVE-2022-26486", "Mozilla", "Firefox", "Links here", "3/7/2022", "3/21/2022", "Mozilla Firefox contains a use-after-free vulnerability in WebGPU IPC Framework which can be exploited to perform arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [480, "CVE-2022-26485", "Mozilla", "Firefox", "Links here", "3/7/2022", "3/21/2022", "Mozilla Firefox contains a use-after-free vulnerability in XSLT parameter processing which can be exploited to perform arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [481, "CVE-2021-21973", "VMware", "vCenter Server and Cloud Foundation", "Links here", "3/7/2022", "3/21/2022", "VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.", "Apply updates per vendor instructions.", "

"], [482, "CVE-2020-8218", "Pulse Secure", "Pulse Connect Secure", "Links here", "3/7/2022", "9/7/2022", "A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.", "Apply updates per vendor instructions.", "

"], [483, "CVE-2019-11581", "Atlassian", "Jira Server and Data Center", "Links here", "3/7/2022", "9/7/2022", "Atlassian Jira Server and Data Center contain a server-side template injection vulnerability which can allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [484, "CVE-2017-6077", "NETGEAR", "Wireless Router DGN2200", "Links here", "3/7/2022", "9/7/2022", "NETGEAR DGN2200 wireless routers contain a vulnerability which allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [485, "CVE-2016-6277", "NETGEAR", "Multiple Routers", "Links here", "3/7/2022", "9/7/2022", "NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution.", "Apply updates per vendor instructions.", "

"], [486, "CVE-2013-0631", "Adobe", "ColdFusion", "Links here", "3/7/2022", "9/7/2022", "Adobe Coldfusion contains an unspecified vulnerability, which could result in information disclosure from a compromised server.", "Apply updates per vendor instructions.", ""], [487, "CVE-2013-0629", "Adobe", "ColdFusion", "Links here", "3/7/2022", "9/7/2022", "Adobe Coldfusion contains a directory traversal vulnerability, which could permit an unauthorized user access to restricted directories.", "Apply updates per vendor instructions.", ""], [488, "CVE-2013-0625", "Adobe", "ColdFusion", "Links here", "3/7/2022", "9/7/2022", "Adobe Coldfusion contains an authentication bypass vulnerability, which could result in an unauthorized user gaining administrative access.", "Apply updates per vendor instructions.", ""], [489, "CVE-2009-3960", "Adobe ", "BlazeDS", "Links here", "3/7/2022", "9/7/2022", "Adobe BlazeDS, which is utilized in LifeCycle and Coldfusion, contains a vulnerability which allows for information disclosure.", "Apply updates per vendor instructions.", ""], [490, "CVE-2020-5135", "SonicWall", "SonicOS", "Links here", "2022-03-15", "2022-04-05", "A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.", "Apply updates per vendor instructions.", "

"], [490, "CVE-2020-5135", "SonicWall", "SonicOS", "Links here", "2022-03-15", "2022-04-05", "A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall.", "Apply updates per vendor instructions.", "

"], [491, "CVE-2019-1405", "Microsoft", "Windows Universal Plug and Play (UPnP)", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists when the Windows UPnP service improperly allows COM object creation.", "Apply updates per vendor instructions.", "

"], [492, "CVE-2019-1322", "Microsoft", "Windows", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.", "Apply updates per vendor instructions.", "

"], [493, "CVE-2019-1315", "Microsoft", "Windows Error Reporting Manager", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.", "Apply updates per vendor instructions.", "

"], [494, "CVE-2019-1253", "Microsoft", "Windows AppX Deployment Server", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.", "Apply updates per vendor instructions.", "

"], [495, "CVE-2019-1132", "Microsoft", "Windows Win32k", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.", "Apply updates per vendor instructions.", "

"], [496, "CVE-2019-1129", "Microsoft", "Windows AppX Deployment Service (AppXSVC)", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.", "Apply updates per vendor instructions.", "

"], [497, "CVE-2019-1069", "Microsoft", "Task Scheduler", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations.", "Apply updates per vendor instructions.", "

"], [498, "CVE-2019-1064", "Microsoft", "Windows AppX Deployment Service (AppXSVC)", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.", "Apply updates per vendor instructions.", "

"], [499, "CVE-2019-0841", "Microsoft", "Windows AppX Deployment Service (AppXSVC)", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.", "Apply updates per vendor instructions.", "

"], [500, "CVE-2019-0543", "Microsoft", "Windows", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.", "Apply updates per vendor instructions.", "

"], [501, "CVE-2018-8120", "Microsoft", "Windows Win32k", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.", "Apply updates per vendor instructions.", "

"], [502, "CVE-2017-0101", "Microsoft", "Windows Transaction Manager", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.", "Apply updates per vendor instructions.", "

"], [503, "CVE-2016-3309", "Microsoft", "Windows Kernel", "Links here", "2022-03-15", "2022-04-05", "An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.", "Apply updates per vendor instructions.", "

"], [504, "CVE-2015-2546", "Microsoft", "Windows Win32k", "Links here", "2022-03-15", "2022-04-05", "The kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.", "Apply updates per vendor instructions.", ""], [505, "CVE-2022-26318", "WatchGuard", "Firebox and XTM Appliances", "Links here", "2022-03-25", "2022-04-15", "On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.", "Apply updates per vendor instructions.", "

"], [505, "CVE-2022-26318", "WatchGuard", "Firebox and XTM Appliances", "Links here", "2022-03-25", "2022-04-15", "On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code.", "Apply updates per vendor instructions.", "

"], [506, "CVE-2022-26143", "Mitel", "MiCollab, MiVoice Business Express", "Links here", "2022-03-25", "2022-04-15", "A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.", "Apply updates per vendor instructions.", "

"], [507, "CVE-2022-21999", "Microsoft ", "Windows", "Links here", "2022-03-25", "2022-04-15", "Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.", "Apply updates per vendor instructions.", "

"], [508, "CVE-2021-42237", "Sitecore", "XP", "Links here", "2022-03-25", "2022-04-15", "Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [509, "CVE-2021-22941", "Citrix", "ShareFile", "Links here", "2022-03-25", "2022-04-15", "Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.", "Apply updates per vendor instructions.", "

"], [510, "CVE-2020-9377", "D-Link ", "DIR-610 Devices", "Links here", "2022-03-25", "2022-04-15", "D-Link DIR-610 devices allow remote code execution via the cmd parameter to command.php.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [511, "CVE-2020-9054", "Zyxel ", "Multiple Network-Attached Storage (NAS) Devices", "Links here", "2022-03-25", "2022-04-15", "Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code.", "Apply updates per vendor instructions.", "

"], [512, "CVE-2020-7247", "OpenBSD", "OpenSMTPD", "Links here", "2022-03-25", "2022-04-15", "smtp_mailaddr in smtp_session.c in OpenSMTPD, as used in OpenBSD and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session.", "Apply updates per vendor instructions.", "

"], [513, "CVE-2020-5410", "VMware Tanzu", "Spring Cloud Configuration (Config) Server", "Links here", "2022-03-25", "2022-04-15", "Spring, by VMware Tanzu, Cloud Config contains a path traversal vulnerability which allows applications to serve arbitrary configuration files.", "Apply updates per vendor instructions.", "

"], [514, "CVE-2020-25223", "Sophos", "SG UTM", "Links here", "2022-03-25", "2022-04-15", "A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM.", "Apply updates per vendor instructions.", "

"], [515, "CVE-2020-2506", "QNAP Systems", "Helpdesk", "Links here", "2022-03-25", "2022-04-15", "QNAP Helpdesk contains an improper access control vulnerability which could allow an attacker to gain privileges or to read sensitive information.", "Apply updates per vendor instructions.", "

"], [516, "CVE-2020-2021", "Palo Alto", "PAN-OS", "Links here", "2022-03-25", "2022-04-15", "Palo Alto PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.", "Apply updates per vendor instructions.", "

"], [517, "CVE-2020-1956", "Apache ", "Kylin", "Links here", "2022-03-25", "2022-04-15", "Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.", "Apply updates per vendor instructions.", "

"], [518, "CVE-2020-1631", "Juniper ", "Junos OS", "Links here", "2022-03-25", "2022-04-15", "A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.", "Apply updates per vendor instructions.", "

"], [519, "CVE-2019-6340", "Drupal ", "Core", "Links here", "2022-03-25", "2022-04-15", "In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.", "Apply updates per vendor instructions.", "

"], [520, "CVE-2019-2616", "Oracle", "BI Publisher (Formerly XML Publisher)", "Links here", "2022-03-25", "2022-04-15", "Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability which allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.", "Apply updates per vendor instructions.", "

"], [521, "CVE-2019-16920", "D-Link", "Multiple Routers", "Links here", "2022-03-25", "2022-04-15", "Multiple D-Link routers contain a command injection vulnerability which can allow attackers to achieve full system compromise.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [522, "CVE-2019-15107", "Webmin", "Webmin", "Links here", "2022-03-25", "2022-04-15", "An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.", "Apply updates per vendor instructions.", "

"], [523, "CVE-2019-12991", "Citrix", "SD-WAN and NetScaler", "Links here", "2022-03-25", "2022-04-15", "Authenticated Command Injection in Citrix SD-WAN Appliance and NetScaler SD-WAN Appliance.", "Apply updates per vendor instructions.", "

"], [524, "CVE-2019-12989", "Citrix", "SD-WAN and NetScaler", "Links here", "2022-03-25", "2022-04-15", "Citrix SD-WAN and NetScaler SD-WAN allow SQL Injection.", "Apply updates per vendor instructions.", "

"], [525, "CVE-2019-11043", "PHP", "FastCGI Process Manager (FPM)", "Links here", "2022-03-25", "2022-04-15", "In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.", "Apply updates per vendor instructions.", "

"], [526, "CVE-2019-10068", "Kentico", "Xperience", "Links here", "2022-03-25", "2022-04-15", "Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution.", "Apply updates per vendor instructions.", "

"], [527, "CVE-2019-1003030", "Jenkins ", "Matrix Project Plugin", "Links here", "2022-03-25", "2022-04-15", "Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.", "Apply updates per vendor instructions.", "

"], [528, "CVE-2019-0903", "Microsoft ", "Graphics Device Interface (GDI)", "Links here", "2022-03-25", "2022-04-15", "A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system.", "Apply updates per vendor instructions.", "

"], [529, "CVE-2018-8414", "Microsoft ", "Windows", "Links here", "2022-03-25", "2022-04-15", "A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.", "Apply updates per vendor instructions.", "

"], [530, "CVE-2018-8373", "Microsoft ", "Internet Explorer Scripting Engine", "Links here", "2022-03-25", "2022-04-15", "A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer.", "Apply updates per vendor instructions.", "

"], [531, "CVE-2018-6961", "VMware", "SD-WAN Edge", "Links here", "2022-03-25", "2022-04-15", "VMware SD-WAN Edge by VeloCloud contains a command injection vulnerability in the local web UI component. Successful exploitation of this issue could result in remote code execution.", "Apply updates per vendor instructions.", "

"], [532, "CVE-2018-14839", "LG ", "N1A1 NAS", "Links here", "2022-03-25", "2022-04-15", "LG N1A1 NAS 3718.510 is affected by a remote code execution vulnerability.", "Apply updates per vendor instructions.", "

"], [533, "CVE-2018-1273", "VMware Tanzu", "Spring Data Commons", "Links here", "2022-03-25", "2022-04-15", "Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.", "Apply updates per vendor instructions.", "

"], [534, "CVE-2018-11138", "Quest", "KACE System Management Appliance", "Links here", "2022-03-25", "2022-04-15", "The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.", "Apply updates per vendor instructions.", "

"], [535, "CVE-2018-0147", "Cisco ", "Secure Access Control System (ACS)", "Links here", "2022-03-25", "2022-04-15", "A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software.", "Apply updates per vendor instructions.", "

"], [536, "CVE-2018-0125", "Cisco ", "VPN Routers", "Links here", "2022-03-25", "2022-04-15", "A vulnerability in the web interface of the Cisco VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary code as root and gain full control of an affected system.", "Apply updates per vendor instructions.", "

"], [537, "CVE-2017-6334", "NETGEAR", "DGN2200 Devices", "Links here", "2022-03-25", "2022-04-15", "dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [538, "CVE-2017-6316", "Citrix", "NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server", "Links here", "2022-03-25", "2022-04-15", "A vulnerability has been identified in the management interface of Citrix NetScaler SD-WAN Enterprise and Standard Edition and Citrix CloudBridge Virtual WAN Edition that could result in an unauthenticated, remote attacker being able to execute arbitrary code as a root user. This vulnerability also affects XenMobile Server.", "Apply updates per vendor instructions.", "

"], [539, "CVE-2017-3881", "Cisco ", "IOS and IOS XE", "Links here", "2022-03-25", "2022-04-15", "A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges.", "Apply updates per vendor instructions.", "

"], [540, "CVE-2017-12617", "Apache ", "Tomcat", "Links here", "2022-03-25", "2022-04-15", "When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.", "Apply updates per vendor instructions.", "

"], [541, "CVE-2017-12615", "Apache ", "Tomcat", "Links here", "2022-03-25", "2022-04-15", "When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.", "Apply updates per vendor instructions.", "

"], [542, "CVE-2017-0146", "Microsoft ", "Windows", "Links here", "2022-03-25", "2022-04-15", "The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution.", "Apply updates per vendor instructions.", "

"], [543, "CVE-2016-7892", "Adobe ", "Flash Player", "Links here", "2022-03-25", "2022-04-15", "Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [544, "CVE-2016-4171", "Adobe ", "Flash Player", "Links here", "2022-03-25", "2022-04-15", "Unspecified vulnerability in Adobe Flash Player allows for remote code execution.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [545, "CVE-2016-1555", "NETGEAR", "Wireless Access Point (WAP) Devices", "Links here", "2022-03-25", "2022-04-15", "Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [546, "CVE-2016-11021", "D-Link ", "DCS-930L Devices", "Links here", "2022-03-25", "2022-04-15", "setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [547, "CVE-2016-10174", "NETGEAR", "WNR2000v5 Router", "Links here", "2022-03-25", "2022-04-15", "The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution.", "Apply updates per vendor instructions.", "

"], [548, "CVE-2016-0752", "Rails", "Ruby on Rails", "Links here", "2022-03-25", "2022-04-15", "Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.", "Apply updates per vendor instructions.", "

"], [549, "CVE-2015-4068", "Arcserve", "Unified Data Protection (UDP)", "Links here", "2022-03-25", "2022-04-15", "Directory traversal vulnerability in Arcserve UDP allows remote attackers to obtain sensitive information or cause a denial of service.", "Apply updates per vendor instructions.", ""], [550, "CVE-2015-3035", "TP-Link ", "Multiple Archer Devices", "Links here", "2022-03-25", "2022-04-15", "Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.", "Apply updates per vendor instructions.", ""], [551, "CVE-2015-1427", "Elastic", "Elasticsearch", "Links here", "2022-03-25", "2022-04-15", "The Groovy scripting engine in Elasticsearch allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands.", "Apply updates per vendor instructions.", ""], [552, "CVE-2015-1187", "D-Link and TRENDnet", "Multiple Devices", "Links here", "2022-03-25", "2022-04-15", "The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to perform remote code execution.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [553, "CVE-2015-0666", "Cisco", "Prime Data Center Network Manager (DCNM)", "Links here", "2022-03-25", "2022-04-15", "Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) allows remote attackers to read arbitrary files.", "Apply updates per vendor instructions.", "

