{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: CVEs linked to T1485 Data Destruction","home_page_url":"https://patchfirst.co/technique/T1485/","feed_url":"https://patchfirst.co/feed/technique/T1485.json","description":"New and newly exploited CVEs that lead to ATT&CK T1485 Data Destruction, with CISA KEV and EPSS context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2023-49105#kev","url":"https://patchfirst.co/cve/CVE-2023-49105/","title":"[KEV] CVE-2023-49105: ownCloud Improper Authentication Vulnerability","content_text":"ownCloud · ownCloud. In CISA KEV since 2026-08-27. ENISA EUVD lists it as exploited. EPSS 43.2% (higher than 98.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System; T1485 Data Destruction. Priority 79.6 of 100.","summary":"ownCloud Improper Authentication Vulnerability","date_published":"2026-08-27T00:00:00.000Z","date_modified":"2026-08-28T12:21:09.000Z","tags":["kev","public-exploit","T1190","T1005","T1485"],"_patchfirst":{"reason":"kev","priority":79.6,"kev":{"dateAdded":"2026-08-27","ransomware":false},"epss":{"score":0.4319,"percentile":0.98723},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ownCloud","product":"ownCloud","techniqueIds":["T1190","T1005","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-25257#kev","url":"https://patchfirst.co/cve/CVE-2025-25257/","title":"[KEV] CVE-2025-25257: Fortinet FortiWeb SQL Injection Vulnerability","content_text":"Fortinet · FortiWeb. In CISA KEV since 2025-07-18. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1068 Exploitation for Privilege Escalation; T1190 Exploit Public-Facing Application; T1059.004 Unix Shell; T1485 Data Destruction. Priority 69.9 of 100.","summary":"Fortinet FortiWeb SQL Injection Vulnerability","date_published":"2025-07-18T00:00:00.000Z","date_modified":"2026-06-17T09:00:34.000Z","tags":["kev","public-exploit","T1055","T1068","T1190","T1059.004","T1485"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2025-07-18","ransomware":false},"epss":{"score":0.99921,"percentile":0.99968},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Fortinet","product":"FortiWeb","techniqueIds":["T1055","T1068","T1190","T1059.004","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-25181#kev","url":"https://patchfirst.co/cve/CVE-2025-25181/","title":"[KEV] CVE-2025-25181: Advantive VeraCore SQL Injection Vulnerability","content_text":"Advantive · VeraCore. In CISA KEV since 2025-03-10. ENISA EUVD lists it as exploited. EPSS 55.5% (higher than 99.04% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1055 Process Injection; T1068 Exploitation for Privilege Escalation; T1485 Data Destruction. Priority 68.1 of 100.","summary":"Advantive VeraCore SQL Injection Vulnerability","date_published":"2025-03-10T00:00:00.000Z","date_modified":"2026-06-17T09:00:26.000Z","tags":["kev","public-exploit","T1055","T1068","T1485"],"_patchfirst":{"reason":"kev","priority":68.1,"kev":{"dateAdded":"2025-03-10","ransomware":false},"epss":{"score":0.55549,"percentile":0.99036},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"Advantive","product":"VeraCore","techniqueIds":["T1055","T1068","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-21391#kev","url":"https://patchfirst.co/cve/CVE-2025-21391/","title":"[KEV] CVE-2025-21391: Microsoft Windows Storage Link Following Vulnerability","content_text":"Microsoft · Windows. In CISA KEV since 2025-02-11. ENISA EUVD lists it as exploited. EPSS 2.3% (higher than 83.1% of CVEs). CVSS 7.1 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1485 Data Destruction; T1490 Inhibit System Recovery. Priority 59.6 of 100.","summary":"Microsoft Windows Storage Link Following Vulnerability","date_published":"2025-02-11T00:00:00.000Z","date_modified":"2026-09-24T13:10:00.000Z","tags":["kev","T1068","T1485","T1490"],"_patchfirst":{"reason":"kev","priority":59.6,"kev":{"dateAdded":"2025-02-11","ransomware":false},"epss":{"score":0.02284,"percentile":0.8314},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows","techniqueIds":["T1068","T1485","T1490"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-39226#kev","url":"https://patchfirst.co/cve/CVE-2021-39226/","title":"[KEV] CVE-2021-39226: Grafana Authentication Bypass Vulnerability","content_text":"Grafana Labs · Grafana. In CISA KEV since 2022-08-25. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 7.3 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1485 Data Destruction. Priority 68.1 of 100.","summary":"Grafana Authentication Bypass Vulnerability","date_published":"2022-08-25T00:00:00.000Z","date_modified":"2026-06-17T04:03:21.000Z","tags":["kev","public-exploit","T1190","T1485"],"_patchfirst":{"reason":"kev","priority":68.1,"kev":{"dateAdded":"2022-08-25","ransomware":false},"epss":{"score":0.99933,"percentile":0.9997},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1"},"vendor":"Grafana Labs","product":"Grafana","techniqueIds":["T1190","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-23134#kev","url":"https://patchfirst.co/cve/CVE-2022-23134/","title":"[KEV] CVE-2022-23134: Zabbix Frontend Improper Access Control Vulnerability","content_text":"Zabbix · Frontend. In CISA KEV since 2022-02-22. ENISA EUVD lists it as exploited. EPSS 95.3% (higher than 99.87% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1485 Data Destruction. Priority 66.7 of 100.","summary":"Zabbix Frontend Improper Access Control Vulnerability","date_published":"2022-02-22T00:00:00.000Z","date_modified":"2026-06-17T04:29:34.000Z","tags":["kev","public-exploit","T1190","T1485"],"_patchfirst":{"reason":"kev","priority":66.7,"kev":{"dateAdded":"2022-02-22","ransomware":false},"epss":{"score":0.9526,"percentile":0.99865},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Zabbix","product":"Frontend","techniqueIds":["T1190","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2018-7600#kev","url":"https://patchfirst.co/cve/CVE-2018-7600/","title":"[KEV] CVE-2018-7600: Drupal Core Remote Code Execution Vulnerability","content_text":"Drupal · Drupal Core. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.98% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1485 Data Destruction; T1496 Resource Hijacking. Named in 1 threat report. Priority 83.7 of 100.","summary":"Drupal Core Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:03:25.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059","T1485","T1496"],"_patchfirst":{"reason":"kev","priority":83.7,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99991,"percentile":0.99985},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Drupal","product":"Drupal Core","techniqueIds":["T1190","T1059","T1485","T1496"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-22986#kev","url":"https://patchfirst.co/cve/CVE-2021-22986/","title":"[KEV] CVE-2021-22986: F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability","content_text":"F5 · BIG-IP and BIG-IQ Centralized Management. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.97% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1090 Proxy; T1485 Data Destruction. Priority 79.9 of 100.","summary":"F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:38:09.000Z","tags":["kev","ransomware","public-exploit","T1133","T1190","T1059","T1090","T1485"],"_patchfirst":{"reason":"kev","priority":79.9,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.99898,"percentile":0.99965},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"F5","product":"BIG-IP and BIG-IQ Centralized Management","techniqueIds":["T1133","T1190","T1059","T1090","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-3715#kev","url":"https://patchfirst.co/cve/CVE-2016-3715/","title":"[KEV] CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerability","content_text":"ImageMagick · ImageMagick. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 75.3% (higher than 99.51% of CVEs). CVSS 5.5 MEDIUM. Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1485 Data Destruction. Priority 66.8 of 100.","summary":"ImageMagick Arbitrary File Deletion Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T00:46:14.000Z","tags":["kev","public-exploit","T1204.002","T1485"],"_patchfirst":{"reason":"kev","priority":66.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.75307,"percentile":0.99512},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1"},"vendor":"ImageMagick","product":"ImageMagick","techniqueIds":["T1204.002","T1485"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-16874","url":"https://patchfirst.co/cve/CVE-2020-16874/","title":"CVE-2020-16874: Visual Studio Remote Code Execution Vulnerability","content_text":"Microsoft · Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6). Not in CISA KEV. EPSS 4.3% (higher than 91.1% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; +1 more. Priority 24.4 of 100.","summary":"Visual Studio Remote Code Execution Vulnerability","date_published":"2020-09-11T00:00:00.000Z","date_modified":"2024-08-04T13:45:34.000Z","tags":["T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":24.4,"kev":null,"epss":{"score":0.04285,"percentile":0.91102},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)","techniqueIds":["T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1569","url":"https://patchfirst.co/cve/CVE-2020-1569/","title":"CVE-2020-1569: Microsoft Edge Memory Corruption Vulnerability","content_text":"Microsoft · Microsoft Edge (EdgeHTML-based). Not in CISA KEV. EPSS 3.0% (higher than 87.