KEV 2024

Samsung MagicINFO 9 Server — Unauthenticated File Write to Remote Code Execution via Path Traversal

ConnectWise ScreenConnect — Zip Slip Path Traversal Enabling RCE as SYSTEM (SlashAndGrab)

JetBrains TeamCity — Pre-Auth Path Traversal Bypassing Authentication on Limited Admin Endpoints

SimpleHelp RMM — Admin Zip Slip Enables Arbitrary File Write and Remote Code Execution

TeamT5 ThreatSonar Anti-Ransomware — TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability

Citrix Session Recording — Citrix Session Recording Improper Privilege Management Vulnerability

Citrix Session Recording — Citrix Session Recording Deserialization of Untrusted Data Vulnerability

DrayTek Vigor Routers — DrayTek Vigor Routers OS Command Injection Vulnerability

Linux Kernel — Linux Kernel Out-of-Bounds Access Vulnerability

Linux Kernel — Linux Kernel Out-of-Bounds Read Vulnerability

NAKIVO Backup and Replication — NAKIVO Backup and Replication Absolute Path Traversal Vulnerability

Oracle Agile Product Lifecycle Management (PLM) — Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

Zyxel DSL CPE Devices — Zyxel DSL CPE OS Command Injection Vulnerability

Zyxel DSL CPE Devices — Zyxel DSL CPE OS Command Injection Vulnerability

Microsoft Partner Center — Microsoft Partner Center Improper Access Control Vulnerability

Linux Kernel — Linux Kernel Out-of-Bounds Write Vulnerability

SimpleHelp SimpleHelp — SimpleHelp Path Traversal Vulnerability

Microsoft .NET Framework — Microsoft .NET Framework Information Disclosure Vulnerability

Apache OFBiz — Apache OFBiz Forced Browsing Vulnerability

Mitel SIP Phones — Mitel SIP Phones Argument Injection Vulnerability

Microsoft Windows — Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

Microsoft Windows — Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

Zyxel Multiple Firewalls — Zyxel Multiple Firewalls Path Traversal Vulnerability

Adobe ColdFusion — Adobe ColdFusion Improper Access Control Vulnerability

Apple Multiple Products — Apple Multiple Products Code Execution Vulnerability

Microsoft Windows — Microsoft Windows Task Scheduler Privilege Escalation Vulnerability

Oracle Agile Product Lifecycle Management (PLM) — Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization Vulnerability

VMware vCenter Server — VMware vCenter Server Privilege Escalation Vulnerability

Palo Alto Networks Expedition — Palo Alto Networks Expedition OS Command Injection Vulnerability

Android Framework — Android Framework Privilege Escalation Vulnerability

Palo Alto Networks PAN-OS — Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

PTZOptics PT30X-SDI/NDI Cameras — PTZOptics PT30X-SDI/NDI Cameras OS Command Injection Vulnerability

Ivanti EPM — Unauthenticated SQL Injection Leading to Remote Code Execution via xp_cmdshell

Qualcomm Multiple Chipsets — Qualcomm Multiple Chipsets Use-After-Free Vulnerability

Microsoft Windows — Microsoft Windows Management Console Remote Code Execution Vulnerability

Microsoft SharePoint — Microsoft SharePoint Deserialization Vulnerability

Ivanti Cloud Services Appliance (CSA) — Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability

Microsoft Windows — Microsoft Windows Kernel TOCTOU Race Condition Vulnerability

Microsoft Windows — Microsoft Windows MSHTML Platform Spoofing Vulnerability

Microsoft Windows — Microsoft Windows Installer Improper Privilege Management Vulnerability

Kingsoft WPS Office — Kingsoft WPS Office Path Traversal Vulnerability

Microsoft Publisher — Microsoft Publisher Protection Mechanism Failure Vulnerability

Ivanti Cloud Services Appliance — Ivanti Cloud Services Appliance OS Command Injection Vulnerability

Google Chromium V8 — Google Chromium V8 Inappropriate Implementation Vulnerability

Microsoft Project — Microsoft Project Remote Code Execution Vulnerability

Microsoft Windows — Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability

Microsoft Windows — Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability

Android Kernel — Android Kernel Remote Code Execution Vulnerability

Microsoft Windows — Microsoft Windows Scripting Engine Memory Corruption Vulnerability

Versa Director — Versa Director Dangerous File Type Upload Vulnerability

Microsoft Windows — Microsoft Windows Kernel Privilege Escalation Vulnerability

SolarWinds Serv-U — SolarWinds Serv-U Path Traversal Vulnerability

Microsoft Windows — Microsoft Windows Hyper-V Privilege Escalation Vulnerability

Microsoft Windows — Microsoft Windows MSHTML Platform Spoofing Vulnerability

Microsoft Windows — Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability

Android Pixel — Android Pixel Privilege Escalation Vulnerability

Arm Mali GPU Kernel Driver — Arm Mali GPU Kernel Driver Use-After-Free Vulnerability

Google Chromium V8 — Google Chromium V8 Out-of-Bounds Memory Write Vulnerability

Microsoft Windows — Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability

Check Point Quantum Security Gateways — Check Point Quantum Security Gateways Information Disclosure Vulnerability

Justice AV Solutions Viewer — Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability

Linux Kernel nf_tables 'notselwyn' — Use-After-Free in Netfilter Verdict Handling Permits Local Privilege Escalation

Microsoft DWM Core Library — Microsoft DWM Core Library Privilege Escalation Vulnerability

Microsoft SmartScreen Prompt — Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) — Cisco ASA and FTD Denial of Service Vulnerability

Android Pixel — Android Pixel Privilege Escalation Vulnerability

D-Link Multiple NAS Devices — D-Link Multiple NAS Devices Command Injection Vulnerability

Apple Multiple Products — Apple Multiple Products Memory Corruption Vulnerability

Apple Multiple Products — Apple Multiple Products Memory Corruption Vulnerability

Microsoft Windows — Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

Microsoft Windows — Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability

Microsoft Windows — Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Apple Multiple Products — Apple Multiple Products WebKit Type Confusion Vulnerability

Google Chromium V8 — Google Chromium V8 Out-of-Bounds Memory Access Vulnerability

Ivanti Connect Secure, Policy Secure, and Neurons — Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability