The KEV catalog lists vulnerabilities that are known to be actively exploited in the wild. Federal agencies are required to remediate these on defined deadlines.
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2020-10221 | UNKNOWN | — | rConfig lib/ajaxHandlers/ajaxAddTemplate.php contains an OS command injection vulnerability that allows remote attackers to execute OS commands via shell metacharacters in the fileName POST parameter. | Nov 3, 2021 |
| CVE-2019-1214 | UNKNOWN | — | Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation. | Nov 3, 2021 |
| CVE-2019-0859 | UNKNOWN | — | Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode. | Nov 3, 2021 |
| CVE-2021-22502 | UNKNOWN | — | Micro Focus Operation Bridge Report (OBR) contains an unspecified vulnerability that allows for remote code execution. | Nov 3, 2021 |
| CVE-2021-22506 | UNKNOWN | — | Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used. | Nov 3, 2021 |
| CVE-2021-37976 | UNKNOWN | — | Google Chromium contains an information disclosure vulnerability within the core memory component that allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Nov 3, 2021 |
| CVE-2020-16009 | UNKNOWN | — | Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Nov 3, 2021 |
| CVE-2018-18325 | UNKNOWN | — | DotNetNuke (DNN) contains an inadequate encryption strength vulnerability resulting from the use of a weak encryption algorithm to protect input parameters. This CVE ID resolves an incomplete patch for CVE-2018-15811. | Nov 3, 2021 |
| CVE-2020-3569 | UNKNOWN | — | Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash. | Nov 3, 2021 |
| CVE-2021-1498 | UNKNOWN | — | Cisco HyperFlex HX Installer Virtual Machine contains an insufficient input validation vulnerability which could allow an attacker to execute commands on an affected device as the tomcat8 user. | Nov 3, 2021 |
| CVE-2019-6223 | UNKNOWN | — | Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction. | Nov 3, 2021 |
| CVE-2020-0041 | UNKNOWN | — | Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain "AbstractEmu." | Nov 3, 2021 |
| CVE-2019-2215 | UNKNOWN | — | Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain "AbstractEmu." | Nov 3, 2021 |
| CVE-2018-4878 | UNKNOWN | — | Adobe Flash Player contains a use-after-free vulnerability that could allow for code execution. | Nov 3, 2021 |
| CVE-2018-15961 | UNKNOWN | — | Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution. | Nov 3, 2021 |
| CVE-2018-4939 | UNKNOWN | — | Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution. | Nov 3, 2021 |
| CVE-2021-21017 | UNKNOWN | — | Acrobat Acrobat and Reader contain a heap-based buffer overflow vulnerability that could allow an unauthenticated attacker to achieve code execution in the context of the current user. | Nov 3, 2021 |
| CVE-2021-30633 | UNKNOWN | — | Google Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Nov 3, 2021 |
| CVE-2021-27103 | UNKNOWN | — | Accellion FTA contains a server-side request forgery (SSRF) vulnerability exploited via a crafted POST request to wmProgressstat.html. | Nov 3, 2021 |
| CVE-2021-27101 | UNKNOWN | — | Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html. | Nov 3, 2021 |
| CVE-2021-27102 | UNKNOWN | — | Accellion FTA contains an OS command injection vulnerability exploited via a local web service call. | Nov 3, 2021 |
| CVE-2021-27104 | UNKNOWN | — | Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints. | Nov 3, 2021 |
| CVE-2017-8759 | UNKNOWN | — | Microsoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system. | Nov 3, 2021 |
| CVE-2019-0541 | UNKNOWN | — | Microsoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability. | Nov 3, 2021 |
| CVE-2019-0604 | UNKNOWN | — | Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account. | Nov 3, 2021 |