"], [554, "CVE-2014-6332", "Microsoft ", "Windows Object Linking and Embedding (OLE)", "Links here", "2022-03-25", "2022-04-15", "OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.", "Apply updates per vendor instructions.", ""], [555, "CVE-2014-6324", "Microsoft ", "Kerberos Key Distribution Center (KDC)", "Links here", "2022-03-25", "2022-04-15", "The Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges.", "Apply updates per vendor instructions.", ""], [556, "CVE-2014-6287", "Rejetto", "HTTP File Server (HFS)", "Links here", "2022-03-25", "2022-04-15", "The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.", "Apply updates per vendor instructions.", "

"], [556, "CVE-2014-6287", "Rejetto", "HTTP File Server (HFS)", "Links here", "2022-03-25", "2022-04-15", "The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.", "Apply updates per vendor instructions.", "

"], [557, "CVE-2014-3120", "Elastic", "Elasticsearch", "Links here", "2022-03-25", "2022-04-15", "Elasticsearch enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code.", "Apply updates per vendor instructions.", ""], [558, "CVE-2014-0130", "Rails", "Ruby on Rails", "Links here", "2022-03-25", "2022-04-15", "Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.", "Apply updates per vendor instructions.", "

"], [559, "CVE-2013-5223", "D-Link ", "DSL-2760U", "Links here", "2022-03-25", "2022-04-15", "A cross-site scripting (XSS) vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML.", "Apply updates per vendor instructions.", ""], [560, "CVE-2013-4810", "Hewlett Packard (HP)", "ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management", "Links here", "2022-03-25", "2022-04-15", "HP ProCurve Manager (PCM), PCM+, Identity Driven Manager (IDM), and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet.", "Apply updates per vendor instructions.", ""], [561, "CVE-2013-2251", "Apache ", "Struts", "Links here", "2022-03-25", "2022-04-15", "Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.", "Apply updates per vendor instructions.", "

"], [562, "CVE-2012-1823", "PHP", "PHP", "Links here", "2022-03-25", "2022-04-15", "sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.", "Apply updates per vendor instructions.", ""], [563, "CVE-2010-4345", "Exim", "Exim", "Links here", "2022-03-25", "2022-04-15", "Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.", "Apply updates per vendor instructions.", "

"], [564, "CVE-2010-4344", "Exim", "Exim", "Links here", "2022-03-25", "2022-04-15", "Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.", "Apply updates per vendor instructions.", "

"], [565, "CVE-2010-3035", "Cisco ", "IOS XR", "Links here", "2022-03-25", "2022-04-15", "Cisco IOS XR, when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service.", "Apply updates per vendor instructions.", ""], [566, "CVE-2010-2861", "Adobe", "ColdFusion", "Links here", "2022-03-25", "2022-04-15", "A directory traversal vulnerability exists in the administrator console in Adobe ColdFusion which allows remote attackers to read arbitrary files.", "Apply updates per vendor instructions.", ""], [567, "CVE-2009-2055", "Cisco ", "IOS XR", "Links here", "2022-03-25", "2022-04-15", "Cisco IOS XR,when BGP is the configured routing feature, allows remote attackers to cause a denial-of-service.", "Apply updates per vendor instructions.", ""], [568, "CVE-2009-1151", "phpMyAdmin", "phpMyAdmin", "Links here", "2022-03-25", "2022-04-15", "Setup script used to generate configuration can be fooled using a crafted POST request to include arbitrary PHP code in generated configuration file.", "Apply updates per vendor instructions.", ""], [569, "CVE-2009-0927", "Adobe", "Reader and Acrobat", "Links here", "2022-03-25", "2022-04-15", "Stack-based buffer overflow in Adobe Reader and Adobe Acrobat allows remote attackers to execute arbitrary code.", "Apply updates per vendor instructions.", ""], [570, "CVE-2005-2773", "Hewlett Packard (HP)", "OpenView Network Node Manager", "Links here", "2022-03-25", "2022-04-15", "HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system.", "Apply updates per vendor instructions.", ""], [571, "CVE-2022-1096", "Google", "Chromium V8", "Links here", "2022-03-28", "2022-04-18", "The vulnerability exists due to a type confusion error within the V8 component in Chromium, affecting all Chromium-based browsers.", "Apply updates per vendor instructions.", "

"], [571, "CVE-2022-1096", "Google", "Chromium V8", "Links here", "2022-03-28", "2022-04-18", "The vulnerability exists due to a type confusion error within the V8 component in Chromium, affecting all Chromium-based browsers.", "Apply updates per vendor instructions.", "

"], [572, "CVE-2022-0543", "Redis", "Debian-specific Redis Servers", "Links here", "2022-03-28", "2022-04-18", "Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.", "Apply updates per vendor instructions.", "

"], [573, "CVE-2021-38646", "Microsoft", "Office", "Links here", "2022-03-28", "2022-04-18", "Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [574, "CVE-2021-34486", "Microsoft", "Windows", "Links here", "2022-03-28", "2022-04-18", "Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.", "Apply updates per vendor instructions.", "

"], [575, "CVE-2021-26085", "Atlassian", "Confluence Server", "Links here", "2022-03-28", "2022-04-18", "Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.", "Apply updates per vendor instructions.", "

"], [576, "CVE-2021-20028", "SonicWall", "Secure Remote Access (SRA)", "Links here", "2022-03-28", "2022-04-18", "SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [577, "CVE-2019-7483", "SonicWall", "SMA100", "Links here", "2022-03-28", "2022-04-18", "In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.", "Apply updates per vendor instructions.", "

"], [578, "CVE-2018-8440", "Microsoft", "Windows", "Links here", "2022-03-28", "2022-04-18", "An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).", "Apply updates per vendor instructions.", "

"], [579, "CVE-2018-8406", "Microsoft", "DirectX Graphics Kernel (DXGKRNL)", "Links here", "2022-03-28", "2022-04-18", "An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.", "Apply updates per vendor instructions.", "

"], [580, "CVE-2018-8405", "Microsoft", "DirectX Graphics Kernel (DXGKRNL)", "Links here", "2022-03-28", "2022-04-18", "An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.", "Apply updates per vendor instructions.", "

"], [581, "CVE-2017-0213", "Microsoft", "Windows", "Links here", "2022-03-28", "2022-04-18", "Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.", "Apply updates per vendor instructions.", "

"], [582, "CVE-2017-0059", "Microsoft", "Internet Explorer", "Links here", "2022-03-28", "2022-04-18", "Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.", "Apply updates per vendor instructions.", "

"], [583, "CVE-2017-0037", "Microsoft", "Edge and Internet Explorer", "Links here", "2022-03-28", "2022-04-18", "Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.", "Apply updates per vendor instructions.", "

"], [584, "CVE-2016-7201", "Microsoft", "Edge", "Links here", "2022-03-28", "2022-04-18", "The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.", "Apply updates per vendor instructions.", "

"], [585, "CVE-2016-7200", "Microsoft", "Edge", "Links here", "2022-03-28", "2022-04-18", "The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.", "Apply updates per vendor instructions.", "

"], [586, "CVE-2016-0189", "Microsoft", "Internet Explorer", "Links here", "2022-03-28", "2022-04-18", "The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.", "Apply updates per vendor instructions.", "

"], [587, "CVE-2016-0151", "Microsoft", "Client-Server Run-time Subsystem (CSRSS)", "Links here", "2022-03-28", "2022-04-18", "The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.", "Apply updates per vendor instructions.", "

"], [588, "CVE-2016-0040", "Microsoft", "Windows", "Links here", "2022-03-28", "2022-04-18", "The kernel in Microsoft Windows allows local users to gain privileges via a crafted application.", "Apply updates per vendor instructions.", "

"], [589, "CVE-2015-2426", "Microsoft", "Windows", "Links here", "2022-03-28", "2022-04-18", "A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.", "Apply updates per vendor instructions.", ""], [590, "CVE-2015-2419", "Microsoft", "Internet Explorer", "Links here", "2022-03-28", "2022-04-18", "JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.", "Apply updates per vendor instructions.", ""], [591, "CVE-2015-1770", "Microsoft", "Office", "Links here", "2022-03-28", "2022-04-18", "Microsoft Office allows remote attackers to execute arbitrary code via a crafted Office document.", "Apply updates per vendor instructions.", ""], [592, "CVE-2013-3660", "Microsoft", "Win32k", "Links here", "2022-03-28", "2022-04-18", "The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.", "Apply updates per vendor instructions.", ""], [593, "CVE-2013-2729", "Adobe", "Reader and Acrobat", "Links here", "2022-03-28", "2022-04-18", "Integer overflow vulnerability in Adobe Reader and Acrobat allows attackers to execute remote code.", "Apply updates per vendor instructions.", ""], [594, "CVE-2013-2551", "Microsoft", "Internet Explorer", "Links here", "2022-03-28", "2022-04-18", "Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.", "Apply updates per vendor instructions.", ""], [595, "CVE-2013-2465", "Oracle", "Java SE", "Links here", "2022-03-28", "2022-04-18", "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D", "Apply updates per vendor instructions.", "

"], [596, "CVE-2013-1690", "Mozilla", "Firefox and Thunderbird", "Links here", "2022-03-28", "2022-04-18", "Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service or possibly execute arbitrary code via a crafted web site.", "Apply updates per vendor instructions.", ""], [597, "CVE-2012-5076", "Oracle", "Java SE", "Links here", "2022-03-28", "2022-04-18", "The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.", "Apply updates per vendor instructions.", "

"], [598, "CVE-2012-2539", "Microsoft", "Word", "Links here", "2022-03-28", "2022-04-18", "Microsoft Word allows attackers to execute remote code or cause a denial-of-service via crafted RTF data.", "Apply updates per vendor instructions.", ""], [599, "CVE-2012-2034", "Adobe", "Flash Player", "Links here", "2022-03-28", "2022-04-18", "Adobe Flash Player contains a memory corruption vulnerability which allows for remote code execution or denial-of-service.", "Apply updates per vendor instructions.", "

"], [600, "CVE-2012-0518", "Oracle", "Fusion Middleware", "Links here", "2022-03-28", "2022-04-18", "Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via unknown vectors", "Apply updates per vendor instructions.", ""], [601, "CVE-2011-2005", "Microsoft", "Ancillary Function Driver (afd.sys)", "Links here", "2022-03-28", "2022-04-18", "afd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.", "Apply updates per vendor instructions.", ""], [602, "CVE-2010-4398", "Microsoft", "Windows", "Links here", "2022-03-28", "2022-04-18", "Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.", "Apply updates per vendor instructions.", ""], [603, "CVE-2022-26871", "Trend Micro", "Apex Central ", "Links here", "2022-03-31", "2022-04-21", "An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [603, "CVE-2022-26871", "Trend Micro", "Apex Central ", "Links here", "2022-03-31", "2022-04-21", "An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [604, "CVE-2022-1040", "Sophos", "Firewall ", "Links here", "2022-03-31", "2022-04-21", "An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [605, "CVE-2021-34484", "Microsoft ", "Windows ", "Links here", "2022-03-31", "2022-04-21", "Microsoft Windows User Profile Service contains an unspecified vulnerability which allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [606, "CVE-2021-28799", "QNAP", "Network Attached Storage (NAS)", "Links here", "2022-03-31", "2022-04-21", "QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device.", "Apply updates per vendor instructions.", "

"], [607, "CVE-2021-21551", "Dell", "dbutil Driver", "Links here", "2022-03-31", "2022-04-21", "Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service, or information disclosure.", "Apply updates per vendor instructions.", "

"], [608, "CVE-2018-10562", "Dasan", "Gigabit Passive Optical Network (GPON) Routers", "Links here", "2022-03-31", "2022-04-21", "Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [609, "CVE-2018-10561", "Dasan", "Gigabit Passive Optical Network (GPON) Routers", "Links here", "2022-03-31", "2022-04-21", "Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [610, "CVE-2022-22965", "Vmware", "Spring Framework", "Links here", "2022-04-04", "2022-04-25", "Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.", "Apply updates per vendor instructions.", "

"], [611, "CVE-2022-22675", "Apple", "macOS", "Links here", "2022-04-04", "2022-04-25", "macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [612, "CVE-2022-22674", "Apple", "macOS", "Links here", "2022-04-04", "2022-04-25", "macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory.", "Apply updates per vendor instructions.", "

"], [613, "CVE-2021-45382", "D-Link", "Multiple Routers ", "Links here", "2022-04-04", "2022-04-25", "A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [614, "CVE-2021-3156", "Sudo", "Sudo", "Links here", "2022-04-06", "2022-04-27", "Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [615, "CVE-2021-31166", "Microsoft", "HTTP Protocol Stack", "Links here", "2022-04-06", "2022-04-27", "Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [616, "CVE-2017-0148", "Microsoft", "SMBv1 server", "Links here", "2022-04-06", "2022-04-27", "The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.", "Apply updates per vendor instructions.", "

"], [617, "CVE-2022-23176", "WatchGuard", "Firebox and XTM", "Links here", "2022-04-11", "2022-05-02", "WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access.", "Apply updates per vendor instructions.", "

"], [618, "CVE-2021-42287", "Microsoft", "Active Directory", "Links here", "2022-04-11", "2022-05-02", "Microsoft Active Directory Domain Services contains an unspecified vulnerability which allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [619, "CVE-2021-42278", "Microsoft", "Active Directory", "Links here", "2022-04-11", "2022-05-02", "Microsoft Active Directory Domain Services contains an unspecified vulnerability which allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [620, "CVE-2021-39793", "Google", "Pixel", "Links here", "2022-04-11", "2022-05-02", "Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege.", "Apply updates per vendor instructions.", "

"], [621, "CVE-2021-27852", "Checkbox", "Checkbox Survey", "Links here", "2022-04-11", "2022-05-02", "Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code.", "Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable.", "

"], [622, "CVE-2021-22600", "Linux", "Kernel", "Links here", "2022-04-11", "2022-05-02", "Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service or possibly for privilege escalation.", "Apply updates per vendor instructions.", "

"], [623, "CVE-2020-2509", "QNAP", "QNAP Network-Attached Storage (NAS)", "Links here", "2022-04-11", "2022-05-02", "QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution.", "Apply updates per vendor instructions.", "

"], [624, "CVE-2017-11317", "Telerik", "User Interface (UI) for ASP.NET AJAX", "Links here", "2022-04-11", "2022-05-02", "Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code.", "Apply updates per vendor instructions.", "

"], [625, "CVE-2022-24521", "Microsoft", "Windows", "Links here", "2022-04-13", "2022-05-04", "Microsoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [626, "CVE-2018-7602", "Drupal", "Core", "Links here", "2022-04-13", "2022-05-04", "A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.", "Apply updates per vendor instructions.", "

