KEV 2014

GNU Bash — Shellshock Variant: Additional Environment Variable Injection Code Path Still Exploitable After Patches 25–26

Adobe Flash Player — Operation GreedyWonk: Zero-Day Double Free Used in Watering Hole Attacks Against Defense Think Tanks

D-Link DIR-600 — No-Auth CSRF Allows Hijacking Admin Session to Change DNS, Firewall Rules, and Router Configuration

Internet Explorer — Zone Elevation Sandbox Escape Enables Privilege Escalation from Protected Mode; Patched MS14-051

Internet Explorer — Zone/Sandbox Privilege Escalation via Crafted Web Site; Sandbox Escape Component in Exploit Chains; Patched MS14-056

Windows Win32k TrueType Font — Zero-Day Kernel Font Parsing RCE via Malicious Office Documents; Paired with CVE-2014-4113 in APT Campaigns

Adobe Flash Player — Dereferenced Pointer in SWF Parsing Enables Remote Code Execution; Patched APSB14-26 (November 2014); Flash EOL December 2020

Internet Explorer 9/10 — Operation SnowMan: VBScript Use-After-Free Enables Drive-By RCE Against US Military Sites

Linux Kernel — 'Towelroot': futex_requeue() Privilege Escalation Enables One-Click Android Root and Linux Kernel Exploit

Windows IME Japanese — IMJPDCT.EXE Sandbox Escape Enables Privilege Escalation from IE Enhanced Protected Mode; Patched MS14-078

Windows Win32k — Zero-Day Local Privilege Escalation Paired with IE/Flash RCE in APT Campaigns; Patched MS14-058

OpenSSL 'Heartbleed' — TLS Heartbeat Extension Bounds Check Missing Allows Server Memory Read Without Authentication

Adobe Flash Player — Stack Buffer Overflow in SWF Handling Enables Code Execution; Patched APSB14-27 (December 2014); Flash EOL December 2020

Windows Kerberos KDC — MS14-068: Any Domain User Can Forge a Kerberos PAC Claiming Domain Admin Membership

Windows OleAut32 — 'God Mode': VBScript SafeArray Memory Corruption in IE Enables Drive-By RCE Bypassing ASLR and DEP

Adobe Reader/Acrobat XI/X — JavaScript Engine Use-After-Free Allows Remote Code Execution via Malicious PDF

Elasticsearch — Default Dynamic Scripting Allows Unauthenticated MVEL/Java Code Execution via Search API

Windows OLE — 'Sandworm' Zero-Day: Remote OLE Package Loading via Office Files Enables RCE Without Code Execution Vulnerabilities

Ruby on Rails — Implicit Render Path Traversal Allows Arbitrary File Read via Crafted Action Name

Windows OLE — Sandworm Bypass: CVE-2014-4114 Patch Circumvented Within One Week; Second OLE RCE via Crafted OLE Object in Office Documents

Microsoft Word — Sandworm Team Zero-Day: RTF Parsing Memory Corruption Used in Spear-Phishing Against Ukraine and NATO Targets

Apple OS X / iOS / tvOS — IOHIDFamily Heap Overflow Enables Kernel Privilege Escalation; Local User to Root via Malicious App

Windows Active Directory GPP — Plaintext Admin Passwords in SYSVOL Encrypted with Microsoft-Published AES Key; Domain-Wide Credential Exposure