주요 제품 취약점 (3,475건)

기술	CVE	심각도	유형	KEV	등재일
Apache Tomcat Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M1…	CVE-2016-8735	9.8	—	KEV	2023-05-12
Fortinet Fortinet FortiOS A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through…	CVE-2022-42475	9.8	CWE-197	KEV	2022-12-13
Fortinet Fortinet Multiple Products An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiP…	CVE-2022-40684	9.8	CWE-287	KEV	2022-10-11
Palo Alto PAN-OS Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrar…	CVE-2017-15944	9.8	CWE-20	KEV	2022-08-18
Atlassian Confluence The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with…	CVE-2022-26138	9.8	CWE-798	KEV	2022-07-29
Windows Adobe Reader and Acrobat Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9…	CVE-2011-2462	9.8	CWE-787	KEV	2022-06-08
Atlassian Confluence Atlassian Confluence Server/Data Center In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to exe…	CVE-2022-26134	9.8	CWE-917	KEV	2022-06-02
Windows Adobe Reader and Acrobat Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequ…	CVE-2014-0546	9.8	—	KEV	2022-05-25
Windows Microsoft Windows Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, W…	CVE-2017-8543	9.8	CWE-281	KEV	2022-05-24
Windows Meta Platforms WhatsApp A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target ph…	CVE-2019-3568	9.8	CWE-122	KEV	2022-04-19
Windows Adobe Flash Player Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Wind…	CVE-2015-5123	9.8	CWE-416	KEV	2022-04-13
Windows Adobe Flash Player Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on W…	CVE-2015-5122	9.8	CWE-416	KEV	2022-04-13
Windows Adobe Flash Player Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.46…	CVE-2015-3113	9.8	CWE-787	KEV	2022-04-13
Windows Adobe Flash Player Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.…	CVE-2015-0313	9.8	CWE-416	KEV	2022-04-13
Windows Adobe Flash Player Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.2…	CVE-2015-0311	9.8	—	KEV	2022-04-13
Apache Tomcat VMware Spring Framework A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit …	CVE-2022-22965	9.8	CWE-94	KEV	2022-04-04
Spring Framework VMware Spring Framework A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit …	CVE-2022-22965	9.8	CWE-94	KEV	2022-04-04
Citrix NetScaler Citrix SD-WAN and NetScaler Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.	CVE-2019-12989	9.8	CWE-89	KEV	2022-03-25
Citrix NetScaler Citrix NetScaler SD-WAN Enterprise, CloudBridge Virtual WAN, and XenMobile Server Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. O…	CVE-2017-6316	9.8	—	KEV	2022-03-25
Cisco IOS Cisco IOS and IOS XE A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated,…	CVE-2017-3881	9.8	CWE-20	KEV	2022-03-25
Apache Tomcat When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as …	CVE-2020-1938	9.8	—	KEV	2022-03-03
Cisco IOS Cisco IOS and IOS XE Software A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote atta…	CVE-2018-0151	9.8	CWE-119	KEV	2022-03-03
Cisco IOS Cisco IOS and IOS XE Software The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remot…	CVE-2017-12240	9.8	CWE-20	KEV	2022-03-03
Windows Adobe Flash Player Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x…	CVE-2015-5119	9.8	CWE-416	KEV	2022-03-03
Windows Adobe Flash Player Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to…	CVE-2015-3043	9.8	CWE-787	KEV	2022-03-03
Windows Microsoft HTTP.sys HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers …	CVE-2015-1635	9.8	CWE-94	KEV	2022-02-10
Apache HTTP SonicWall SMA 100 Appliances A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated atta…	CVE-2021-20038	9.8	CWE-121	KEV	2022-01-28
OpenSSH GNU Bourne-Again Shell (Bash) GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which…	CVE-2014-7169	9.8	CWE-78	KEV	2022-01-28
Apache HTTP GNU Bourne-Again Shell (Bash) GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which…	CVE-2014-7169	9.8	CWE-78	KEV	2022-01-28
OpenSSH GNU Bourne-Again Shell (Bash) GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to e…	CVE-2014-6271	9.8	CWE-78	KEV	2022-01-28
Apache HTTP GNU Bourne-Again Shell (Bash) GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to e…	CVE-2014-6271	9.8	CWE-78	KEV	2022-01-28