"], [627, "CVE-2018-20753", "Kaseya", "Virtual System/Server Administrator (VSA)", "Links here", "2022-04-13", "2022-05-04", "Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.", "Apply updates per vendor instructions.", "

"], [628, "CVE-2015-5123", "Adobe", "Flash Player", "Links here", "2022-04-13", "2022-05-04", "Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [629, "CVE-2015-5122", "Adobe", "Flash Player", "Links here", "2022-04-13", "2022-05-04", "Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [630, "CVE-2015-3113", "Adobe", "Flash Player", "Links here", "2022-04-13", "2022-05-04", "Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [631, "CVE-2015-2502", "Microsoft", "Internet Explorer", "Links here", "2022-04-13", "2022-05-04", "Microsoft Internet Explorer contains a memory corruption vulnerability which allows an attacker to execute code or cause a denial-of-service.", "Apply updates per vendor instructions.", ""], [632, "CVE-2015-0313", "Adobe", "Flash Player", "Links here", "2022-04-13", "2022-05-04", "Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [633, "CVE-2015-0311", "Adobe", "Flash Player", "Links here", "2022-04-13", "2022-05-04", "Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [634, "CVE-2014-9163", "Adobe", "Flash Player", "Links here", "2022-04-13", "2022-05-04", "Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [635, "CVE-2022-22954", "VMware", "Workspace ONE Access and Identity Manager", "Links here", "2022-04-14", "2022-05-05", "VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.", "Apply updates per vendor instructions.", "

"], [635, "CVE-2022-22954", "VMware", "Workspace ONE Access and Identity Manager", "Links here", "2022-04-14", "2022-05-05", "VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.", "Apply updates per vendor instructions.", "

"], [636, "CVE-2022-22960", "VMware", "Multiple Products", "Links here", "2022-04-15", "2022-05-06", "VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.", "Apply updates per vendor instructions.", "

"], [637, "CVE-2022-1364", "Google", "Chromium V8 Engine", "Links here", "2022-04-15", "2022-05-06", "Google Chromium V8 engine contains a type confusion vulnerability.", "Apply updates per vendor instructions.", "

"], [638, "CVE-2019-3929", "Crestron", "Multiple Products", "Links here", "2022-04-15", "2022-05-06", "Multiple Crestron products are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.", "Apply updates per vendor instructions.", "

"], [639, "CVE-2019-16057", "D-Link", "DNS-320 Storage Device", "Links here", "2022-04-15", "2022-05-06", "The login_mgr.cgi script in D-Link DNS-320 is vulnerable to remote code execution.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [640, "CVE-2018-7841", "Schneider Electric", "U.motion Builder", "Links here", "2022-04-15", "2022-05-06", "A SQL Injection vulnerability exists in U.motion Builder software which could cause unwanted code execution when an improper set of characters is entered.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [641, "CVE-2016-4523", "Trihedral", "VTScada (formerly VTS)", "Links here", "2022-04-15", "2022-05-06", "The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service.", "Apply updates per vendor instructions.", "

"], [642, "CVE-2014-0780", "InduSoft", "Web Studio", "Links here", "2022-04-15", "2022-05-06", "InduSoft Web Studio NTWebServer contains a directory traversal vulnerability which allows remote attackers to read administrative passwords in APP files, allowing for remote code execution.", "Apply updates per vendor instructions.", ""], [643, "CVE-2010-5330", "Ubiquiti", "AirOS", "Links here", "2022-04-15", "2022-05-06", "Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.", "Apply updates per vendor instructions.", ""], [644, "CVE-2007-3010", "Alcatel", "OmniPCX Enterprise", "Links here", "2022-04-15", "2022-05-06", "masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.", "Apply updates per vendor instructions.", ""], [645, "CVE-2018-6882", "Zimbra", "Collaboration Suite (ZCS)", "Links here", "2022-04-19", "2022-05-10", "Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.", "Apply updates per vendor instructions.", "

"], [646, "CVE-2019-3568", "Meta Platforms", "WhatsApp", "Links here", "2022-04-19", "2022-05-10", "A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.", "Apply updates per vendor instructions.", "

"], [647, "CVE-2022-22718", "Microsoft", "Windows", "Links here", "2022-04-19", "2022-05-10", "Microsoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation.", "Apply updates per vendor instructions.", "

"], [648, "CVE-2022-29464", "WSO2", "Multiple Products", "Links here", "2022-04-25", "2022-05-16", "Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution.", "Apply updates per vendor instructions.", "

"], [649, "CVE-2022-26904", "Microsoft", "Windows", "Links here", "2022-04-25", "2022-05-16", "Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [650, "CVE-2022-21919", "Microsoft", "Windows", "Links here", "2022-04-25", "2022-05-16", "Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [651, "CVE-2022-0847", "Linux", "Kernel", "Links here", "2022-04-25", "2022-05-16", "Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of \"Dirty Pipe.\"", "Apply updates per vendor instructions.", "

"], [652, "CVE-2021-41357", "Microsoft", "Win32k", "Links here", "2022-04-25", "2022-05-16", "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [653, "CVE-2021-40450", "Microsoft", "Win32k", "Links here", "2022-04-25", "2022-05-16", "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [654, "CVE-2019-1003029", "Jenkins", "Script Security Plugin", "Links here", "2022-04-25", "2022-05-16", "Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.", "Apply updates per vendor instructions.", "

"], [655, "CVE-2021-1789", "Apple", "Multiple Products", "Links here", "2022-05-04", "2022-05-25", "A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [656, "CVE-2019-8506", "Apple", "Multiple Products", "Links here", "2022-05-04", "2022-05-25", "A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.", "Apply updates per vendor instructions.", "

"], [657, "CVE-2014-4113", "Microsoft", "Win32k", "Links here", "2022-05-04", "2022-05-25", "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions.", ""], [658, "CVE-2014-0322", "Microsoft", "Internet Explorer", "Links here", "2022-05-04", "2022-05-25", "Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.", "Apply updates per vendor instructions.", ""], [659, "CVE-2014-0160", "OpenSSL", "OpenSSL", "Links here", "2022-05-04", "2022-05-25", "The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.", "Apply updates per vendor instructions.", "

"], [660, "CVE-2022-1388", "F5", "BIG-IP", "Links here", "5/10/2022", "5/31/2022", "F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.", "Apply updates per vendor instructions.", "

"], [661, "CVE-2022-26925", "Microsoft", "Windows", "Links here", "2022-05-11", "2022-06-01", "Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.", "Apply updates per vendor instructions.", "

"], [662, "CVE-2022-30525", "Zyxel", "Multiple Firewalls", "Links here", "2022-05-16", "2022-06-06", "A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.", "Apply updates per vendor instructions.", "

"], [663, "CVE-2022-22947", "VMware", "Spring Cloud Gateway", "Links here", "2022-05-16", "2022-06-06", "Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.", "Apply updates per vendor instructions.", "

"], [664, "CVE-2022-20821", "Cisco", "IOS XR", "Links here", "2022-05-23", "2022-06-13", "Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.", "Apply updates per vendor instructions.", "

"], [665, "CVE-2021-1048", "Android", "Kernel", "Links here", "2022-05-23", "2022-06-13", "Android kernel contains a use-after-free vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [666, "CVE-2021-0920", "Android", "Kernel", "Links here", "2022-05-23", "2022-06-13", "Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation.", "Apply updates per vendor instructions.", "

"], [667, "CVE-2021-30883", "Apple", "Multiple Products", "Links here", "2022-05-23", "2022-06-13", "Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution.", "Apply updates per vendor instructions.", "

"], [668, "CVE-2020-1027", "Microsoft", "Windows", "Links here", "2022-05-23", "2022-06-13", "An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.", "Apply updates per vendor instructions.", "

"], [669, "CVE-2020-0638", "Microsoft", "Update Notification Manager", "Links here", "2022-05-23", "2022-06-13", "Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [670, "CVE-2019-7286", "Apple", "Multiple Products", "Links here", "2022-05-23", "2022-06-13", "Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation.", "Apply updates per vendor instructions.", "

"], [671, "CVE-2019-7287", "Apple", "iOS", "Links here", "2022-05-23", "2022-06-13", "Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution.", "Apply updates per vendor instructions.", "

"], [672, "CVE-2019-0676", "Microsoft", "Internet Explorer", "Links here", "2022-05-23", "2022-06-13", "An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.", "Apply updates per vendor instructions.", "

"], [673, "CVE-2019-5786", "Google", "Chrome", "Links here", "2022-05-23", "2022-06-13", "Google Chrome contains a heap use-after-free vulnerability which allows an attacker to potentially perform out of bounds memory access.", "Apply updates per vendor instructions.", "

"], [674, "CVE-2019-0703", "Microsoft", "Windows", "Links here", "2022-05-23", "2022-06-13", "An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.", "Apply updates per vendor instructions.", "

"], [675, "CVE-2019-0880", "Microsoft", "Windows", "Links here", "2022-05-23", "2022-06-13", "A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.", "Apply updates per vendor instructions.", "

"], [676, "CVE-2019-13720", "Google", "Chrome", "Links here", "2022-05-23", "2022-06-13", "Use-after-free in WebAudio in Google Chrome allows a remote attacker to potentially exploit heap corruption.", "Apply updates per vendor instructions.", "

"], [677, "CVE-2019-11707", "Mozilla", "Firefox and Thunderbird", "Links here", "2022-05-23", "2022-06-13", "Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.", "Apply updates per vendor instructions.", "

"], [678, "CVE-2019-11708", "Mozilla", "Firefox and Thunderbird", "Links here", "2022-05-23", "2022-06-13", "Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.", "Apply updates per vendor instructions.", "

"], [679, "CVE-2019-8720", "WebKitGTK", "WebKitGTK", "Links here", "2022-05-23", "2022-06-13", "WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution.", "Apply updates per vendor instructions.", "

"], [680, "CVE-2019-18426", "Meta Platforms", "WhatsApp", "Links here", "2022-05-23", "2022-06-13", "A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.", "Apply updates per vendor instructions.", "

"], [681, "CVE-2019-1385", "Microsoft", "Windows", "Links here", "2022-05-23", "2022-06-13", "A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.", "Apply updates per vendor instructions.", "

"], [682, "CVE-2019-1130", "Microsoft", "Windows", "Links here", "2022-05-23", "2022-06-13", "A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.", "Apply updates per vendor instructions.", "

"], [683, "CVE-2018-5002", "Adobe", "Flash Player", "Links here", "2022-05-23", "2022-06-13", "Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [684, "CVE-2018-8589", "Microsoft", "Win32k", "Links here", "2022-05-23", "2022-06-13", "A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.", "Apply updates per vendor instructions.", "

"], [685, "CVE-2018-8611", "Microsoft", "Windows", "Links here", "2022-05-24", "2022-06-14", "A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.", "Apply updates per vendor instructions.", "

"], [686, "CVE-2018-19953", "QNAP", "Network Attached Storage (NAS)", "Links here", "2022-05-24", "2022-06-14", "A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.", "Apply updates per vendor instructions.", "

"], [687, "CVE-2018-19949", "QNAP", "Network Attached Storage (NAS)", "Links here", "2022-05-24", "2022-06-14", "A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands.", "Apply updates per vendor instructions.", "

"], [688, "CVE-2018-19943", "QNAP", "Network Attached Storage (NAS)", "Links here", "2022-05-24", "2022-06-14", "A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code.", "Apply updates per vendor instructions.", "

"], [689, "CVE-2017-0147", "Microsoft", "SMBv1 server", "Links here", "2022-05-24", "2022-06-14", "The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.", "Apply updates per vendor instructions.", "

"], [690, "CVE-2017-0022", "Microsoft", "XML Core Services", "Links here", "2022-05-24", "2022-06-14", "Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.", "Apply updates per vendor instructions.", "

"], [691, "CVE-2017-0005", "Microsoft", "Windows", "Links here", "2022-05-24", "2022-06-14", "The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.", "Apply updates per vendor instructions.", "

"], [692, "CVE-2017-0149", "Microsoft", "Internet Explorer", "Links here", "2022-05-24", "2022-06-14", "Microsoft Internet Explorer allows remote attackers to execute code or cause a denial-of-service (memory corruption) via a crafted web site.", "Apply updates per vendor instructions.", "

"], [693, "CVE-2017-0210", "Microsoft", "Internet Explorer", "Links here", "2022-05-24", "2022-06-14", "A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.", "Apply updates per vendor instructions.", "

"], [694, "CVE-2017-8291", "Artifex", "Ghostscript", "Links here", "2022-05-24", "2022-06-14", "Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a \"/OutputFile.", "Apply updates per vendor instructions.", "

"], [695, "CVE-2017-8543", "Microsoft", "Windows", "Links here", "2022-05-24", "2022-06-14", "Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.", "Apply updates per vendor instructions.", "

"], [696, "CVE-2017-18362", "Kaseya", "Virtual System/Server Administrator (VSA)", "Links here", "2022-05-24", "2022-06-14", "ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [697, "CVE-2016-0162", "Microsoft", "Internet Explorer", "Links here", "2022-05-24", "2022-06-14", "An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.", "Apply updates per vendor instructions.", "

"], [698, "CVE-2016-3351", "Microsoft", "Internet Explorer and Edge", "Links here", "2022-05-24", "2022-06-14", "An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.", "Apply updates per vendor instructions.", "

"], [699, "CVE-2016-4655", "Apple", "iOS", "Links here", "2022-05-24", "2022-06-14", "The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application.", "Apply updates per vendor instructions.", "

"], [700, "CVE-2016-4656", "Apple", "iOS", "Links here", "2022-05-24", "2022-06-14", "A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service via a crafted application.", "Apply updates per vendor instructions.", "

"], [701, "CVE-2016-4657", "Apple", "iOS", "Links here", "2022-05-24", "2022-06-14", "WebKit in Apple iOS contains a memory corruption vulnerability which allows attackers to execute remote code or cause a denial-of-service via a crafted web site.", "Apply updates per vendor instructions.", "

"], [702, "CVE-2016-6366", "Cisco", "Adaptive Security Appliance (ASA)", "Links here", "2022-05-24", "2022-06-14", "A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code.", "Apply updates per vendor instructions.", "

"], [703, "CVE-2016-6367", "Cisco", "Adaptive Security Appliance (ASA)", "Links here", "2022-05-24", "2022-06-14", "A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service condition or potentially execute code.", "Apply updates per vendor instructions.", "

"], [704, "CVE-2016-3298", "Microsoft", "Internet Explorer", "Links here", "2022-05-24", "2022-06-14", "An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.", "Apply updates per vendor instructions.", "

"], [705, "CVE-2019-3010", "Oracle", "Solaris", "Links here", "2022-05-25", "2022-06-15", "Oracle Solaris component: XScreenSaver contains an unspecified vulnerability which allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [706, "CVE-2016-3393", "Microsoft", "Windows", "Links here", "2022-05-25", "2022-06-15", "A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.", "Apply updates per vendor instructions.", "

