top of page
Cyber Security, Compliance & Business Continuity Update
There's always something on the horizon with business continuity and cyber security: regulations change, new expectations arise and industry intelligence continues to develop. On this page we maintain a curated list of developments and issues that could affect the information security and business continuity arrangements of SME organisations
Last Update: July 2026
CVE ID | Vendor | Product | Vulnerability Name | Short Description | Likely Attack Vector |
|---|---|---|---|---|---|
CVE-2018-0173 | Cisco | IOS and IOS XE Software | Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packets can allow for denial-of-service (DoS). | Application/System Exploitation |
CVE-2018-0172 | Cisco | IOS and IOS XE Software | Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS). | Application/System Exploitation |
CVE-2018-0167 | Cisco | IOS, XR, and XE Software | Cisco IOS XR and XE Software Buffer Overflow Vulnerability | There is a buffer overflow vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software Cisco IOS XE Software and Cisco IOS XR Software which could allow an unauthenticated adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code. | Direct Remote Network Attack |
CVE-2018-0161 | Cisco | IOS Software | Cisco IOS Software Resource Management Errors Vulnerability | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated remote attacker to cause a denial-of-service (DoS) condition. | Application/System Exploitation |
CVE-2018-0159 | Cisco | IOS Software and Cisco IOS XE Software | Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability | A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated remote attacker to cause an affected device to reload resulting in a denial-of-service (DoS) condition. | Direct Remote Network Attack |
CVE-2018-0158 | Cisco | IOS Software and Cisco IOS XE Software | Cisco IOS and XE Software Internet Key Exchange Memory Leak Vulnerability | A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated remote attacker to cause an affected device to reload resulting in a denial-of-service (DoS) condition. | Direct Remote Network Attack |
CVE-2018-0156 | Cisco | IOS Software and Cisco IOS XE Software | Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability | A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated remote attacker to trigger a reload of an affected device resulting in a denial-of-service (DoS) condition. | Direct Remote Network Attack |
CVE-2018-0155 | Cisco | Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches | Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability | A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated remote attacker to cause a crash of the iosd process causing a denial-of-service (DoS) condition. | Direct Remote Network Attack |
CVE-2018-0154 | Cisco | IOS Software | Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability | A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated remote attacker to cause a denial-of-service (DoS) condition. | Perimeter Gateway Breach |
CVE-2018-0151 | Cisco | IOS and IOS XE Software | Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution Vulnerability | A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges. | Direct Remote Network Attack |
CVE-2017-8540 | Microsoft | Malware Protection Engine | Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 Microsoft Exchange Server 2013 and 2016 does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability". | Phishing (Malicious Attachment) |
CVE-2017-6744 | Cisco | IOS software | Cisco IOS Software SNMP Remote Code Execution Vulnerability | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 1 contains a vulnerability that could allow an authenticated remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. | Application/System Exploitation |
CVE-2017-6743 | Cisco | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated remote attacker to remotely execute code. | Application/System Exploitation |
CVE-2017-6740 | Cisco | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated remote attacker to remotely execute code on an affected system or cause an affected system to reload. | Application/System Exploitation |
CVE-2017-6739 | Cisco | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated remote attacker to remotely execute code on an affected system or cause an affected system to reload. | Application/System Exploitation |
CVE-2017-6738 | Cisco | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated remote attacker to remotely execute code. | Application/System Exploitation |
CVE-2017-6737 | Cisco | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated remote attacker to remotely execute code. | Application/System Exploitation |
CVE-2017-6736 | Cisco | IOS and IOS XE Software | Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated remote attacker to remotely execute code. | Application/System Exploitation |
CVE-2017-6663 | Cisco | IOS and IOS XE Software | Cisco IOS Software and Cisco IOS XE Software Denial-of-Service Vulnerability | A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated adjacent attacker to cause autonomic nodes of an affected system to reload resulting in denial-of-service (DoS). | Direct Remote Network Attack |
CVE-2017-6627 | Cisco | IOS and IOS XE Software | Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service Vulnerability | A vulnerability in the UDP processing code of Cisco IOS and IOS XE could allow an unauthenticated remote attacker to cause the input queue of an affected system to hold UDP packets causing an interface queue wedge and denial of service. | Direct Remote Network Attack |