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 23.6 of 100.","summary":"Microsoft Edge Memory Corruption Vulnerability","date_published":"2020-08-17T00:00:00.000Z","date_modified":"2024-08-04T06:39:10.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":23.6,"kev":null,"epss":{"score":0.02984,"percentile":0.87281},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Microsoft Edge (EdgeHTML-based)","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1495","url":"https://patchfirst.co/cve/CVE-2020-1495/","title":"CVE-2020-1495: Microsoft Excel Remote Code Execution Vulnerability","content_text":"Microsoft · Microsoft SharePoint Server 2010 Service Pack 2. Not in CISA KEV. EPSS 4.2% (higher than 91% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 18.9 of 100.","summary":"Microsoft Excel Remote Code Execution Vulnerability","date_published":"2020-08-17T00:00:00.000Z","date_modified":"2024-08-04T06:39:10.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":18.9,"kev":null,"epss":{"score":0.04212,"percentile":0.90969},"cvss":null,"vendor":"Microsoft","product":"Microsoft SharePoint Server 2010 Service Pack 2","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1456","url":"https://patchfirst.co/cve/CVE-2020-1456/","title":"CVE-2020-1456: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a…","content_text":"Microsoft · Microsoft SharePoint Enterprise Server. Not in CISA KEV. EPSS 2.2% (higher than 82.7% of CVEs). CVSS 5.4 MEDIUM. ATT&CK: T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1036 Masquerading; T1485 Data Destruction; T1565 Data Manipulation. Priority 21.0 of 100.","summary":"A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a…","date_published":"2020-07-14T00:00:00.000Z","date_modified":"2025-02-28T20:32:04.000Z","tags":["T1059","T1005","T1036","T1485","T1565"],"_patchfirst":{"reason":"published","priority":21,"kev":null,"epss":{"score":0.02229,"percentile":0.82723},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1"},"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server","techniqueIds":["T1059","T1005","T1036","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1163","url":"https://patchfirst.co/cve/CVE-2020-1163/","title":"CVE-2020-1163: An elevation of privilege vulnerability exists in Windows Defender that leads arbitrary file deletion on the system.To…","content_text":"Microsoft · Microsoft Forefront Endpoint Protection. Not in CISA KEV. EPSS 0.9% (higher than 59.2% of CVEs). ATT&CK: T1485 Data Destruction. Priority 11.8 of 100.","summary":"An elevation of privilege vulnerability exists in Windows Defender that leads arbitrary file deletion on the system.To…","date_published":"2020-06-09T00:00:00.000Z","date_modified":"2024-08-04T06:25:01.000Z","tags":["T1485"],"_patchfirst":{"reason":"published","priority":11.8,"kev":null,"epss":{"score":0.00885,"percentile":0.59204},"cvss":null,"vendor":"Microsoft","product":"Microsoft Forefront Endpoint Protection","techniqueIds":["T1485"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1109","url":"https://patchfirst.co/cve/CVE-2020-1109/","title":"CVE-2020-1109: Windows Update Stack Elevation of Privilege Vulnerability","content_text":"Microsoft · Windows 10 Version 1709. Not in CISA KEV. EPSS 1.0% (higher than 62.6% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; T1565 Data Manipulation. Priority 18.0 of 100.","summary":"Windows Update Stack Elevation of Privilege Vulnerability","date_published":"2020-05-21T00:00:00.000Z","date_modified":"2026-08-19T16:34:05.000Z","tags":["T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":18,"kev":null,"epss":{"score":0.00994,"percentile":0.6259},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows 10 Version 1709","techniqueIds":["T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-1111","url":"https://patchfirst.co/cve/CVE-2020-1111/","title":"CVE-2020-1111: Windows Clipboard Service Elevation of Privilege Vulnerability","content_text":"Microsoft · Windows 10 Version 1809. Not in CISA KEV. EPSS 1.0% (higher than 61.3% of CVEs). CVSS 7.8 HIGH. ATT&CK: T1068 Exploitation for Privilege Escalation; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; T1565 Data Manipulation. Priority 17.7 of 100.","summary":"Windows Clipboard Service Elevation of Privilege Vulnerability","date_published":"2020-05-21T00:00:00.000Z","date_modified":"2026-08-19T16:34:05.000Z","tags":["T1068","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":17.7,"kev":null,"epss":{"score":0.00952,"percentile":0.61289},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"Microsoft","product":"Windows 10 Version 1809","techniqueIds":["T1068","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-0671","url":"https://patchfirst.co/cve/CVE-2020-0671/","title":"CVE-2020-0671: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka…","content_text":"Microsoft · Windows. Not in CISA KEV. EPSS 1.4% (higher than 71.8% of CVEs). ATT&CK: T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; T1565 Data Manipulation. Priority 15.0 of 100.","summary":"An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka…","date_published":"2020-02-11T00:00:00.000Z","date_modified":"2024-08-04T06:11:04.000Z","tags":["T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":15,"kev":null,"epss":{"score":0.01367,"percentile":0.7182},"cvss":null,"vendor":"Microsoft","product":"Windows","techniqueIds":["T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3750","url":"https://patchfirst.co/cve/CVE-2019-3750/","title":"CVE-2019-3750: Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability","content_text":"Dell · Dell Command Update (DCU). Not in CISA KEV. EPSS 0.3% (higher than 24.9% of CVEs). CVSS 5.6 MEDIUM. ATT&CK: T1485 Data Destruction. Priority 8.9 of 100.","summary":"Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability","date_published":"2019-12-03T00:00:00.000Z","date_modified":"2024-09-16T23:11:52.000Z","tags":["T1485"],"_patchfirst":{"reason":"published","priority":8.9,"kev":null,"epss":{"score":0.00319,"percentile":0.24877},"cvss":{"score":5.6,"severity":"MEDIUM","version":"3.0"},"vendor":"Dell","product":"Dell Command Update (DCU)","techniqueIds":["T1485"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1270","url":"https://patchfirst.co/cve/CVE-2019-1270/","title":"CVE-2019-1270: An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to…","content_text":"Microsoft · Windows. Not in CISA KEV. EPSS 0.9% (higher than 59.6% of CVEs). ATT&CK: T1202 Indirect Command Execution; T1485 Data Destruction; T1565 Data Manipulation. Priority 11.9 of 100.","summary":"An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to…","date_published":"2019-09-11T00:00:00.000Z","date_modified":"2024-08-04T18:13:30.000Z","tags":["T1202","T1485","T1565"],"_patchfirst":{"reason":"published","priority":11.9,"kev":null,"epss":{"score":0.00897,"percentile":0.59559},"cvss":null,"vendor":"Microsoft","product":"Windows","techniqueIds":["T1202","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-1118","url":"https://patchfirst.co/cve/CVE-2019-1118/","title":"CVE-2019-1118: A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite…","content_text":"Microsoft · Windows. Not in CISA KEV. EPSS 23.6% (higher than 97.8% of CVEs). Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 24.6 of 100.","summary":"A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite…","date_published":"2019-07-29T00:00:00.000Z","date_modified":"2024-08-04T18:06:31.000Z","tags":["public-exploit","T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":24.6,"kev":null,"epss":{"score":0.2357,"percentile":0.97801},"cvss":null,"vendor":"Microsoft","product":"Windows","techniqueIds":["T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2019-1031","url":"https://patchfirst.co/cve/CVE-2019-1031/","title":"CVE-2019-1031: Microsoft Office SharePoint XSS Vulnerability","content_text":"Microsoft · Microsoft SharePoint Enterprise Server 2016. Not in CISA KEV. EPSS 1.7% (higher than 76.7% of CVEs). ATT&CK: T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1036 Masquerading; T1485 Data Destruction; T1565 Data Manipulation. Priority 15.3 of 100.","summary":"Microsoft Office SharePoint XSS