"], [707, "CVE-2016-7256", "Microsoft", "Windows", "Links here", "2022-05-25", "2022-06-15", "A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.", "Apply updates per vendor instructions.", "

"], [708, "CVE-2016-1010", "Adobe", "Flash Player and AIR", "Links here", "2022-05-25", "2022-06-15", "Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code.", "The impacted products are end-of-life and should be disconnected if still in use.", "

"], [709, "CVE-2016-0984", "Adobe", "Flash Player and AIR", "Links here", "2022-05-25", "2022-06-15", "Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code.", "The impacted products are end-of-life and should be disconnected if still in use.", "

"], [710, "CVE-2016-0034", "Microsoft", "Silverlight", "Links here", "2022-05-25", "2022-06-15", "Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service.", "The impacted products are end-of-life and should be disconnected if still in use.", "

"], [711, "CVE-2015-0310", "Adobe", "Flash Player", "Links here", "2022-05-25", "2022-06-15", "Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [712, "CVE-2015-0016", "Microsoft", "Windows", "Links here", "2022-05-25", "2022-06-15", "Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges.", "Apply updates per vendor instructions.", ""], [713, "CVE-2015-0071", "Microsoft", "Internet Explorer", "Links here", "2022-05-25", "2022-06-15", "Microsoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site.", "Apply updates per vendor instructions.", ""], [714, "CVE-2015-2360", "Microsoft", "Win32k", "Links here", "2022-05-25", "2022-06-15", "Win32k.sys in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges or cause denial-of-service.", "Apply updates per vendor instructions.", ""], [715, "CVE-2015-2425", "Microsoft", "Internet Explorer", "Links here", "2022-05-25", "2022-06-15", "Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service.", "Apply updates per vendor instructions.", ""], [716, "CVE-2015-1769", "Microsoft", "Windows", "Links here", "2022-05-25", "2022-06-15", "A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links.", "Apply updates per vendor instructions.", ""], [717, "CVE-2015-4495", "Mozilla", "Firefox", "Links here", "2022-05-25", "2022-06-15", "Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.", "Apply updates per vendor instructions.", "

"], [718, "CVE-2015-8651", "Adobe", "Flash Player", "Links here", "2022-05-25", "2022-06-15", "Integer overflow in Adobe Flash Player allows attackers to execute code.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [719, "CVE-2015-6175", "Microsoft", "Windows", "Links here", "2022-05-25", "2022-06-15", "The kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application.", "Apply updates per vendor instructions.", ""], [720, "CVE-2015-1671", "Microsoft", "Windows", "Links here", "2022-05-25", "2022-06-15", "A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.", "Apply updates per vendor instructions.", ""], [721, "CVE-2014-4148", "Microsoft", "Windows", "Links here", "2022-05-25", "2022-06-15", "A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.", "Apply updates per vendor instructions.", ""], [722, "CVE-2014-8439", "Adobe", "Flash Player", "Links here", "2022-05-25", "2022-06-15", "Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [723, "CVE-2014-4123", "Microsoft", "Internet Explorer", "Links here", "2022-05-25", "2022-06-15", "Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.", "Apply updates per vendor instructions.", ""], [724, "CVE-2014-0546", "Adobe", "Acrobat and Reader", "Links here", "2022-05-25", "2022-06-15", "Adobe Acrobat and Reader on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context.", "Apply updates per vendor instructions.", ""], [725, "CVE-2014-2817", "Microsoft", "Internet Explorer", "Links here", "2022-05-25", "2022-06-15", "Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.", "Apply updates per vendor instructions.", ""], [726, "CVE-2014-4077", "Microsoft", "Input Method Editor (IME) Japanese", "Links here", "2022-05-25", "2022-06-15", "Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.", "Apply updates per vendor instructions.", ""], [727, "CVE-2014-3153", "Linux", "Kernel", "Links here", "2022-05-25", "2022-06-15", "The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.", "Apply updates per vendor instructions.", "

"], [728, "CVE-2013-7331", "Microsoft", "Internet Explorer", "Links here", "2022-05-25", "2022-06-15", "An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.", "Apply updates per vendor instructions.", ""], [729, "CVE-2013-3993", "IBM", "InfoSphere BigInsights", "Links here", "2022-05-25", "2022-06-15", "Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [730, "CVE-2013-3896", "Microsoft", "Silverlight", "Links here", "2022-05-25", "2022-06-15", "Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [731, "CVE-2013-2423", "Oracle", "Java Runtime Environment (JRE)", "Links here", "2022-05-25", "2022-06-15", "Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.", "Apply updates per vendor instructions.", "

"], [732, "CVE-2013-0431", "Oracle", "Java Runtime Environment (JRE)", "Links here", "2022-05-25", "2022-06-15", "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.", "Apply updates per vendor instructions.", "

"], [733, "CVE-2013-0422", "Oracle", "Java Runtime Environment (JRE)", "Links here", "2022-05-25", "2022-06-15", "A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.", "Apply updates per vendor instructions.", "

"], [734, "CVE-2013-0074", "Microsoft", "Silverlight", "Links here", "2022-05-25", "2022-06-15", "Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [735, "CVE-2012-1710", "Oracle", "Fusion Middleware", "Links here", "2022-05-25", "2022-06-15", "Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer.", "Apply updates per vendor instructions.", ""], [736, "CVE-2010-1428", "Red Hat", "JBoss", "Links here", "2022-05-25", "2022-06-15", "Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information.", "Apply updates per vendor instructions.", ""], [737, "CVE-2010-0840", "Oracle", "Java Runtime Environment (JRE)", "Links here", "2022-05-25", "2022-06-15", "Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.", "Apply updates per vendor instructions.", ""], [738, "CVE-2010-0738", "Red Hat", "JBoss", "Links here", "2022-05-25", "2022-06-15", "The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.", "Apply updates per vendor instructions.", "

"], [739, "CVE-2022-26134", "Atlassian", "Confluence Server/Data Center", "Links here", "2022-06-02", "2022-06-03", "Versions of Confluence Server and Data Center contain a remote code execution vulnerability that allow for an unauthenticated attacker to perform arbitrary code execution.", "Immediately block all internet traffic to and from Atlassian's Confluence Server and Data Center products until an update is available and successfully applied.", "

"], [740, "CVE-2022-31460", "Owl Labs", "Meeting Owl Pro and Whiteboard Owl", "Links here", "2022-06-08", "2022-06-22", "Owl Labs Meeting Owl and Whiteboard Owl allow attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value.", "Apply updates per vendor instructions.", "

"], [741, "CVE-2019-7195", "QNAP", "Photo Station", "Links here", "2022-06-08", "2022-06-22", "QNAP devices running Photo Station contains an external control of file name or path vulnerability allowing remote attackers to access or modify system files.", "Apply updates per vendor instructions.", "

"], [742, "CVE-2019-7194", "QNAP", "Photo Station", "Links here", "2022-06-08", "2022-06-22", "QNAP devices running Photo Station contains an external control of file name or path vulnerability allowing remote attackers to access or modify system files.", "Apply updates per vendor instructions.", "

"], [743, "CVE-2019-7193", "QNAP", "QTS", "Links here", "2022-06-08", "2022-06-22", "QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.", "Apply updates per vendor instructions.", "

"], [744, "CVE-2019-7192", "QNAP", "Photo Station", "Links here", "2022-06-08", "2022-06-22", "QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.", "Apply updates per vendor instructions.", "

"], [745, "CVE-2019-5825", "Google", "Chromium V8 Engine", "Links here", "2022-06-08", "2022-06-22", "Google Chromium V8 contains an out-of-bounds write vulnerability which allows a remote attacker to potentially exploit heap corruption.", "Apply updates per vendor instructions.", "

"], [746, "CVE-2019-15271", "Cisco", "RV Series Routers", "Links here", "2022-06-08", "2022-06-22", "A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.", "Apply updates per vendor instructions.", "

"], [747, "CVE-2018-6065", "Google", "Chromium V8 Engine", "Links here", "2022-06-08", "2022-06-22", "Google Chromium V8 Engine contains an integer overflow vulnerability which allows a remote attacker to potentially exploit heap corruption.", "Apply updates per vendor instructions.", "

"], [748, "CVE-2018-4990", "Adobe", "Acrobat and Reader", "Links here", "2022-06-08", "2022-06-22", "Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.", "Apply updates per vendor instructions.", "

"], [749, "CVE-2018-17480", "Google", "Chromium V8 Engine", "Links here", "2022-06-08", "2022-06-22", "Google Chromium V8 contains an out-of-bounds write vulnerability which allows a remote attacker to execute code inside a sandbox.", "Apply updates per vendor instructions.", "

"], [750, "CVE-2018-17463", "Google", "Chromium V8 Engine", "Links here", "2022-06-08", "2022-06-22", "Google Chromium V8 contains an unspecified vulnerability which allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [751, "CVE-2017-6862", "NETGEAR", "Multiple Devices", "Links here", "2022-06-08", "2022-06-22", "Multiple NETGEAR devices contain a buffer overflow vulnerability that allow for authentication bypass and remote code execution.", "Apply updates per vendor instructions.", "

"], [752, "CVE-2017-5070", "Google", "Chromium V8 Engine", "Links here", "2022-06-08", "2022-06-22", "Google Chromium V8 Engine contains a type confusion vulnerability which allows a remote attacker to execute code inside a sandbox.", "Apply updates per vendor instructions.", "

"], [753, "CVE-2017-5030", "Google", "Chromium V8 Engine", "Links here", "2022-06-08", "2022-06-22", "Google Chromium V8 Engine contains a memory corruption vulnerability which allows a remote attacker to execute code.", "Apply updates per vendor instructions.", "

"], [754, "CVE-2016-5198", "Google", "Chromium V8 Engine", "Links here", "2022-06-08", "2022-06-22", "Google Chromium V8 Engine contains an out-of-bounds memory vulnerability.", "Apply updates per vendor instructions.", "

"], [755, "CVE-2016-1646", "Google", "Chromium V8 Engine", "Links here", "2022-06-08", "2022-06-22", "Google Chromium V8 contains an out-of-bounds read vulnerability.", "Apply updates per vendor instructions.", "

"], [756, "CVE-2013-1331", "Microsoft", "Office", "Links here", "2022-06-08", "2022-06-22", "Microsoft Office contains a buffer overflow vulnerability which allows remote attackers to execute code via crafted PNG data in an Office document.", "Apply updates per vendor instructions.", ""], [757, "CVE-2012-5054", "Adobe", "Flash Player", "Links here", "2022-06-08", "2022-06-22", "Adobe Flash Player contains an integer overflow vulnerability which allows remote attackers to execute code via malformed arguments.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [758, "CVE-2012-4969", "Microsoft", "Internet Explorer", "Links here", "2022-06-08", "2022-06-22", "Microsoft Internet Explorer contains a use-after-free vulnerability which allows remote attackers to execute code via a crafted web site.", "Apply updates per vendor instructions.", ""], [759, "CVE-2012-1889", "Microsoft", "XML Core Services", "Links here", "2022-06-08", "2022-06-22", "Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.", "Apply updates per vendor instructions.", ""], [760, "CVE-2012-0767", "Adobe", "Flash Player", "Links here", "2022-06-08", "2022-06-22", "Adobe Flash Player contains a XSS vulnerability which allows remote attackers to inject web script or HTML.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [761, "CVE-2012-0754", "Adobe", "Flash Player", "Links here", "2022-06-08", "2022-06-22", "Adobe Flash Player contains a memory corruption vulnerability which allows remote attackers to execute code or cause denial-of-service.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [762, "CVE-2012-0151", "Microsoft", "Windows", "Links here", "2022-06-08", "2022-06-22", "The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.", "Apply updates per vendor instructions.", ""], [763, "CVE-2011-2462", "Adobe", "Acrobat and Reader", "Links here", "2022-06-08", "2022-06-22", "The Universal 3D (U3D) component in Adobe Acrobat and Reader contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service.", "Apply updates per vendor instructions.", ""], [764, "CVE-2011-0609", "Adobe", "Flash Player", "Links here", "2022-06-08", "2022-06-22", "Adobe Flash Player contains an unspecified vulnerability which allows remote attackers to execute code or cause denial-of-service.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [765, "CVE-2010-2883", "Adobe", "Reader and Acrobat", "Links here", "2022-06-08", "2022-06-22", "Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability which allows remote attackers to execute code or cause denial-of-service.", "Apply updates per vendor instructions.", ""], [766, "CVE-2010-2572", "Microsoft", "PowerPoint", "Links here", "2022-06-08", "2022-06-22", "Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.", "Apply updates per vendor instructions.", ""], [767, "CVE-2010-1297", "Adobe", "Flash Player", "Links here", "2022-06-08", "2022-06-22", "Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [768, "CVE-2009-4324", "Adobe", "Acrobat and Reader", "Links here", "2022-06-08", "2022-06-22", "Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file.", "Apply updates per vendor instructions.", ""], [769, "CVE-2009-3953", "Adobe", "Acrobat and Reader", "Links here", "2022-06-08", "2022-06-22", "Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution.", "Apply updates per vendor instructions.", ""], [770, "CVE-2009-1862", "Adobe", "Acrobat and Reader, Flash Player", "Links here", "2022-06-08", "2022-06-22", "Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service.", "For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.", ""], [771, "CVE-2009-0563", "Microsoft", "Office", "Links here", "2022-06-08", "2022-06-22", "Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.", "Apply updates per vendor instructions.", ""], [772, "CVE-2009-0557", "Microsoft", "Office", "Links here", "2022-06-08", "2022-06-22", "Microsoft Office contains an object record corruption vulnerability which allows remote attackers to execute code via a crafted Excel file with a malformed record object.", "Apply updates per vendor instructions.", ""], [773, "CVE-2008-0655", "Adobe", "Acrobat and Reader", "Links here", "2022-06-08", "2022-06-22", "Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times.", "Apply updates per vendor instructions.", ""], [774, "CVE-2007-5659", "Adobe", "Acrobat and Reader", "Links here", "2022-06-08", "2022-06-22", "Adobe Acrobat and Reader contain a buffer overflow vulnerability which allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods.", "Apply updates per vendor instructions.", ""], [775, "CVE-2006-2492", "Microsoft", "Word", "Links here", "2022-06-08", "2022-06-22", "Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.", "Apply updates per vendor instructions.", ""], [776, "CVE-2021-38163", "SAP", "NetWeaver", "Links here", "2022-06-09", "2022-06-30", "SAP NetWeaver contains a vulnerability that allows unrestricted file upload.", "Apply updates per vendor instructions.", "

"], [776, "CVE-2021-38163", "SAP", "NetWeaver", "Links here", "2022-06-09", "2022-06-30", "SAP NetWeaver contains a vulnerability that allows unrestricted file upload.", "Apply updates per vendor instructions.", "

"], [777, "CVE-2016-2386", "SAP", "NetWeaver", "Links here", "2022-06-09", "2022-06-30", "SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.", "Apply updates per vendor instructions.", "

"], [778, "CVE-2016-2388", "SAP", "NetWeaver", "Links here", "2022-06-09", "2022-06-30", "The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.", "Apply updates per vendor instructions.", "

"], [779, "CVE-2022-30190", "Microsoft", "Windows", "Links here", "2022-06-14", "2022-07-05", "A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.", "Apply updates per vendor instructions.", "

"], [780, "CVE-2022-29499", "Mitel", "MiVoice Connect", "Links here", "2022-06-27", "2022-07-18", "The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.", "Apply updates per vendor instructions.", "

"], [781, "CVE-2021-30533", "Google", "Chromium", "Links here", "2022-06-27", "2022-07-18", "Insufficient policy enforcement in the PopupBlocker for Chromium allows an attacker to remotely bypass security mechanisms. This vulnerability impacts web browsers using Chromium such as Chrome and Edge.", "Apply updates per vendor instructions.", "

"], [782, "CVE-2021-4034", "Red Hat", "Polkit", "Links here", "2022-06-27", "2022-07-18", "The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability which allows for privilege escalation with administrative rights.", "Apply updates per vendor instructions.", "

"], [783, "CVE-2021-30983", "Apple", "iOS and iPadOS", "Links here", "2022-06-27", "2022-07-18", "Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [784, "CVE-2020-3837", "Apple", "Multiple Products", "Links here", "2022-06-27", "2022-07-18", "Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [785, "CVE-2020-9907", "Apple", "Multiple Products", "Links here", "2022-06-27", "2022-07-18", "Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [786, "CVE-2019-8605", "Apple", "Multiple Products", "Links here", "2022-06-27", "2022-07-18", "A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.", "Apply updates per vendor instructions.", "

"], [787, "CVE-2018-4344", "Apple", "Multiple Products", "Links here", "2022-06-27", "2022-07-18", "Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution.", "Apply updates per vendor instructions.", "

"], [788, "CVE-2022-22047", "Microsoft", "Windows", "Links here", "2022-07-12", "2022-08-02", "Microsoft Windows CSRSS contains an unspecified vulnerability which allows for privilege escalation to SYSTEM privileges.", "Apply updates per vendor instructions.", "

"], [789, "CVE-2022-26138", "Atlassian", "Confluence", "Links here", "2022-07-29", "2022-08-19", "Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.", "Apply updates per vendor instructions.", "

"], [790, "CVE-2022-27924", "Zimbra", "Collaboration", "Links here", "2022-08-04", "2022-08-25", "Zimbra Collaboration (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.", "Apply updates per vendor instructions.", "

"], [791, "CVE-2022-34713", "Microsoft ", "Windows", "Links here", "2022-08-09", "2022-08-30", "A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.", "Apply updates per vendor instructions.", "

"], [792, "CVE-2022-30333", "RARLAB", "UnRAR", "Links here", "2022-08-09", "2022-08-30", "RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.", "Apply updates per vendor instructions.", "

"], [793, "CVE-2022-27925", "Zimbra", "Collaboration", "Links here", "2022-08-11", "2022-09-01", "Zimbra Collaboration (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.", "Apply updates per vendor instructions.", "

"], [794, "CVE-2022-37042", "Zimbra", "Collaboration", "Links here", "2022-08-11", "2022-09-01", "Zimbra Collaboration (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.", "Apply updates per vendor instructions.", "

"], [795, "CVE-2022-22536", "SAP", "Multiple Products", "Links here", "2022-08-18", "2022-09-08", "SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.", "Apply updates per vendor instructions.", "

"], [796, "CVE-2022-32894", "Apple", "iOS and macOS", "Links here", "2022-08-18", "2022-09-08", "Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [797, "CVE-2022-32893", "Apple", "iOS and macOS", "Links here", "2022-08-18", "2022-09-08", "Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content.", "Apply updates per vendor instructions.", "

"], [798, "CVE-2022-2856", "Google", "Chrome", "Links here", "2022-08-18", "2022-09-08", "Google Chrome Intents allows for insufficient validation of untrusted input, causing unknown impacts. CISA will update this description if more information becomes available.", "Apply updates per vendor instructions.", "

"], [799, "CVE-2022-26923", "Microsoft", "Active Directory", "Links here", "2022-08-18", "2022-09-08", "An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.", "Apply updates per vendor instructions.", "

"], [800, "CVE-2022-21971", "Microsoft", "Windows", "Links here", "2022-08-18", "2022-09-08", "Microsoft Windows Runtime contains an unspecified vulnerability which allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [801, "CVE-2017-15944", "Palo Alto", "PAN-OS", "Links here", "2022-08-18", "2022-09-08", "Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.", "Apply updates per vendor instructions.", "

"], [802, "CVE-2022-0028", "Palo Alto Networks", "PAN-OS", "Links here", "2022-08-22", "2022-09-12", "A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.", "Apply updates per vendor instructions.", "

"], [803, "CVE-2022-26352", "dotCMS", "dotCMS", "Links here", "2022-08-25", "2022-09-15", "dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [804, "CVE-2022-24706", "Apache", "CouchDB", "Links here", "2022-08-25", "2022-09-15", "Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.", "Apply updates per vendor instructions.", "

"], [805, "CVE-2022-24112", "Apache", "APISIX", "Links here", "2022-08-25", "2022-09-15", "Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [806, "CVE-2022-22963", "VMware Tanzu", "Spring Cloud", "Links here", "2022-08-25", "2022-09-15", "When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.", "Apply updates per vendor instructions.", "

"], [807, "CVE-2022-2294", "WebRTC", "WebRTC", "Links here", "2022-08-25", "2022-09-15", "WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability which allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.", "Apply updates per vendor instructions.", "

"], [808, "CVE-2021-39226", "Grafana Labs", "Grafana", "Links here", "2022-08-25", "2022-09-15", "Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.", "Apply updates per vendor instructions.", "

"], [809, "CVE-2021-38406", "Delta Electronics", "DOPSoft 2", "Links here", "2022-08-25", "2022-09-15", "Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [810, "CVE-2021-31010", "Apple", "iOS, macOS, watchOS", "Links here", "2022-08-25", "2022-09-15", "In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.", "Apply updates per vendor instructions.", "

"], [811, "CVE-2020-36193", "PEAR", "Archive_Tar", "Links here", "2022-08-25", "2022-09-15", "PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.", "Apply updates per vendor instructions.", "

"], [812, "CVE-2020-28949", "PEAR", "Archive_Tar", "Links here", "2022-08-25", "2022-09-15", "PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.", "Apply updates per vendor instructions.", "

"], [813, "CVE-2022-3075", "Google", "Chromium", "Links here", "2022-09-08", "2022-09-29", "Google Chromium Mojo contains an insufficient data validation vulnerability. Impacts from exploitation are not yet known. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge.", "Apply updates per vendor instructions.", "

"], [814, "CVE-2022-28958", "D-Link", "DIR-816L", "Links here", "2022-09-08", "2022-09-29", "D-Link DIR-816L contains an unspecified vulnerability in the shareport.php value parameter which allows for remote code execution.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [815, "CVE-2022-27593", "QNAP", "Photo Station", "Links here", "2022-09-08", "2022-09-29", "Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.", "Apply updates per vendor instructions.", "

"], [816, "CVE-2022-26258", "D-Link", "DIR-820L", "Links here", "2022-09-08", "2022-09-29", "D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [817, "CVE-2020-9934", "Apple", "iOS, iPadOS, and macOS", "Links here", "2022-09-08", "2022-09-29", "Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.", "Apply updates per vendor instructions.", "

"], [818, "CVE-2018-7445", "MikroTik", "RouterOS", "Links here", "2022-09-08", "2022-09-29", "In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system.", "Apply updates per vendor instructions.", "

"], [819, "CVE-2018-6530", "D-Link", "Multiple Routers", "Links here", "2022-09-08", "2022-09-29", "Multiple D-Link routers contain an unspecified vulnerability which allows for execution of OS commands.", "The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.", "

"], [820, "CVE-2018-2628", "Oracle", "WebLogic Server", "Links here", "2022-09-08", "2022-09-29", "Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.", "Apply updates per vendor instructions.", "

"], [821, "CVE-2018-13374", "Fortinet", "FortiOS and FortiADC", "Links here", "2022-09-08", "2022-09-29", "Fortinet FortiOS and FortiADC contain an improper access control vulnerability which allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.", "Apply updates per vendor instructions.", "

"], [822, "CVE-2017-5521", "NETGEAR", "Multiple Devices", "Links here", "2022-09-08", "2022-09-29", "Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.", "Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.", "

"], [823, "CVE-2011-4723", "D-Link", "DIR-300 Router", "Links here", "2022-09-08", "2022-09-29", "The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [824, "CVE-2011-1823", "Android", "Android OS", "Links here", "2022-09-08", "2022-09-29", "The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.", "Apply updates per vendor instructions.", ""], [825, "CVE-2022-37969", "Microsoft", "Windows", "Links here", "2022-09-14", "2022-10-05", "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability which allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [826, "CVE-2022-32917", "Apple", "iOS, iPadOS, and macOS", "Links here", "2022-09-14", "2022-10-05", "Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [827, "CVE-2022-40139", "Trend Micro", "Apex One and Apex One as a Service", "Links here", "2022-09-15", "2022-10-06", "Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.", "Apply updates per vendor instructions.", "

"], [828, "CVE-2013-6282", "Linux", "Kernel", "Links here", "2022-09-15", "2022-10-06", "The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.", "Apply updates per vendor instructions.", ""], [829, "CVE-2013-2597", "Code Aurora", "ACDB Audio Driver", "Links here", "2022-09-15", "2022-10-06", "The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability which allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android.", "Apply updates per vendor instructions.", ""], [830, "CVE-2013-2596", "Linux", "Kernel", "Links here", "2022-09-15", "2022-10-06", "Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability which allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [831, "CVE-2013-2094", "Linux", "Kernel", "Links here", "2022-09-15", "2022-10-06", "Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [832, "CVE-2010-2568", "Microsoft", "Windows", "Links here", "2022-09-15", "2022-10-06", "Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.", "Apply updates per vendor instructions.", ""], [833, "CVE-2022-35405", "Zoho", "ManageEngine", "Links here", "2022-09-22", "2022-10-13", "Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability which allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [833, "CVE-2022-35405", "Zoho", "ManageEngine", "Links here", "2022-09-22", "2022-10-13", "Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability which allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [834, "CVE-2022-3236", "Sophos", "Firewall", "Links here", "2022-09-23", "2022-10-14", "A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [835, "CVE-2022-41082", "Microsoft", "Exchange Server", "Links here", "2022-09-30", "2022-10-21", "Microsoft Exchange Server contains an unspecified vulnerability which allows for authenticated remote code execution. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.", "Apply updates per vendor instructions.", "

"], [836, "CVE-2022-41040", "Microsoft", "Exchange Server", "Links here", "2022-09-30", "2022-10-21", "Microsoft Exchange Server allows for server-side request forgery. Dubbed \"ProxyNotShell,\" this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [837, "CVE-2022-36804", "Atlassian", "Bitbucket Server and Data Center", "Links here", "2022-09-30", "2022-10-21", "Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.", "Apply updates per vendor instructions.", "

"], [838, "CVE-2022-40684", "Fortinet", "Multiple Products", "Links here", "2022-10-11", "2022-11-01", "Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.", "Apply updates per vendor instructions.", "

"], [839, "CVE-2022-41033", "Microsoft", "Windows COM+ Event System Service", "Links here", "2022-10-11", "2022-11-01", "Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [840, "CVE-2022-41352", "Zimbra", "Collaboration (ZCS)", "Links here", "2022-10-20", "2022-11-10", "Zimbra Collaboration (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.", "Apply updates per vendor instructions.", "

"], [841, "CVE-2021-3493", "Linux", "Kernel", "Links here", "2022-10-20", "2022-11-10", "The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.", "Apply updates per vendor instructions.", "

"], [842, "CVE-2020-3433", "Cisco", "AnyConnect Secure", "Links here", "2022-10-24", "2022-11-14", "Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges.", "Apply updates per vendor instructions.", "

"], [843, "CVE-2020-3153", "Cisco", "AnyConnect Secure", "Links here", "2022-10-24", "2022-11-14", "Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks.", "Apply updates per vendor instructions.", "

"], [844, "CVE-2018-19323", "GIGABYTE", "Multiple Products", "Links here", "2022-10-24", "2022-11-14", "The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.", "Apply updates per vendor instructions.", "

"], [845, "CVE-2018-19322", "GIGABYTE", "Multiple Products", "Links here", "2022-10-24", "2022-11-14", "The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.", "Apply updates per vendor instructions.", "

"], [846, "CVE-2018-19321", "GIGABYTE", "Multiple Products", "Links here", "2022-10-24", "2022-11-14", "The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.", "Apply updates per vendor instructions.", "

"], [847, "CVE-2018-19320", "GIGABYTE", "Multiple Products", "Links here", "2022-10-24", "2022-11-14", "The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.", "Apply updates per vendor instructions.", "

"], [848, "CVE-2022-42827", "Apple", "iOS and iPadOS", "Links here", "2022-10-25", "2022-11-15", "Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges.", "Apply updates per vendor instructions.", "

"], [849, "CVE-2022-3723", "Google", "Chromium V8 Engine", "Links here", "2022-10-28", "2022-11-18", "Google Chromium V8 contains a type confusion vulnerability. Specific impacts from exploitation are not available at this time.", "Apply updates per vendor instructions.", "

"], [850, "CVE-2022-41091", "Microsoft", "Windows", "Links here", "2022-11-08", "2022-11-29", "Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.", "Apply updates per vendor instructions.", "

"], [851, "CVE-2022-41073", "Microsoft", "Windows", "Links here", "2022-11-08", "2022-11-29", "Microsoft Windows Print Spooler contains an unspecified vulnerability which allows an attacker to gain SYSTEM-level privileges.", "Apply updates per vendor instructions.", "

"], [852, "CVE-2022-41125", "Microsoft", "Windows", "Links here", "2022-11-08", "2022-11-29", "Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability which allows an attacker to gain SYSTEM-level privileges.", "Apply updates per vendor instructions.", "

"], [853, "CVE-2022-41128", "Microsoft", "Windows", "Links here", "2022-11-08", "2022-11-29", "Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [854, "CVE-2021-25337", "Samsung", "Mobile Devices", "Links here", "2022-11-08", "2022-11-29", "Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370.", "Apply updates per vendor instructions.", "

"], [855, "CVE-2021-25369", "Samsung", "Mobile Devices", "Links here", "2022-11-08", "2022-11-29", "Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370.", "Apply updates per vendor instructions.", "

"], [856, "CVE-2021-25370", "Samsung", "Mobile Devices", "Links here", "2022-11-08", "2022-11-29", "Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369.", "Apply updates per vendor instructions.", "

"], [857, "CVE-2022-41049", "Microsoft", "Windows", "Links here", "2022-11-14", "2022-12-05", "Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.", "Apply updates per vendor instructions.", "

"], [858, "CVE-2021-35587", "Oracle", "Fusion Middleware", "Links here", "2022-11-28", "2022-12-19", "Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.", "Apply updates per vendor instructions.", "

"], [859, "CVE-2022-4135", "Google", "Chrome", "Links here", "2022-11-28", "2022-12-19", "Google Chrome GPU contains a heap buffer overflow vulnerability that allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.", "", "

