The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2016-3976 | UNKNOWN | — | SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files. | Nov 3, 2021 |
| CVE-2020-3950 | UNKNOWN | — | VMware Fusion, Remote Console (VMRC) for Mac, and Horizon Client for Mac contain a privilege escalation vulnerability due to improper use of setuid binaries that allows attackers to escalate privileges to root. | Nov 3, 2021 |
| CVE-2020-10148 | UNKNOWN | — | SolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands. | Nov 3, 2021 |
| CVE-2021-35211 | UNKNOWN | — | SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution. | Nov 3, 2021 |
| CVE-2016-3643 | UNKNOWN | — | SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo. | Nov 3, 2021 |
| CVE-2020-10199 | UNKNOWN | — | Sonatype Nexus Repository contains an unspecified vulnerability that allows for remote code execution. | Nov 3, 2021 |
| CVE-2020-5847 | UNKNOWN | — | Unraid contains a vulnerability due to the insecure use of the extract PHP function that can be abused to execute remote code as root. This CVE is chainable with CVE-2020-5849 for initial access. | Nov 3, 2021 |
| CVE-2020-8467 | UNKNOWN | — | Trend Micro Apex One and OfficeScan contain an unspecified vulnerability within a migration tool component that allows for remote code execution. | Nov 3, 2021 |
| CVE-2021-31755 | UNKNOWN | — | Tenda AC11 devices contain a stack buffer overflow vulnerability in /goform/setmac which allows attackers to execute code via a crafted post request. | Nov 3, 2021 |
| CVE-2020-4428 | UNKNOWN | — | IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.� | Nov 3, 2021 |
| CVE-2021-30563 | UNKNOWN | — | Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Nov 3, 2021 |
| CVE-2021-21193 | UNKNOWN | — | Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Nov 3, 2021 |
| CVE-2021-21148 | UNKNOWN | — | Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Nov 3, 2021 |
| CVE-2020-16013 | UNKNOWN | — | Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Nov 3, 2021 |
| CVE-2018-13379 | UNKNOWN | — | Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests. | Nov 3, 2021 |
| CVE-2020-12812 | UNKNOWN | — | Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username. | Nov 3, 2021 |
| CVE-2020-5902 | UNKNOWN | — | F5 BIG-IP Traffic Management User Interface (TMUI) contains a remote code execution vulnerability in undisclosed pages. | Nov 3, 2021 |
| CVE-2020-8655 | UNKNOWN | — | EyesOfNetwork contains an improper privilege management vulnerability that may allow a user to run commands as root via a crafted Nmap Scripting Engine (NSE) script to nmap7. | Nov 3, 2021 |
| CVE-2020-8657 | UNKNOWN | — | EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token. | Nov 3, 2021 |
| CVE-2018-6789 | UNKNOWN | — | Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution. | Nov 3, 2021 |
| CVE-2021-38000 | UNKNOWN | — | Google Chromium Intents contains an improper input validation vulnerability that allows a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Nov 3, 2021 |
| CVE-2021-20023 | UNKNOWN | — | SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20021 and CVE-2021-20022 to achieve privilege escalation. | Nov 3, 2021 |
| CVE-2021-37973 | UNKNOWN | — | Google Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge. | Nov 3, 2021 |
| CVE-2019-9978 | UNKNOWN | — | WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro. | Nov 3, 2021 |
| CVE-2019-7481 | UNKNOWN | — | SonicWall SMA100 contains a SQL injection vulnerability allowing an unauthenticated user to gain read-only access to unauthorized resources. | Nov 3, 2021 |