CVE-2017-12319 | Cisco | IOS XE Software | Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability | A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated remote attacker to cause the device to reload resulting in a denial of service (DoS) condition or potentially corrupt the BGP routing table which could result in network instability. | Perimeter Gateway Breach |
CVE-2017-12240 | Cisco | IOS and IOS XE Software | Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability | The Dynamic Host Configuration Protocol (DHCP) relay subsystem of Cisco IOS and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated remote attacker to execute arbitrary code and gain full control of an affected system. | Direct Remote Network Attack |
CVE-2017-12238 | Cisco | Catalyst 6800 Series Switches | Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability | A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for Cisco Catalyst 6800 Series Switches could allow an unauthenticated adjacent attacker to cause a denial of service. | Direct Remote Network Attack |
CVE-2017-12237 | Cisco | IOS and IOS XE Software | Cisco IOS and IOS XE Software Internet Key Exchange Denial-of-Service Vulnerability | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS and Cisco IOS XE could allow an unauthenticated remote attacker to cause high CPU utilization traceback messages or a reload of an affected device that leads to a denial of service. | Direct Remote Network Attack |
CVE-2017-12235 | Cisco | IOS software | Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial-of-Service Vulnerability | A vulnerability in the implementation of the PROFINET Discovery and Configuration Protocol (PN-DCP) for Cisco IOS could allow an unauthenticated remote attacker to cause an affected device to reload resulting in a denial of service. | Direct Remote Network Attack |
CVE-2017-12234 | Cisco | IOS software | Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability | There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated remote attacker to cause an affected device to reload resulting in a denial of service. | Direct Remote Network Attack |
CVE-2017-12233 | Cisco | IOS software | Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability | There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated remote attacker to cause an affected device to reload resulting in a denial of service. | Direct Remote Network Attack |
CVE-2017-12232 | Cisco | IOS software | Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service Vulnerability | A vulnerability in the implementation of a protocol in Cisco Integrated Services Routers Generation 2 (ISR G2) Routers running Cisco IOS could allow an unauthenticated adjacent attacker to cause an affected device to reload resulting in a denial of service. | Direct Remote Network Attack |
CVE-2017-12231 | Cisco | IOS software | Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability | A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS could allow an unauthenticated remote attacker to cause a denial of service. | Direct Remote Network Attack |
CVE-2017-11826 | Microsoft | Office | Microsoft Office Remote Code Execution Vulnerability | A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. | Phishing / User Interaction |
CVE-2017-11292 | Adobe | Flash Player | Adobe Flash Player Type Confusion Vulnerability | Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution. | Phishing / User Interaction |
CVE-2017-0261 | Microsoft | Office | Microsoft Office Use-After-Free Vulnerability | Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution. | Phishing / User Interaction |
CVE-2017-0001 | Microsoft | Graphics Device Interface (GDI) | Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability | The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold 1511 and 1607 allows local users to gain privileges | Application/System Exploitation |
CVE-2016-8562 | Siemens | SIMATIC CP | Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability | An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service. | Application/System Exploitation |
CVE-2016-7855 | Adobe | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code. | Phishing / User Interaction |
CVE-2016-7262 | Microsoft | Excel | Microsoft Office Security Feature Bypass Vulnerability | A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands. | Phishing / User Interaction |
CVE-2016-7193 | Microsoft | Office | Microsoft Office Memory Corruption Vulnerability | Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution. | Phishing / User Interaction |
CVE-2016-5195 | Linux | Kernel | Linux Kernel Race Condition Vulnerability | Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges. | Application/System Exploitation |
CVE-2016-4117 | Adobe | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution. | Phishing / User Interaction |
CVE-2016-1019 | Adobe | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code. | Phishing / User Interaction |
CVE-2016-0099 | Microsoft | Windows | Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability | A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator. | Phishing / User Interaction |
CVE-2015-7645 | Adobe | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file. | Phishing (Malicious Attachment) |
CVE-2015-5119 | Adobe | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution. | Phishing / User Interaction |
CVE-2015-4902 | Oracle | Java SE | Oracle Java SE Integrity Check Vulnerability | Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment. | Application/System Exploitation |
