AI
Product
Active IQ Unified Manager
On CISA KEVExploited in the wildRansomware-linked
848
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 54High 179Medium 267Low 0
Watch
Add Active IQ Unified Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-44228 RansomwareIn wildKEV | 10.0 | Dec 10 | Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints Affected: All versions, or not specified |
| CVE-2023-41993 In wildKEV | 8.8 | Sep 21 | Apple Multiple Products WebKit Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2023-4863 In wildKEV | 8.8 | Sep 12 | Google Chromium WebP Heap-Based Buffer Overflow Vulnerability Affected: All versions, or not specified |
| CVE-2018-11776 In wildKEV | 8.1 | Aug 22 | Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like… Affected: 7.3 and later; 9.5 and later |
| CVE-2017-12617 In wildKEV | 8.1 | Oct 3 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g Affected: 7.3 and later; 9.5 and later |
| CVE-2021-3156 In wildKEV | 7.8 | Jan 26 | Sudo Heap-Based Buffer Overflow Vulnerability Affected: All versions, or not specified |
| CVE-2019-13272 In wildKEV | 7.8 | Jul 17 | Linux Kernel Improper Privilege Management Vulnerability Affected: All versions, or not specified |
| CVE-2025-0411 In wildKEV | 7.0 | Jan 25 | 7-Zip Mark-of-the-Web Bypass Vulnerability Affected: All versions, or not specified |
| CVE-2020-11023 In wildKEV | 6.1 | Apr 29 | Potential XSS vulnerability in jQuery Affected: All versions, or not specified |
| CVE-2024-56171 | 9.8 | Feb 18 | libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c Affected: All versions, or not specified |
| CVE-2024-52533 | 9.8 | Nov 11 | gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character Affected: All versions, or not specified |
| CVE-2023-38545 | 9.8 | Oct 18 | This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake Affected: All versions, or not specified |
| CVE-2021-32292 | 9.8 | Aug 22 | An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726 Affected: All versions, or not specified |
| CVE-2023-37920 | 9.8 | Jul 25 | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts Affected: All versions, or not specified |
| CVE-2022-31692 | 9.8 | Oct 31 | Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types Affected: All versions, or not specified |
| CVE-2022-2526 | 9.8 | Sep 9 | A use-after-free vulnerability was found in systemd Affected: All versions, or not specified |
| CVE-2022-37434 | 9.8 | Aug 5 | zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field Affected: All versions, or not specified |
| CVE-2022-22978 | 9.8 | May 19 | In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet… Affected: All versions, or not specified |
| CVE-2022-23457 | 9.8 | Apr 25 | ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library Affected: All versions, or not specified |
| CVE-2021-3711 | 9.8 | Aug 24 | SM2 Decryption Buffer Overflow Affected: All versions, or not specified |
| CVE-2021-22931 | 9.8 | Aug 16 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name… Affected: All versions, or not specified |
| CVE-2021-3520 | 9.8 | Jun 2 | There's a flaw in lz4 Affected: All versions, or not specified |
| CVE-2021-25216 | 9.8 | Apr 29 | In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions… Affected: All versions, or not specified |
| CVE-2021-20231 | 9.8 | Mar 12 | A flaw was found in gnutls Affected: All versions, or not specified |
| CVE-2021-3177 | 9.8 | Jan 19 | Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept… Affected: All versions, or not specified |
| CVE-2020-9546 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 7.3 and later; 7.3 and later; 9.5 and later |
| CVE-2020-9547 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to… Affected: 7.3 and later; 7.3 and later; 9.5 and later |
| CVE-2020-9548 | 9.8 | Mar 2 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka… Affected: 7.3 and later; 7.3 and later; 9.5 and later |
| CVE-2019-20330 | 9.8 | Jan 3 | FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking Affected: 7.3 and later; 7.3 and later; 9.5 and later |
| CVE-2019-18805 | 9.8 | Nov 7 | An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11 Affected: All versions, or not specified |
| CVE-2019-17267 | 9.8 | Oct 6 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 7.3 and later; 7.3 and later; 9.5 and later |
| CVE-2019-10212 | 9.8 | Oct 2 | A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security Affected: All versions, or not specified |
| CVE-2019-16943 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 7.3 and later; 7.3 and later; 9.5 and later |
| CVE-2019-16942 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 7.3 and later; 7.3 and later; 9.5 and later |
| CVE-2019-14379 | 9.8 | Jul 29 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of… Affected: 7.3 and later; 7.3 and later; 9.5 and later |
| CVE-2019-13990 | 9.8 | Jul 26 | initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description Affected: All versions, or not specified |
| CVE-2017-12652 | 9.8 | Jul 10 | libpng before 1.6.32 does not properly check the length of chunks against the user limit Affected: All versions, or not specified |
| CVE-2019-10126 | 9.8 | Jun 14 | A flaw was found in the Linux kernel Affected: 9.5 and later |
| CVE-2019-3888 | 9.8 | Jun 12 | A vulnerability was found in Undertow web server before 2.0.21 Affected: All versions, or not specified |
| CVE-2019-11068 | 9.8 | Apr 10 | libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code Affected: All versions, or not specified |
| CVE-2019-10125 | 9.8 | Mar 27 | An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4 Affected: 9.5 and later |
| CVE-2019-3822 | 9.8 | Feb 6 | libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow Affected: 7.3 and later; 9.5 and later |
| CVE-2016-9843 | 9.8 | May 23 | The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation Affected: 7.3 and later; 9.5 and later |
| CVE-2016-9841 | 9.8 | May 23 | inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10346 | 9.6 | Oct 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10285 | 9.6 | Oct 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10111 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10110 | 9.6 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT) Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10107 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: 7.3 and later; 9.5 and later |
| CVE-2017-10101 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) Affected: 7.3 and later; 9.5 and later |
The 500 most important CVEs for this product (exploited first, then by severity)