"], [860, "CVE-2022-4262", "Google", "Chromium V8 Engine", "Links here", "2022-12-05", "2022-12-26", "Google Chromium V8 contains a type confusion vulnerability. Specific impacts from exploitation are not available at this time.", "Apply updates per vendor instructions.", "

"], [861, "CVE-2022-42475", "Fortinet", "FortiOS", "Links here", "2022-12-13", "2023-01-03", "Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.", "Apply updates per vendor instructions.", "

"], [862, "CVE-2022-44698", "Microsoft", "Defender", "Links here", "2022-12-13", "2023-01-03", "Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.", "Apply updates per vendor instructions.", "

"], [863, "CVE-2022-27518", "Citrix", "Application Delivery Controller (ADC) and Gateway", "Links here", "2022-12-13", "2023-01-03", "Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability which allows an attacker to execute code as administrator.", "Apply updates per vendor instructions.", "

"], [864, "CVE-2022-26500", "Veeam", "Backup & Replication", "Links here", "2022-12-13", "2023-01-03", "The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.", "Apply updates per vendor instructions.", "

"], [865, "CVE-2022-26501", "Veeam", "Backup & Replication", "Links here", "2022-12-13", "2023-01-03", "The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.", "Apply updates per vendor instructions.", "

"], [866, "CVE-2022-42856", "Apple", "iOS", "Links here", "2022-12-14", "2023-01-04", "Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.", "Apply updates per vendor instructions.", "

"], [867, "CVE-2022-22536?", "SAP ", "Multiple Products", "Links here", "8/18/2022", "9/8/2022", "SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.", "Apply updates per vendor instructions.", ""], [868, "CVE-2017-15944?", "Palo Alto Networks", "PAN-OS", "Links here", "8/18/2022", "9/8/2022", "Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.", "Apply updates per vendor instructions.", ""], [869, "CVE-2020-9934 ", "Apple", "iOS, iPadOS, and macOS", "Links here", "9/8/2022", "9/29/2022", "Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information.", "Apply updates per vendor instructions.", ""], [870, "CVE-2022-42475?", "Fortinet", "FortiOS", "Links here", "12/13/2022", "1/3/2023", "Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.", "Apply updates per vendor instructions.", ""], [871, "CVE-2018-5430", "TIBCO", "JasperReports Server", "Links here", "12/29/2022", "1/19/2023", "TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. ", "Apply updates per vendor instructions.", "

"], [872, "CVE-2018-18809", "TIBCO", "JasperReports Library", "Links here", "12/29/2022", "1/19/2023", "TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.", "Apply updates per vendor instructions.", "

"], [873, "CVE-2022-41080", "Microsoft", "Exchange Server", "Links here", "2023-01-10", "2023-01-31", "Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [874, "CVE-2023-21674", "Microsoft", "Windows", "Links here", "2023-01-10", "2023-01-31", "Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [875, "CVE-2022-44877", "CWP", "Control Web Panel", "Links here", "2023-01-17", "2023-02-07", "CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.", "Apply updates per vendor instructions.", "

"], [876, "CVE-2022-47966", "Zoho", "ManageEngine", "Links here", "2023-01-23", "2023-02-13", "Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.", "Apply updates per vendor instructions.", "

"], [877, "CVE-2017-11357", "Telerik", "User Interface (UI) for ASP.NET AJAX", "Links here", "2023-01-26", "2023-02-16", "Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.", "Apply updates per vendor instructions.", "

"], [878, "CVE-2022-21587", "Oracle", "E-Business Suite", "Links here", "2023-02-02", "2023-02-23", "Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.", "Apply updates per vendor instructions.", "

"], [879, "CVE-2023-22952", "SugarCRM", "Multiple Products", "Links here", "2023-02-02", "2023-02-23", "Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.", "Apply updates per vendor instructions.", "

"], [880, "CVE-2015-2291", "Intel", "Ethernet Diagnostics Driver for Windows", "Links here", "2023-02-10", "2023-03-03", "Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service.", "Apply updates per vendor instructions.", ""], [881, "CVE-2022-24990", "TerraMaster", "TerraMaster OS", "Links here", "2023-02-10", "2023-03-03", "TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.", "Apply updates per vendor instructions.", "

"], [881, "CVE-2022-24990", "TerraMaster", "TerraMaster OS", "Links here", "2023-02-10", "2023-03-03", "TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.", "Apply updates per vendor instructions.", "

"], [882, "CVE-2023-0669", "Fortra", "GoAnywhere MFT", "Links here", "2023-02-10", "2023-03-03", "Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.", "Apply updates per vendor instructions.", "

"], [883, "CVE-2023-21715", "Microsoft", "Office", "Links here", "2/14/2023", "3/7/2023", "Microsoft Office contains a security feature bypass vulnerability which allows for a local, authenticated attack on a targeted system.", "Apply updates per vendor instructions.", "

"], [884, "CVE-2023-23376", "Microsoft", "Windows", "Links here", "2/14/2023", "3/7/2023", "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability which allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [885, "CVE-2023-23529", "Apple", "Multiple Products", "Links here", "2/14/2023", "3/7/2023", "WebKit in Apple iOS, MacOS, Safari and iPadOS contains a type confusion vulnerability that may lead to code execution.", "Apply updates per vendor instructions.", "

"], [886, "CVE-2023-21823", "Microsoft", "Windows", "Links here", "2/14/2023", "3/7/2023", "Microsoft Windows Graphic Component contains an unspecified vulnerability which allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [887, "CVE-2022-46169", "Cacti", "Cacti", "Links here", "2023-02-16", "2023-03-09", "Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.", "Apply updates per vendor instructions", "

"], [888, "CVE-2022-47986", "IBM", "Aspera Faspex", "Links here", "2023-02-21", "2023-03-14", "IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.", "Apply updates per vendor instructions.", "

"], [889, "CVE-2022-41223", "Mitel", "MiVoice Connect", "Links here", "2023-02-21", "2023-03-14", "The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.", "Apply updates per vendor instructions.", "

"], [890, "CVE-2022-40765", "Mitel", "MiVoice Connect", "Links here", "2023-02-21", "2023-03-14", "The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.", "Apply updates per vendor instructions.", "

"], [891, "CVE-2022-36537", "ZK Framework", "AuUploader", "Links here", "2023-02-27", "2023-03-20", "ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.", "Apply updates per vendor instructions.", "

"], [892, "CVE-2022-28810", "Zoho", "ManageEngine", "Links here", "2023-03-07", "2023-03-28", "Multiple Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.", "Apply updates per vendor instructions.", "

"], [893, "CVE-2022-33891", "Apache", "Spark", "Links here", "2023-03-07", "2023-03-28", "Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.", "Apply updates per vendor instructions.", "

"], [894, "CVE-2022-35914", "Teclib", "GLPI", "Links here", "2023-03-07", "2023-03-28", "Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.", "Apply updates per vendor instructions.", "

"], [895, "CVE-2021-39144", "XStream", "XStream", "Links here", "3/10/2023", "3/31/2023", "XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects, that result in execution of a local command on the server. This vulnerability can affect multiple products including but not limited to VMware Cloud Foundation.", "Apply updates per vendor instructions.", "

"], [896, "CVE-2020-5741", "Plex", "Media Server", "Links here", "3/10/2023", "3/31/2023", "Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it.", "Apply updates per vendor instructions.", "

"], [897, "CVE-2023-23397", "Microsoft", "Office", "Links here", "2023-03-14", "2023-04-04", "Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.", "Apply updates per vendor instructions.", "

"], [898, "CVE-2023-24880", "Microsoft", "Windows", "Links here", "2023-03-14", "2023-04-04", "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.", "Apply updates per vendor instructions.", "

"], [899, "CVE-2022-41328", "Fortinet", "FortiOS", "Links here", "2023-03-14", "2023-04-04", "Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.", "Apply updates per vendor instructions.", "

"], [900, "CVE-2023-26360", "Adobe", "ColdFusion", "Links here", "2023-03-15", "2023-04-05", "Adobe ColdFusion contains an improper access control vulnerability that allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [901, "CVE-2013-3163", "Microsoft", "Internet Explorer", "Links here", "2023-03-30", "2023-04-20", "Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [902, "CVE-2017-7494", "Samba", "Samba", "Links here", "2023-03-30", "2023-04-20", "Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.", "Apply updates per vendor instructions.", "

"], [903, "CVE-2022-42948", "Fortra", "Cobalt Strike", "Links here", "2023-03-30", "2023-04-20", "Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.", "Apply updates per vendor instructions.", "

"], [904, "CVE-2022-39197", "Fortra", "Cobalt Strike", "Links here", "2023-03-30", "2023-04-20", "Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.", "Apply updates per vendor instructions.", "

"], [905, "CVE-2021-30900", "Apple", "iOS, iPadOS, and macOS", "Links here", "2023-03-30", "2023-04-20", "Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [906, "CVE-2022-38181", "Arm", "Mali Graphics Processing Unit (GPU)", "Links here", "2023-03-30", "2023-04-20", "Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.", "Apply updates per vendor instructions.", "

"], [907, "CVE-2023-0266", "Linux", "Kernel", "Links here", "2023-03-30", "2023-04-20", "Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.", "Apply updates per vendor instructions.", "

"], [908, "CVE-2022-3038", "Google", "Chrome", "Links here", "2023-03-30", "2023-04-20", "Google Chrome contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption.", "Apply updates per vendor instructions.", "

"], [909, "CVE-2022-22706", "Arm", "Mali Graphics Processing Unit (GPU)", "Links here", "2023-03-30", "2023-04-20", "Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.", "Apply updates per vendor instructions.", "

"], [910, "CVE-2022-27926", "Zimbra", "Collaboration (ZCS)", "Links here", "2023-04-03", "2023-04-24", "Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.", "Apply updates per vendor instructions.", "

"], [911, "CVE-2021-27876", "Veritas", "Backup Exec Agent", "Links here", "2023-04-07", "2023-04-28", "Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.", "Apply updates per vendor instructions.", "

"], [912, "CVE-2021-27877", "Veritas", "Backup Exec Agent", "Links here", "2023-04-07", "2023-04-28", "Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.", "Apply updates per vendor instructions.", "

"], [913, "CVE-2021-27878", "Veritas", "Backup Exec Agent", "Links here", "2023-04-07", "2023-04-28", "Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.", "Apply updates per vendor instructions.", "

"], [914, "CVE-2019-1388", "Microsoft", "Windows", "Links here", "2023-04-07", "2023-04-28", "Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.", "Apply updates per vendor instructions.", "

"], [915, "CVE-2023-26083", "Arm", "Mali Graphics Processing Unit (GPU)", "Links here", "2023-04-07", "2023-04-28", "Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.", "Apply updates per vendor instructions.", "

"], [916, "CVE-2023-28205", "Apple", "Multiple Products", "Links here", "2023-04-10", "2023-05-01", "Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content.", "Apply updates per vendor instructions.", "

"], [917, "CVE-2023-28206", "Apple", "iOS, iPadOS, and macOS", "Links here", "2023-04-10", "2023-05-01", "Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [918, "CVE-2023-28252", "Microsoft", "Windows", "Links here", "2023-04-11", "2023-05-02", "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [919, "CVE-2023-20963", "Android", "Framework", "Links here", "2023-04-13", "2023-05-04", "Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.", "Apply updates per vendor instructions.", "

"], [920, "CVE-2023-29492", "Novi Survey", "Novi Survey", "Links here", "2023-04-13", "2023-05-04", "Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.", "Apply updates per vendor instructions.", "

"], [921, "CVE-2019-8526", "Apple", "macOS", "Links here", "2023-04-17", "2023-05-08", "Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation.", "Apply updates per vendor instructions.", "

"], [922, "CVE-2023-2033", "Google", "Chromium V8 Engine", "Links here", "2023-04-17", "2023-05-08", "Google Chromium V8 contains a type confusion vulnerability. Specific impacts from exploitation are not available at this time.", "Apply updates per vendor instructions.", "

"], [923, "CVE-2017-6742", "Cisco", "IOS and IOS XE Software", "Links here", "2023-04-19", "2023-05-10", "The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.", "Apply updates per vendor instructions.", "

"], [924, "CVE-2023-28432", "MinIO", "MinIO", "Links here", "2023-04-21", "2023-05-12", "MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure.", "Apply updates per vendor instructions.", "

"], [925, "CVE-2023-27350", "PaperCut", "MF/NG", "Links here", "2023-04-21", "2023-05-12", "PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.", "Apply updates per vendor instructions.", "

"], [926, "CVE-2023-2136", "Google", "Chrome", "Links here", "2023-04-21", "2023-05-12", "Google Chrome Skia contains an integer overflow vulnerability. Specific impacts from exploitation are not available at this time. This vulnerability resides in Skia which serves as the graphics engine for Google Chrome and ChromeOS, Android, Flutter, and other products.", "Apply updates per vendor instructions.", "

"], [927, "CVE-2023-1389", "TP-Link", "Archer AX21", "Links here", "2023-05-01", "2023-05-22", "TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.", "Apply updates per vendor instructions.", "

"], [928, "CVE-2021-45046", "Apache", "Log4j2", "Links here", "2023-05-01", "2023-05-22", "Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.", "Apply updates per vendor instructions.", "

"], [929, "CVE-2023-21839", "Oracle", "WebLogic Server", "Links here", "2023-05-01", "2023-05-22", "Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.", "Apply updates per vendor instructions.", "

"], [930, "CVE-2023-29336", "Microsoft", "Win32k", "Links here", "2023-05-09", "2023-05-30", "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges.", "Apply updates per vendor instructions.", "

"], [931, "CVE-2023-25717", "Ruckus Wireless", "Multiple Products", "Links here", "2023-05-12", "2023-06-02", "Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs.", "Apply updates per vendor instructions or disconnect product if it is end-of-life.", "

"], [932, "CVE-2021-3560", "Red Hat", "Polkit", "Links here", "2023-05-12", "2023-06-02", "Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation.", "Apply updates per vendor instructions.", "

"], [933, "CVE-2014-0196", "Linux", "Kernel", "Links here", "2023-05-12", "2023-06-02", "Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service or gain privileges via read and write operations with long strings.", "The impacted product is end-of-life and should be disconnected if still in use.", "

"], [934, "CVE-2010-3904", "Linux", "Kernel", "Links here", "2023-05-12", "2023-06-02", "Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.", "The impacted product is end-of-life and should be disconnected if still in use.", ""], [935, "CVE-2015-5317", "Jenkins", "Jenkins User Interface (UI)", "Links here", "2023-05-12", "2023-06-02", "Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the \"Fingerprints\" pages.", "Apply updates per vendor instructions.", ""], [936, "CVE-2016-3427", "Oracle", "Java SE and JRockit", "Links here", "2023-05-12", "2023-06-02", "Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.", "Apply updates per vendor instructions.", "

"], [937, "CVE-2016-8735", "Apache", "Tomcat", "Links here", "2023-05-12", "2023-06-02", "Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.", "Apply updates per vendor instructions.", "

