CVE Intelligence
Home / CVEs

Exploited vulnerabilities (CISA KEV)

CVEs with exploitation confirmed by CISA (Known Exploited Vulnerabilities), with required actions and deadlines.

Severity
Clear

11 result(s)

Export this search: RSS · CSV · STIX
CVE-2021-44077 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-306 Nov 29, 2021
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
CVE-2021-38003 High · 8.8 KEV High · 62 Public exploit CWE-755 Nov 23, 2021
Google Chromium V8 Memory Corruption Vulnerability
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-38000 Medium · 6.1 KEV High · 52 CWE-601 Nov 23, 2021
Google Chromium Intents Improper Input Validation Vulnerability
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a crafted HTML page.
CVE-2021-44026 Critical · 9.8 KEV High · 69 Public exploit CWE-89 Nov 19, 2021
Roundcube Webmail SQL Injection Vulnerability
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
CVE-2021-41277 High · 7.5 KEV High · 69 Public exploit CWE-200 Nov 17, 2021
Metabase GeoJSON API Local File Inclusion Vulnerability
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
CVE-2021-42321 High · 8.8 KEV Urgent · 84 Public exploit Ransomware Nov 9, 2021
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-42292 High · 7.8 KEV High · 62 Public exploit Nov 9, 2021
Microsoft Excel Security Feature Bypass
Microsoft Excel Security Feature Bypass Vulnerability
CVE-2021-42287 High · 7.5 KEV Urgent · 72 Public exploit Ransomware Nov 9, 2021
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2021-42278 High · 7.5 KEV Urgent · 72 Public exploit Ransomware Nov 9, 2021
Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2021-41379 Medium · 5.5 KEV High · 63 Ransomware CWE-59 Nov 9, 2021
Microsoft Windows Installer Privilege Escalation Vulnerability
Windows Installer Elevation of Privilege Vulnerability
CVE-2021-42237 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-502 Nov 5, 2021
Sitecore XP Remote Command Execution Vulnerability
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.