Apache HTTP Apache HTTP Server It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs…	CVE-2021-42013	9.8	CWE-22	KEV	2021-11-03
Apache HTTP Apache HTTP Server A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to fi…	CVE-2021-41773	9.8	CWE-22	KEV	2021-11-03
Atlassian Confluence Atlassian Confluence Server and Data Center In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to exe…	CVE-2021-26084	9.8	CWE-917	KEV	2021-11-03
VMware vCenter VMware vCenter Server The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCe…	CVE-2021-22005	9.8	CWE-22	KEV	2021-11-03
VMware vCenter VMware vCenter Server The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in whi…	CVE-2021-21985	9.8	CWE-918	KEV	2021-11-03
VMware vCenter VMware vCenter Server The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 4…	CVE-2021-21972	9.8	CWE-22	KEV	2021-11-03
VMware ESXi OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after…	CVE-2020-3992	9.8	CWE-416	KEV	2021-11-03
VMware vCenter VMware vCenter Server Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does no…	CVE-2020-3952	9.8	CWE-306	KEV	2021-11-03
Ivanti Ivanti MobileIron Multiple Products A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0,…	CVE-2020-15505	9.8	CWE-706	KEV	2021-11-03
Fortinet Fortinet FortiOS An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in succe…	CVE-2020-12812	9.8	CWE-178	KEV	2021-11-03
VMware ESXi VMware VMware ESXi and Horizon DaaS OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Crit…	CVE-2019-5544	9.8	CWE-787	KEV	2021-11-03
Atlassian Confluence Atlassian Confluence Server and Data Server The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the …	CVE-2019-3396	9.8	CWE-22	KEV	2021-11-03
Windows Citrix Workspace Application and Receiver for Windows Citrix Workspace App before 1904 for Windows has Incorrect Access Control.	CVE-2019-11634	9.8	CWE-284	KEV	2021-11-03
Cisco IOS Cisco IOS and IOS XE A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigg…	CVE-2018-0171	9.8	CWE-20	KEV	2021-11-03
Windows Microsoft Internet Information Services (IIS) Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 200…	CVE-2017-7269	9.8	CWE-120	KEV	2021-11-03
Windows Qlik Sense Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation o…	CVE-2023-48365	9.6	CWE-444	KEV	2025-01-13
Windows Qlik Sense An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 a…	CVE-2023-41265	9.6	CWE-444	KEV	2023-12-07
Ivanti Ivanti Cloud Services Appliance (CSA) Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.	CVE-2024-8963	9.4	CWE-22	KEV	2024-09-19
Citrix NetScaler Citrix NetScaler ADC and NetScaler Gateway Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy)…	CVE-2023-4966	9.4	CWE-119	KEV	2023-10-18
VMware ESXi VMware ESXi and Workstation VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with …	CVE-2025-22224	9.3	CWE-367	KEV	2025-03-04
Palo Alto PAN-OS Palo Alto Networks PAN-OS Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass se…	CVE-2026-0257	9.1	CWE-565	KEV	2026-05-29
Apache HTTP Apache HTTP Server Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are p…	CVE-2024-38475	9.1	CWE-116	KEV	2025-05-01
Palo Alto PAN-OS Palo Alto Networks PAN-OS An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web inte…	CVE-2025-0108	9.1	CWE-306	KEV	2025-02-18
Ivanti Ivanti Connect Secure and Policy Secure A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticate…	CVE-2024-21887	9.1	CWE-77	KEV	2024-01-10
Fortinet Fortinet FortiOS and FortiProxy An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, …	CVE-2018-13382	9.1	CWE-863	KEV	2022-01-10
Microsoft Exchange Microsoft Exchange Server Microsoft Exchange Server Remote Code Execution Vulnerability	CVE-2021-34473	9.1	CWE-918	KEV	2021-11-03
Microsoft Exchange Microsoft Exchange Server Microsoft Exchange Server Remote Code Execution Vulnerability	CVE-2021-26855	9.1	CWE-918	KEV	2021-11-03
Fortinet Fortinet FortiOS An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4…	CVE-2018-13379	9.1	CWE-22	KEV	2021-11-03
Ivanti Ivanti Connect Secure, Policy Secure, and ZTA Gateways A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways…	CVE-2025-22457	9.0	CWE-121	KEV	2025-04-04