"], [938, "CVE-2004-1464", "Cisco", "IOS", "Links here", "2023-05-19", "2023-06-09", "Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device.", "Apply updates per vendor instructions.", ""], [939, "CVE-2016-6415", "Cisco", "IOS, IOS XR, and IOS XE", "Links here", "2023-05-19", "2023-06-09", "Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure.", "Apply updates per vendor instructions.", "

"], [940, "CVE-2023-21492", "Samsung", "Mobile Devices", "Links here", "2023-05-19", "2023-06-09", "Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass.", "Apply updates per vendor instructions.", "

"], [941, "CVE-2023-32409", "Apple Webkit", "Multiple Products", "Links here", "2023-05-22", "2023-06-12", "Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox.", "Apply updates per vendor instructions.", "

"], [942, "CVE-2023-28204", "Apple Webkit", "Multiple Products", "Links here", "2023-05-22", "2023-06-12", "Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information.", "Apply updates per vendor instructions.", "

"], [943, "CVE-2023-32373", "Apple Webkit", "Multiple Products", "Links here", "2023-05-22", "2023-06-12", "Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution.", "Apply updates per vendor instructions.", "

"], [944, "CVE-2023-2868", "Barracuda Networks", "Email Security Gateway (ESG) Appliance", "Links here", "2023-05-26", "2023-06-16", "Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection.", "Apply updates per vendor instructions.", "

"], [945, "CVE-2023-28771", "Zyxel", "Multiple Firewalls", "Links here", "2023-05-31", "2023-06-21", "Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device.", "Apply updates per vendor instructions.", "

"], [946, "CVE-2023-34362", "Progress", "MOVEit Transfer", "Links here", "2023-06-02", "2023-06-23", "Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.", "Apply updates per vendor instructions.", "

"], [947, "CVE-2023-33009", "Zyxel", "Multiple Firewalls", "Links here", "2023-06-05", "2023-06-26", "Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.", "Apply updates per vendor instructions.", "

"], [948, "CVE-2023-33010", "Zyxel", "Multiple Firewalls", "Links here", "2023-06-05", "2023-06-26", "Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.", "Apply updates per vendor instructions.", "

"], [949, "CVE-2023-3079", "Google", "Chromium V8 Engine", "Links here", "2023-06-07", "2023-06-28", "Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply updates per vendor instructions.", "

"], [950, "CVE-2023-27997", "Fortinet", "FortiOS and FortiProxy SSL-VPN", "Links here", "2023-06-13", "2023-07-04", "Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.", "Apply updates per vendor instructions.", "

"], [951, "CVE-2023-20887", "VMware", "Aria Operations for Networks", "Links here", "2023-06-22", "2023-07-13", "VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.", "Apply updates per vendor instructions.", "

"], [952, "CVE-2020-35730", "Roundcube", "Roundcube Webmail", "Links here", "2023-06-22", "2023-07-13", "Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.", "Apply updates per vendor instructions.", "

"], [953, "CVE-2020-12641", "Roundcube", "Roundcube Webmail", "Links here", "2023-06-22", "2023-07-13", "Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.", "Apply updates per vendor instructions.", "

"], [954, "CVE-2021-44026", "Roundcube", "Roundcube Webmail", "Links here", "2023-06-22", "2023-07-13", "Roundcube Webmail is vulnerable to SQL injection via search or search_params.", "Apply updates per vendor instructions.", "

"], [955, "CVE-2016-9079", "Mozilla", "Firefox, Firefox ESR, and Thunderbird", "Links here", "2023-06-22", "2023-07-13", "Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.", "Apply updates per vendor instructions.", "

"], [956, "CVE-2016-0165", "Microsoft", "Win32k", "Links here", "2023-06-22", "2023-07-13", "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions.", "

"], [957, "CVE-2023-32434", "Apple", "Multiple Products", "Links here", "2023-06-23", "2023-07-14", "Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.", "Apply updates per vendor instructions.", "

"], [958, "CVE-2023-32435", "Apple", "iOS and macOS", "Links here", "2023-06-23", "2023-07-14", "Apple iOS and iPadOS WebKit contain a memory corruption vulnerability that leads to code execution when processing web content.", "Apply updates per vendor instructions.", "

"], [959, "CVE-2023-32439", "Apple", "Multiple Products", "Links here", "2023-06-23", "2023-07-14", "Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content.", "Apply updates per vendor instructions.", "

"], [960, "CVE-2023-20867", "VMware", "Tools", "Links here", "2023-06-23", "2023-07-14", "VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.", "Apply updates per vendor instructions.", "

"], [961, "CVE-2023-27992", "Zyxel", "Multiple Network-Attached Storage (NAS) Devices", "Links here", "2023-06-23", "2023-07-14", "Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.", "Apply updates per vendor instructions.", "

"], [962, "CVE-2019-17621", "D-Link", "DIR-859 Router", "Links here", "2023-06-29", "2023-07-20", "D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable", "

"], [963, "CVE-2019-20500", "D-Link", "DWL-2600AP Access Point", "Links here", "2023-06-29", "2023-07-20", "D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable", "

"], [964, "CVE-2021-25487", "Samsung", "Mobile Devices", "Links here", "2023-06-29", "2023-07-20", "Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable", "

"], [965, "CVE-2021-25489", "Samsung", "Mobile Devices", "Links here", "2023-06-29", "2023-07-20", "Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable", "

"], [966, "CVE-2021-25394", "Samsung", "Mobile Devices", "Links here", "2023-06-29", "2023-07-20", "Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable", "

"], [967, "CVE-2021-25395", "Samsung", "Mobile Devices", "Links here", "2023-06-29", "2023-07-20", "Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable", "

"], [968, "CVE-2021-25371", "Samsung", "Mobile Devices", "Links here", "2023-06-29", "2023-07-20", "Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable", "

"], [969, "CVE-2021-25372", "Samsung", "Mobile Devices", "Links here", "2023-06-29", "2023-07-20", "Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable", "

"], [970, "CVE-2021-29256", "Arm", "Mali Graphics Processing Unit (GPU)", "Links here", "2023-07-07", "2023-07-28", "Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.", "

"], [971, "CVE-2023-32046", "Microsoft", "Windows MSHTML Platform", "Links here", "2023-07-11", "2023-08-01", "Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.", "

"], [972, "CVE-2023-32049", "Microsoft", "Windows Defender SmartScreen", "Links here", "2023-07-11", "2023-08-01", "Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.", "

"], [973, "CVE-2023-35311", "Microsoft", "Outlook", "Links here", "2023-07-11", "2023-08-01", "Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.", "

"], [974, "CVE-2023-36874", "Microsoft", "Windows Error Reporting Service", "Links here", "2023-07-11", "2023-08-01", "Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.", "

"], [975, "CVE-2022-31199", "Netwrix", "Auditor", "Links here", "2023-07-11", "2023-08-01", "Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\\SYSTEM user. Successful exploitation requires that the attacker to be able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.", "

"], [976, "CVE-2022-29303", "SolarView", "Compact", "Links here", "2023-07-13", "2023-08-03", "SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.", "

"], [977, "CVE-2023-37450", "Apple", "Multiple Products", "Links here", "2023-07-13", "2023-08-03", "Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that can allow an attacker to execute code when processing web content.", "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.", "

"], [978, "CVE-2023-36884", "Microsoft", "Office and Windows", "Links here", "2023-07-17", "2023-08-07", "Microsoft Office and Windows contain an unspecified vulnerability that allows an attacker to perform remote code execution via a specially crafted Microsoft Office document.", "Follow \"CVE-2023-36884 Specific Recommendations\" per vendor instructions. [https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/]", "

"], [979, "CVE-2023-3519", "Citrix", "NetScaler ADC and NetScaler Gateway", "Links here", "2023-07-19", "2023-08-09", "Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [980, "CVE-2023-29298", "Adobe", "ColdFusion", "Links here", "2023-07-20", "2023-08-10", "Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [981, "CVE-2023-38205", "Adobe", "ColdFusion", "Links here", "2023-07-20", "2023-08-10", "Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [982, "CVE-2023-35078", "Ivanti", "Endpoint Manager Mobile", "Links here", "2023-07-25", "2023-08-15", "Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes, including creating an EPMM administrative account that can make further changes to a vulnerable system.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [983, "CVE-2023-38606", "Apple", "Multiple Products", "Links here", "2023-07-26", "2023-08-16", "Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify sensitive kernel state.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [984, "CVE-2023-37580", "Zimbra", "Collaboration (ZCS)", "Links here", "2023-07-27", "2023-08-17", "Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [985, "CVE-2023-35081", "Ivanti", "Endpoint Manager Mobile (EPMM)", "Links here", "2023-07-31", "2023-08-21", "Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078, bypassing administrator authentication and ACLs restrictions (if applicable).", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [986, "CVE-2017-18368", "Zyxel", "P660HN-T1A Routers", "Links here", "2023-08-07", "2023-08-28", "Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [987, "CVE-2023-38180", "Microsoft", ".NET Core and Visual Studio", "Links here", "2023-08-09", "2023-08-30", "Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial of service.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [988, "CVE-2023-24489", "Citrix", "Content Collaboration", "Links here", "2023-08-16", "2023-09-06", "Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [989, "CVE-2023-26359", "Adobe", "ColdFusion", "Links here", "2023-08-21", "2023-09-11", "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [990, "CVE-2023-38035", "Ivanti", "Sentry", "Links here", "2023-08-22", "2023-09-12", "Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [991, "CVE-2023-27532", "Veeam", "Backup & Replication", "Links here", "2023-08-22", "2023-09-12", "Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [992, "CVE-2023-38831", "RARLAB", "WinRAR", "Links here", "2023-08-24", "2023-09-14", "RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [993, "CVE-2023-32315", "Ignite Realtime", "Openfire", "Links here", "2023-08-24", "2023-09-14", "Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [994, "CVE-2023-33246", "Apache", "RocketMQ", "Links here", "2023-09-06", "2023-09-27", "Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [995, "CVE-2023-41064", "Apple", "iOS, iPadOS, and macOS", "Links here", "2023-09-11", "2023-10-02", "Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [996, "CVE-2023-41061", "Apple", "iOS, iPadOS, and watchOS", "Links here", "2023-09-11", "2023-10-02", "Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [997, "CVE-2023-36761", "Microsoft", "Word", "Links here", "2023-09-12", "2023-10-03", "Microsoft Word contains an unspecified vulnerability that allows for information disclosure.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [998, "CVE-2023-36802", "Microsoft", "Streaming Service Proxy", "Links here", "2023-09-12", "2023-10-03", "Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [999, "CVE-2023-35674", "Android", "Framework", "Links here", "2023-09-13", "2023-10-04", "Android Framework contains an unspecified vulnerability that allows for privilege escalation.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1000, "CVE-2023-20269", "Cisco", "Adaptive Security Appliance and Firepower Threat Defense", "Links here", "2023-09-13", "2023-10-04", "Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.", "Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.", "

"], [1001, "CVE-2023-4863", "Google", "Chromium", "Links here", "2023-09-13", "2023-10-04", "Google Chromium contains a heap-based buffer overflow vulnerability in WebP that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1002, "CVE-2022-22265", "Samsung", "Mobile Devices", "Links here", "2023-09-13", "2023-10-04", "Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1003, "CVE-2023-26369", "Adobe", "Acrobat and Reader", "Links here", "2023-09-14", "2023-10-05", "Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1004, "CVE-2014-8361", "Realtek", "SDK", "Links here", "2023-09-18", "2023-10-09", "Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1005, "CVE-2017-6884", "Zyxel", "EMG2926 Routers", "Links here", "2023-09-18", "2023-10-09", "Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1006, "CVE-2021-3129", "Laravel", "Ignition", "Links here", "2023-09-18", "2023-10-09", "Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1007, "CVE-2023-28434", "MinIO", "MinIO", "Links here", "2023-09-19", "2023-10-10", "MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1008, "CVE-2023-41179", "Trend Micro", "Apex One and Worry-Free Business Security", "Links here", "2023-09-21", "2023-10-12", "Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1009, "CVE-2023-41991", "Apple", "Multiple Products", "Links here", "2023-09-25", "2023-10-16", "Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1010, "CVE-2023-41992", "Apple", "Multiple Products", "Links here", "2023-09-25", "2023-10-16", "Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1011, "CVE-2023-41993", "Apple", "Multiple Products", "Links here", "2023-09-25", "2023-10-16", "Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that can allow an attacker to execute code when processing web content.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1012, "CVE-2018-14667", "Red Hat", "JBoss RichFaces Framework", "Links here", "2023-09-28", "2023-10-19", "Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1013, "CVE-2023-5217", "Google", "Chrome libvpx", "Links here", "2023-10-02", "2023-10-23", "Google Chrome libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1014, "CVE-2023-4211", "Arm", "Mali GPU Kernel Driver", "Links here", "2023-10-03", "2023-10-24", "Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1015, "CVE-2023-42793", "JetBrains", "TeamCity", "Links here", "2023-10-04", "2023-10-25", "JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1016, "CVE-2023-28229", "Microsoft", "Windows CNG Key Isolation Service", "Links here", "2023-10-04", "2023-10-25", "Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1017, "CVE-2023-22515", "Atlassian", "Confluence Data Center and Server", "Links here", "2023-10-05", "2023-10-13", "Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.", "

"], [1018, "CVE-2023-40044", "Progress", "WS_FTP Server", "Links here", "2023-10-05", "2023-10-26", "Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1019, "CVE-2023-42824", "Apple", "iOS and iPadOS", "Links here", "2023-10-05", "2023-10-26", "Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1020, "CVE-2023-21608", "Adobe", "Acrobat and Reader", "Links here", "2023-10-10", "2023-10-31", "Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1021, "CVE-2023-20109", "Cisco", "IOS and IOS XE", "Links here", "2023-10-10", "2023-10-31", "Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1022, "CVE-2023-41763", "Microsoft", "Skype for Business", "Links here", "2023-10-10", "2023-10-31", "Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1023, "CVE-2023-36563", "Microsoft", "WordPad", "Links here", "2023-10-10", "2023-10-31", "Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1024, "CVE-2023-44487", "IETF", "HTTP/2", "Links here", "2023-10-10", "2023-10-31", "HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1024, "CVE-2023-44487", "IETF", "HTTP/2", "Links here", "2023-10-10", "2023-10-31", "HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1025, "CVE-2023-20198", "Cisco", "IOS XE Web UI", "Links here", "2023-10-16", "2023-10-20", "Cisco IOS XE Web UI contains a privilege escalation vulnerability in the web user interface that could allow a remote, unauthenticated attacker to create an account with privilege level 15 access. The attacker can then use that account to gain control of the affected device.", "Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.", "

"], [1026, "CVE-2023-4966", "Citrix", "NetScaler ADC and NetScaler Gateway", "Links here", "2023-10-18", "2023-11-08", "Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for sensitive information disclosure when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.", "Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.", "

"], [1027, "CVE-2023-20273", "Cisco", "Cisco IOS XE Web UI", "Links here", "2023-10-23", "2023-10-27", "Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity.", "Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected products (Cisco IOS XE Web UI exposed to the internet or to untrusted networks), follow vendor instructions to determine if a system may have been compromised and immediately report positive findings to CISA.", "

"], [1028, "CVE-2023-5631", "Roundcube", "Webmail", "Links here", "2023-10-26", "2023-11-16", "Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1029, "CVE-2023-46748", "F5", "BIG-IP Configuration Utility", "Links here", "2023-10-31", "2023-11-21", "F5 BIG-IP Configuration utility contains an SQL injection vulnerability that may allow an authenticated attacker with network access through the BIG-IP management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46747.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1030, "CVE-2023-46747", "F5", "BIG-IP Configuration Utility", "Links here", "2023-10-31", "2023-11-21", "F5 BIG-IP Configuration utility contains an authentication bypass using an alternate path or channel vulnerability due to undisclosed requests that may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute system commands. This vulnerability can be used in conjunction with CVE-2023-46748.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1031, "CVE-2023-46604", "Apache", "ActiveMQ", "Links here", "2023-11-02", "2023-11-23", "Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1032, "CVE-2023-22518", "Atlassian", "Confluence Data Center and Server", "Links here", "2023-11-07", "2023-11-28", "Atlassian Confluence Data Center and Server contain an improper authorization vulnerability that can result in significant data loss when exploited by an unauthenticated attacker. There is no impact on confidentiality since the attacker cannot exfiltrate any data.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1033, "CVE-2023-29552", "IETF", "Service Location Protocol (SLP)", "Links here", "2023-11-08", "2023-11-29", "The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.", "Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.", "

"], [1033, "CVE-2023-29552", "IETF", "Service Location Protocol (SLP)", "Links here", "2023-11-08", "2023-11-29", "The Service Location Protocol (SLP) contains a denial-of-service (DoS) vulnerability that could allow an unauthenticated, remote attacker to register services and use spoofed UDP traffic to conduct a denial-of-service (DoS) attack with a significant amplification factor.", "Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.", "

"], [1034, "CVE-2023-47246", "SysAid", "SysAid Server", "Links here", "2023-11-13", "2023-12-04", "SysAid Server (on-premises version) contains a path traversal vulnerability that leads to code execution.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1035, "CVE-2023-36844", "Juniper", "Junos OS", "Links here", "2023-11-13", "2023-11-17", "Juniper Junos OS on EX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1036, "CVE-2023-36845", "Juniper", "Junos OS", "Links here", "2023-11-13", "2023-11-17", "Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1037, "CVE-2023-36846", "Juniper", "Junos OS", "Links here", "2023-11-13", "2023-11-17", "Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1038, "CVE-2023-36847", "Juniper", "Junos OS", "Links here", "2023-11-13", "2023-11-17", "Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1039, "CVE-2023-36851", "Juniper", "Junos OS", "Links here", "2023-11-13", "2023-11-17", "Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1040, "CVE-2023-36033", "Microsoft", "Windows", "Links here", "2023-11-14", "2023-12-05", "Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1041, "CVE-2023-36025", "Microsoft", "Windows", "Links here", "2023-11-14", "2023-12-05", "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1042, "CVE-2023-36036", "Microsoft", "Windows", "Links here", "2023-11-14", "2023-12-05", "Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1043, "CVE-2023-36584", "Microsoft", "Windows", "Links here", "2023-11-16", "2023-12-07", "Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1044, "CVE-2023-1671", "Sophos", "Web Appliance", "Links here", "2023-11-16", "2023-12-07", "Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1044, "CVE-2023-1671", "Sophos", "Web Appliance", "Links here", "2023-11-16", "2023-12-07", "Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1045, "CVE-2020-2551", "Oracle", "Fusion Middleware", "Links here", "2023-11-16", "2023-12-07", "Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1046, "CVE-2023-4911", "GNU", "GNU C Library", "Links here", "2023-11-21", "2023-12-12", "GNU C Library's dynamic loader ld.so contains a buffer overflow vulnerability when processing the GLIBC_TUNABLES environment variable, allowing a local attacker to execute code with elevated privileges.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1047, "CVE-2023-6345", "Google", "Skia", "Links here", "2023-11-30", "2023-12-21", "Google Skia contains an integer overflow vulnerability affecting Google Chrome and ChromeOS, Android, Flutter, and possibly other products.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1048, "CVE-2023-49103", "ownCloud", "ownCloud graphapi", "Links here", "2023-11-30", "2023-12-21", "ownCloud graphapi contains an information disclosure vulnerability that can reveal sensitive data stored in phpinfo() via GetPhpInfo.php, including administrative credentials.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1049, "CVE-2023-42917", "Apple", "Multiple Products", "Links here", "2023-12-04", "2023-12-25", "Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing web content.", "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.", "

"], [1049, "CVE-2023-42917", "Apple", "Multiple Products", "Links here", "2023-12-04", "2023-12-25", "Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing web content.", "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.", "

"], [1050, "CVE-2023-42916", "Apple", "Multiple Products", "Links here", "2023-12-04", "2023-12-25", "Apple iOS, iPadOS, macOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing web content.", "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.", "

"], [1051, "CVE-2023-33107", "Qualcomm", "Multiple Chipsets", "Links here", "2023-12-05", "2023-12-26", "Multiple Qualcomm chipsets contain an integer overflow vulnerability due to memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.", "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.", "

"], [1052, "CVE-2023-33106", "Qualcomm", "Multiple Chipsets", "Links here", "2023-12-05", "2023-12-26", "Multiple Qualcomm chipsets contain a use of out-of-range pointer offset vulnerability due to memory corruption in Graphics while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.", "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.", "

"], [1053, "CVE-2023-33063", "Qualcomm", "Multiple Chipsets", "Links here", "2023-12-05", "2023-12-26", "Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services during a remote call from HLOS to DSP.", "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.", "

"], [1054, "CVE-2022-22071", "Qualcomm", "Multiple Chipsets", "Links here", "2023-12-05", "2023-12-26", "Multiple Qualcomm chipsets contain a use-after-free vulnerability when process shell memory is freed using IOCTL munmap call and process initialization is in progress.", "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.", "

"], [1055, "CVE-2023-41266", "Qlik", "Sense", "Links here", "2023-12-07", "2023-12-28", "Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints.", "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.", "

"], [1056, "CVE-2023-41265", "Qlik", "Sense", "Links here", "2023-12-07", "2023-12-28", "Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.", "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.", "

"], [1057, "CVE-2023-6448", "Unitronics", "Vision PLC and HMI", "Links here", "2023-12-11", "2023-12-18", "Unitronics Vision Series PLCs and HMIs ship with an insecure default password, which if left unchanged, can allow attackers to execute remote commands.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1058, "CVE-2023-49897", "FXC", "AE1021, AE1021PE", "Links here", "2023-12-21", "2024-01-11", "FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1059, "CVE-2023-47565", "QNAP", "VioStor NVR", "Links here", "2023-12-21", "2024-01-11", "QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", ""], [1060, "CVE-2023-7101", "Spreadsheet::ParseExcel", "Spreadsheet::ParseExcel", "Links here", "2024-01-02", "2024-01-23", "Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type \u201ceval\u201d. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1061, "CVE-2023-7024", "Google Chromium", "WebRTC", "Links here", "2024-01-02", "2024-01-23", "Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to cause crashes or code execution. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1062, "CVE-2023-23752", "Joomla!", "Joomla!", "Links here", "2024-01-08", "2024-01-29", "Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1063, "CVE-2016-20017", "D-Link", "DSL-2750B Devices", "Links here", "2024-01-08", "2024-01-29", "D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1064, "CVE-2023-41990", "Apple", "Multiple Products", "Links here", "2024-01-08", "2024-01-29", "Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1065, "CVE-2023-27524", "Apache", "Superset", "Links here", "2024-01-08", "2024-01-29", "Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1066, "CVE-2023-29300", "Adobe", "ColdFusion", "Links here", "2024-01-08", "2024-01-29", "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1067, "CVE-2023-38203", "Adobe", "ColdFusion", "Links here", "2024-01-08", "2024-01-29", "Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1068, "CVE-2023-29357", "Microsoft", "SharePoint Server", "Links here", "2024-01-10", "2024-01-31", "Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1069, "CVE-2023-46805", "Ivanti", "Connect Secure and Policy Secure", "Links here", "2024-01-10", "2024-01-31", "Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1070, "CVE-2024-21887", "Ivanti", "Connect Secure and Policy Secure", "Links here", "2024-01-10", "2024-01-31", "Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1071, "CVE-2018-15133", "Laravel", "Laravel Framework", "Links here", "2024-01-16", "2024-02-06", "Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable).", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1072, "CVE-2024-0519", "Google", "Chromium V8", "Links here", "2024-01-17", "2024-02-07", "Google Chromium V8 contains an out-of-bounds memory access vulnerability. Specific impacts from exploitation are not available at this time.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1073, "CVE-2023-6549", "Citrix", "NetScaler ADC and NetScaler Gateway", "Links here", "2024-01-17", "2024-02-07", "Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1074, "CVE-2023-6548", "Citrix", "NetScaler ADC and NetScaler Gateway", "Links here", "2024-01-17", "2024-01-24", "Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1075, "CVE-2023-35082", "Ivanti", "Endpoint Manager Mobile (EPMM) and MobileIron Core", "Links here", "2024-01-18", "2024-02-08", "Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1076, "CVE-2023-34048", "VMware", "vCenter Server", "Links here", "2024-01-22", "2024-02-12", "VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1077, "CVE-2024-23222", "Apple", "Multiple Products", "Links here", "2024-01-23", "2024-02-13", "Apple iOS, iPadOS, macOS, and tvOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1078, "CVE-2023-22527", "Atlassian", "Confluence Data Center and Server", "Links here", "2024-01-24", "2024-02-14", "Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1079, "CVE-2022-48618", "Apple", "Multiple Products", "Links here", "2024-01-31", "2024-02-21", "Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an improper authentication vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1080, "CVE-2024-21893", "Ivanti", "Connect Secure, Policy Secure, and Neurons", "Links here", "2024-01-31", "2024-02-02", "Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1081, "CVE-2023-4762", "Google", "Chromium V8 Engine", "Links here", "2024-02-06", "2024-02-27", "Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1082, "CVE-2024-21762", "Fortinet", "FortiOS", "Links here", "2024-02-09", "2024-02-16", "Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1083, "CVE-2023-43770", "Roundcube", "Webmail", "Links here", "2024-02-12", "2024-03-04", "Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1084, "CVE-2024-21412", "Microsoft", "Windows", "Links here", "2024-02-13", "2024-03-05", "Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1085, "CVE-2024-21351", "Microsoft", "Windows", "Links here", "2024-02-13", "2024-03-05", "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1086, "CVE-2020-3259", "Cisco", "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)", "Links here", "2024-02-15", "2024-03-07", "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1087, "CVE-2024-21410", "Microsoft", "Exchange Server", "Links here", "2024-02-15", "2024-03-07", "Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1088, "CVE-2024-1709", "ConnectWise", "ScreenConnect", "Links here", "2024-02-22", "2024-02-29", "ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1089, "CVE-2023-29360", "Microsoft", "Streaming Service", "Links here", "2024-02-29", "2024-03-21", "Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1090, "CVE-2024-21338", "Microsoft", "Windows", "Links here", "2024-03-04", "2024-03-25", "Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1091, "CVE-2023-21237", "Android", "Pixel", "Links here", "2024-03-05", "2024-03-26", "Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1092, "CVE-2021-36380", "Sunhillo", "SureLine", "Links here", "2024-03-05", "2024-03-26", "Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1093, "CVE-2024-23225", "Apple", "iOS and iPadOS", "Links here", "2024-03-06", "2024-03-27", "Apple iOS and iPadOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1094, "CVE-2024-23296", "Apple", "iOS and iPadOS", "Links here", "2024-03-06", "2024-03-27", "Apple iOS and iPadOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1095, "CVE-2024-27198", "JetBrains", "TeamCity", "Links here", "2024-03-07", "2024-03-28", "JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1096, "CVE-2019-7256", "Nice", "Linear eMerge E3-Series", "Links here", "2024-03-25", "2024-04-15", "Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution.", "Contact the vendor for guidance on remediating firmware, per their advisory.", "

"], [1097, "CVE-2021-44529", "Ivanti", "Endpoint Manager Cloud Service Appliance (EPM CSA)", "Links here", "2024-03-25", "2024-04-15", "Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody).", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1098, "CVE-2023-48788", "Fortinet", "FortiClient EMS", "Links here", "2024-03-25", "2024-04-15", "Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1099, "CVE-2023-24955", "Microsoft", "SharePoint Server", "Links here", "2024-03-26", "2024-04-16", "Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1100, "CVE-2024-29748", "Android", "Pixel", "Links here", "2024-04-04", "2024-04-25", "Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1101, "CVE-2024-29745", "Android", "Pixel", "Links here", "2024-04-04", "2024-04-25", "Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1102, "CVE-2024-3273", "D-Link", "Multiple NAS Devices", "Links here", "2024-04-11", "2024-05-02", "D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.", "This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "

"], [1103, "CVE-2024-3272", "D-Link", "Multiple NAS Devices", "Links here", "2024-04-11", "2024-05-02", "D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.", "This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "

"], [1104, "CVE-2024-3400", "Palo Alto Networks", "PAN-OS", "Links here", "2024-04-12", "2024-04-19", "Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.", "Users of affected devices should enable Threat Prevention Threat ID 95187 if that is available, otherwise, disable device telemetry until patches are available from the vendor, per vendor instructions.", "

"], [1105, "CVE-2022-38028", "Microsoft", "Windows", "Links here", "2024-04-23", "2024-05-14", "Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1106, "CVE-2024-4040", "CrushFTP", "CrushFTP", "Links here", "2024-04-24", "2024-05-01", "CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1107, "CVE-2024-20359", "Cisco", "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)", "Links here", "2024-04-24", "2024-05-01", "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a privilege escalation vulnerability that can allow local privilege escalation from Administrator to root.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1108, "CVE-2024-20353", "Cisco", "Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)", "Links here", "2024-04-24", "2024-05-01", "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an infinite loop vulnerability that can lead to remote denial of service condition.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1109, "CVE-2024-29988", "Microsoft", "SmartScreen Prompt", "Links here", "2024-04-30", "2024-05-21", "Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1110, "CVE-2023-7028", "GitLab", "GitLab CE/EE", "Links here", "2024-05-01", "2024-05-22", "GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1111, "CVE-2024-4671", "Google", "Chromium", "Links here", "2024-05-13", "2024-06-03", "Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1112, "CVE-2024-30040", "Microsoft", "Windows", "Links here", "2024-05-14", "2024-06-04", "Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1113, "CVE-2024-30051", "Microsoft", "DWM Core Library", "Links here", "2024-05-14", "2024-06-04", "Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1114, "CVE-2024-4761", "Google", "Chromium Visuals", "Links here", "2024-05-16", "2024-06-06", "Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. ", "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "

"], [1115, "CVE-2021-40655", "D-Link", "DIR-605 Router", "Links here", "2024-05-16", "2024-06-06", "D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page. ", "This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "

"], [1116, "CVE-2014-100005", "D-Link", "DIR-600 Router", "Links here", "2024-05-16", "2024-06-06", "D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session.", "This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.", "

"]]

CVE ID:
Vendor:
Product:
Links:
Description:

CISA CVEs