KEV 2019

Ruby on Rails — Action View Accept-Header Path Traversal Discloses Arbitrary Server Files

Zimbra Collaboration Suite — SSRF via ProxyServlet, Chained with XXE for Full Server Compromise

Sitecore XP — Low-Privilege Companion Deserialization RCE, Same AntiCSRF Module as CVE-2019-9874

Authenticated command injection in Reolink camera email-test feature, now affecting end-of-life models

D-Link DWL-2600AP — Authenticated Command Injection via Configuration Backup/Restore

Apple macOS — Local Use-After-Free Enabling Privilege Escalation

Windows UAC Certificate Viewer — Privilege Escalation via Elevated Dialog Abuse

Cisco RV Series Routers — Authenticated Deserialization Flaw Enabling Root Code Execution

Apple iOS/macOS/tvOS/watchOS — Malicious App Use-After-Free Escalating to System Privileges

Oracle Solaris — Local Privilege Escalation via the XScreenSaver Component

Firefox Array.pop type confusion — zero-day used against Coinbase employees, chained with a sandbox escape

Chrome WebAudio use-after-free — the zero-day behind Operation WizardOpium's Korean watering-hole attack

WebKitGTK — Memory Corruption in Malicious Web Content on Linux/GTK-Based Browsers

Apple WebKit — Type Confusion in Malicious Web Content Leading to Code Execution

WhatsApp Desktop Paired with iPhone — Cross-Site Scripting and Local File Read via Link Preview

splwow64.exe flaw letting sandboxed low-integrity code elevate to medium integrity

Windows AppX Deployment Service — a second hard-link race grants SYSTEM-level file access

Windows AppX Deployment Service — Local Privilege Escalation via Hard Link Abuse

Apple iOS/macOS/watchOS/tvOS — Memory Corruption Used in NSO Group's 'Kismet' Zero-Click iMessage Exploit Chain

Apple iOS — Memory Corruption Fixed in the Same December 2019 Update Batch as the 'Kismet' Exploit Bug

GDI memory-handling flaw enabling code execution via a crafted document or font

Citrix SD-WAN / NetScaler SD-WAN — low-privileged command injection in the appliance management interface

Microsoft Excel — a malicious spreadsheet triggers memory corruption for code execution in the context of the victim

PHP-FPM — Nginx path_info underflow leads to unauthenticated remote code execution

Drupal Core — REST Module Deserialization Flaw Enables PHP Code Execution

Windows authentication flaw letting a local attacker run code in an elevated context

AppXSVC hard-link race condition letting a local attacker overwrite protected files as SYSTEM

Follow-up fix for the AppXSVC hard-link EoP after the initial April 2019 patch was bypassed

Task Scheduler file-validation flaw letting a local attacker elevate to SYSTEM

Windows AppXSVC — hard-link abuse lets a low-privileged process overwrite arbitrary files as SYSTEM

Windows Win32k — kernel callback memory-handling flaw exploited as an in-the-wild zero-day

Windows AppX Deployment Server — junction-following flaw grants SYSTEM-level file access to a local user

Windows Error Reporting — hard-link abuse in the crash-reporting service escalates a local user to SYSTEM

Windows — improper handling of authentication requests lets a local low-privileged user reach SYSTEM

Windows UPnP Service — Local Privilege Escalation via Insecure COM Object Instantiation

SonicWall SMA100 — Unauthenticated Directory Traversal via handleWAFRedirect CGI

Oracle BI Publisher — Unauthenticated Access Bypass in a Widely Deployed Reporting Engine

Cisco RV320/RV325 Routers — Authenticated Command Injection via Web Management Interface

IE scripting-engine type confusion enabling remote code execution via a crafted web page

PAN-OS GlobalProtect Portal/Gateway — Pre-Authentication Format String Remote Code Execution

Windows Win32k — Privilege Escalation Used to Escape Browser Sandboxes in Operation WizardOpium

Linux kernel ptrace — a credential race lets a traced process inherit its tracer's elevated privileges

Apache Solr DataImportHandler — Code Injection via Attacker-Controlled dataConfig Parameter

MSHTML memory-corruption flaw allowing code execution via malicious content rendering

Nagios XI — Authenticated Root Command Execution via check_plugin Executable Tampering

Firefox/Thunderbird IonMonkey JIT — Type Confusion Zero-Day Exploited in Targeted Attacks

Atlassian Confluence — Authenticated downloadallattachments Path Traversal Enables File Write / RCE

ThinkPHP 5.x — Unauthenticated RCE via Method-Invocation Abuse, Mass-Exploited for Years

Apache httpd MPM — Worker Process Scoreboard Manipulation Enables Root Privilege Escalation

Win32k kernel memory-handling flaw exploited as a zero-day for local privilege escalation

Win32k kernel object-handling flaw enabling local privilege escalation to SYSTEM

Win32k zero-day chained with a Chrome renderer bug to escape the browser sandbox

Win32k use-after-free exploited in the wild as a kernel privilege-escalation zero-day

WER file-handling flaw letting a local attacker corrupt protected files to gain SYSTEM

Windows CLFS driver — kernel memory-handling flaw in the log-file-system driver escalates a local user to SYSTEM

Windows ws2ifsl.sys (Winsock) — a publicly-dropped local privilege escalation zero-day dubbed AngryPolarBearBug2

Docker Desktop Community Edition — Local Privilege Escalation via Trojanized Credential Helper Binary

Android Kernel — Binder Use-After-Free 0-Day Exploited by NSO Group

Citrix StoreFront — unauthenticated XXE processing exposes sensitive server-side files and data

Internet Explorer scripting engine — actively-exploited zero-day patched via emergency out-of-band update

Internet Explorer Scripting Engine — Use-After-Free Remote Code Execution via Malicious Web Content

Cisco RV320/RV325 Routers — Unauthenticated Configuration and Diagnostic Data Disclosure

Apache Solr VelocityResponseWriter — Server-Side Template Injection Leading to Remote Code Execution

Trend Micro OfficeScan — Unauthenticated Path Traversal via Zip Extraction Exposes Server Credentials and Configuration Files

Netis WF2419 Router — Web Management Interface Command Injection Grants Root

TVT NVMS-1000 — Unauthenticated Directory Traversal in White-Labeled DVR/NVR Firmware

Apple Group FaceTime — Caller Can Force Callee's Device to Answer and Transmit Audio/Video

SonicWall SMA100 — Pre-Auth SQL Injection Enabling Unauthorized Data Access, Tied to Ransomware Intrusions

Pulse Connect/Policy Secure — authenticated admin console command injection, often chained after credential theft via CVE-2019-11510

TeamViewer Desktop — Shared AES Key Across Installations Exposes Unattended Access Credentials