CVE-2015-3043 | Adobe | Flash Player | Adobe Flash Player Memory Corruption Vulnerability | A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution. | Phishing / User Interaction |
CVE-2015-2590 | Oracle | Java SE | Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability | An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution. | Direct Remote Network Attack |
CVE-2015-2545 | Microsoft | Office | Microsoft Office Malformed EPS File Vulnerability | Microsoft Office allows remote attackers to execute arbitrary code via a crafted EPS image. | Phishing / User Interaction |
CVE-2015-2424 | Microsoft | PowerPoint | Microsoft PowerPoint Memory Corruption Vulnerability | Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document. | Phishing (Malicious Attachment) |
CVE-2015-2387 | Microsoft | ATM Font Driver | Microsoft ATM Font Driver Privilege Escalation Vulnerability | ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application. | Application/System Exploitation |
CVE-2015-1701 | Microsoft | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | An unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges. | Application/System Exploitation |
CVE-2015-1642 | Microsoft | Office | Microsoft Office Memory Corruption Vulnerability | Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document. | Phishing (Malicious Attachment) |
CVE-2014-4114 | Microsoft | Windows | Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability | A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object. | Phishing (Malicious Attachment) |
CVE-2014-0496 | Adobe | Reader and Acrobat | Adobe Reader and Acrobat Use-After-Free Vulnerability | Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution. | Phishing / User Interaction |
CVE-2013-5065 | Microsoft | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges. | Phishing / User Interaction |
CVE-2013-3897 | Microsoft | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code. | Phishing / User Interaction |
CVE-2013-3346 | Adobe | Reader and Acrobat | Adobe Reader and Acrobat Memory Corruption Vulnerability | Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service. | Phishing / User Interaction |
CVE-2013-1675 | Mozilla | Firefox | Mozilla Firefox Information Disclosure Vulnerability | Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions which allows remote attackers to obtain sensitive information from process memory via a crafted web site. | Phishing / User Interaction |
CVE-2013-1347 | Microsoft | Internet Explorer | Microsoft Internet Explorer Remote Code Execution Vulnerability | This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. | Phishing / User Interaction |
CVE-2013-0641 | Adobe | Reader | Adobe Reader Buffer Overflow Vulnerability | A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution. | Phishing / User Interaction |
CVE-2013-0640 | Adobe | Reader and Acrobat | Adobe Reader and Acrobat Memory Corruption Vulnerability | An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution. | Phishing / User Interaction |
CVE-2013-0632 | Adobe | ColdFusion | Adobe ColdFusion Authentication Bypass Vulnerability | An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access. | Phishing / User Interaction |
CVE-2012-4681 | Oracle | Java SE | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution. | Direct Remote Network Attack |
CVE-2012-1856 | Microsoft | Office | Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability | The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption. | Phishing (Malicious Attachment) |
CVE-2012-1723 | Oracle | Java SE | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality integrity and availability via Unknown vectors related to Hotspot. | Application/System Exploitation |
CVE-2012-1535 | Adobe | Flash Player | Adobe Flash Player Arbitrary Code Execution Vulnerability | Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content. | Phishing / User Interaction |
CVE-2012-0507 | Oracle | Java SE | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code. | Application/System Exploitation |
CVE-2011-3544 | Oracle | Java SE JDK and JRE | Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code. | Application/System Exploitation |
CVE-2011-1889 | Microsoft | Forefront Threat Management Gateway (TMG) | Microsoft Forefront TMG Remote Code Execution Vulnerability | A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application. | Perimeter Gateway Breach |
CVE-2011-0611 | Adobe | Flash Player | Adobe Flash Player Remote Code Execution Vulnerability | Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content. | Phishing / User Interaction |
CVE-2010-3333 | Microsoft | Office | Microsoft Office Stack-based Buffer Overflow Vulnerability | A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution. | Phishing / User Interaction |
CVE-2010-0232 | Microsoft | Windows | Microsoft Windows Kernel Exception Handler Vulnerability | The kernel in Microsoft Windows when access to 16-bit applications is enabled on a 32-bit x86 platform does not properly validate certain BIOS calls which allows local users to gain privileges. | Phishing / User Interaction |
CVE-2010-0188 | Adobe | Reader and Acrobat | Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability | Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code. | Phishing / User Interaction |
CVE-2009-3129 | Microsoft | Excel | Microsoft Excel Featheader Record Memory Corruption Vulnerability | Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset. | Phishing / User Interaction |
CVE-2009-1123 | Microsoft | Windows | Microsoft Windows Improper Input Validation Vulnerability | The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects which allows local users to gain privileges via a crafted application. | Phishing / User Interaction |
CVE-2008-3431 | Oracle | VirtualBox | Oracle VirtualBox Insufficient Input Validation Vulnerability | An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code. | Application/System Exploitation |
CVE-2008-2992 | Adobe | Acrobat and Reader | Adobe Reader and Acrobat Input Validation Vulnerability | Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution. | Phishing / User Interaction |
CVE-2004-0210 | Microsoft | Windows | Microsoft Windows Privilege Escalation Vulnerability | A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system. | Phishing / User Interaction |
CVE-2002-0367 | Microsoft | Windows | Microsoft Windows Privilege Escalation Vulnerability | smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs which allows local users to gain administrator or SYSTEM privileges. | Phishing / User Interaction |
CVE-2022-24682 | Synacor | Zimbra Collaborate Suite (ZCS) | Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability | Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code. | Application/System Exploitation |
CVE-2017-8570 | Microsoft | Office | Microsoft Office Remote Code Execution Vulnerability | A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. | Phishing / User Interaction |
CVE-2017-0222 | Microsoft | Internet Explorer | Microsoft Internet Explorer Remote Code Execution Vulnerability | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. | Phishing / User Interaction |
CVE-2014-6352 | Microsoft | Windows | Microsoft Windows Code Injection Vulnerability | Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object. | Phishing / User Interaction |
CVE-2022-23131 | Zabbix | Frontend | Zabbix Frontend Authentication Bypass Vulnerability | Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML. | Application/System Exploitation |
CVE-2022-23134 | Zabbix | Frontend | Zabbix Frontend Improper Access Control Vulnerability | Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend. | Application/System Exploitation |
CVE-2022-24086 | Adobe | Commerce and Magento Open Source | Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability | Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution. | Phishing / User Interaction |
CVE-2022-0609 | Google | Chromium Animation | Google Chromium Animation Use-After-Free Vulnerability | Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium including but not limited to Google Chrome Microsoft Edge and Opera. | Phishing (Malicious Link) |
CVE-2019-0752 | Microsoft | Internet Explorer | Microsoft Internet Explorer Type Confusion Vulnerability | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer | Phishing / User Interaction |
CVE-2018-8174 | Microsoft | Windows | Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory aka "Windows VBScript Engine Remote Code Execution" | Phishing / User Interaction |
CVE-2018-20250 | RARLAB | WinRAR | WinRAR Absolute Path Traversal Vulnerability | WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution | Direct Remote Network Attack |
CVE-2018-15982 | Adobe | Flash Player | Adobe Flash Player Use-After-Free Vulnerability | Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability | Phishing / User Interaction |
CVE-2017-9841 | PHPUnit | PHPUnit | PHPUnit Command Injection Vulnerability | PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring as demonstrated by an attack on a site with an exposed /vendor folder i.e. external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI. | Application/System Exploitation |
CVE-2014-1761 | Microsoft | Word | Microsoft Word Memory Corruption Vulnerability | Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution. | Phishing / User Interaction |
CVE-2013-3906 | Microsoft | Graphics Component | Microsoft Graphics Component Memory Corruption Vulnerability | Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution. | Phishing / User Interaction |
CVE-2022-22620 | Apple | iOS, iPadOS, and macOS | Apple iOS iPadOS and macOS Webkit Use-After-Free Vulnerability | Apple iOS iPadOS and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Phishing (Malicious Link) |
CVE-2021-36934 | Microsoft | Windows | Microsoft Windows SAM Local Privilege Escalation Vulnerability | If a Volume Shadow Copy (VSS) shadow copy of the system drive is available users can read the SAM file which would allow any user to escalate privileges to SYSTEM level. | Phishing (Malicious Attachment) |
CVE-2020-0796 | Microsoft | SMBv3 | Microsoft SMBv3 Remote Code Execution Vulnerability | A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client. | Direct Remote Network Attack |
CVE-2018-1000861 | Jenkins | Jenkins Stapler Web Framework | Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability | A code execution vulnerability exists in the Stapler web framework used by Jenkins | Application/System Exploitation |
CVE-2017-9791 | Apache | Struts 1 | Apache Struts 1 Improper Input Validation Vulnerability | The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. | Direct Remote Network Attack |
CVE-2017-8464 | Microsoft | Windows | Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability | Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file | Phishing (Malicious Attachment) |
CVE-2017-10271 | Oracle | WebLogic Server | Oracle Corporation WebLogic Server Remote Code Execution Vulnerability | Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution. | Direct Remote Network Attack |
Follow or connect with Steve, RiskCentric's owner & founder via LinkedIn
Opeining times are listed here
bottom of page