Vulnerability","date_published":"2019-06-12T00:00:00.000Z","date_modified":"2025-05-20T17:50:11.000Z","tags":["T1059","T1005","T1036","T1485","T1565"],"_patchfirst":{"reason":"published","priority":15.3,"kev":null,"epss":{"score":0.01662,"percentile":0.76671},"cvss":null,"vendor":"Microsoft","product":"Microsoft SharePoint Enterprise Server 2016","techniqueIds":["T1059","T1005","T1036","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-3723","url":"https://patchfirst.co/cve/CVE-2019-3723/","title":"CVE-2019-3723: Web Parameter Tampering Vulnerability","content_text":"Dell EMC · OpenManage Server Administrator. Not in CISA KEV. EPSS 1.8% (higher than 79.1% of CVEs). CVSS 9.1 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1485 Data Destruction; T1059 Command and Scripting Interpreter; T1574 Hijack Execution Flow. Priority 22.2 of 100.","summary":"Web Parameter Tampering Vulnerability","date_published":"2019-06-06T00:00:00.000Z","date_modified":"2024-09-16T19:05:23.000Z","tags":["T1190","T1485","T1059","T1574"],"_patchfirst":{"reason":"published","priority":22.2,"kev":null,"epss":{"score":0.01848,"percentile":0.79053},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.0"},"vendor":"Dell EMC","product":"OpenManage Server Administrator","techniqueIds":["T1190","T1485","T1059","T1574"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2019-0609","url":"https://patchfirst.co/cve/CVE-2019-0609/","title":"CVE-2019-0609: A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…","content_text":"Microsoft · Internet Explorer 11. Not in CISA KEV. EPSS 9.8% (higher than 95.6% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.8 of 100.","summary":"A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…","date_published":"2019-04-08T00:00:00.000Z","date_modified":"2024-08-04T17:51:26.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.8,"kev":null,"epss":{"score":0.09846,"percentile":0.95554},"cvss":null,"vendor":"Microsoft","product":"Internet Explorer 11","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8575","url":"https://patchfirst.co/cve/CVE-2018-8575/","title":"CVE-2018-8575: A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in…","content_text":"Microsoft · Microsoft Project. Not in CISA KEV. EPSS 19.5% (higher than 97.4% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1068 Exploitation for Privilege Escalation; T1005 Data from Local System; T1136 Create Account; T1485 Data Destruction; +1 more. Priority 19.5 of 100.","summary":"A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in…","date_published":"2018-11-14T00:00:00.000Z","date_modified":"2024-08-05T07:02:25.000Z","tags":["T1204.002","T1566","T1068","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.5,"kev":null,"epss":{"score":0.19546,"percentile":0.97377},"cvss":null,"vendor":"Microsoft","product":"Microsoft Project","techniqueIds":["T1204.002","T1566","T1068","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8607","url":"https://patchfirst.co/cve/CVE-2018-8607/","title":"CVE-2018-8607: A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly…","content_text":"Microsoft · Microsoft Dynamics 365. Not in CISA KEV. EPSS 1.6% (higher than 75.8% of CVEs). ATT&CK: T1059 Command and Scripting Interpreter; T1005 Data from Local System; T1036 Masquerading; T1485 Data Destruction; T1565 Data Manipulation. Priority 15.2 of 100.","summary":"A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly…","date_published":"2018-11-14T00:00:00.000Z","date_modified":"2024-08-05T07:02:25.000Z","tags":["T1059","T1005","T1036","T1485","T1565"],"_patchfirst":{"reason":"published","priority":15.2,"kev":null,"epss":{"score":0.01605,"percentile":0.75832},"cvss":null,"vendor":"Microsoft","product":"Microsoft Dynamics 365","techniqueIds":["T1059","T1005","T1036","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8353","url":"https://patchfirst.co/cve/CVE-2018-8353/","title":"CVE-2018-8353: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in…","content_text":"Not in CISA KEV. EPSS 67.3% (higher than 99.3% of CVEs). Public exploit code exists. ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 24.9 of 100.","summary":"A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in…","date_published":"2018-08-15T00:00:00.000Z","date_modified":"2024-08-05T06:54:35.000Z","tags":["public-exploit","T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.67339,"percentile":0.99304},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-8355","url":"https://patchfirst.co/cve/CVE-2018-8355/","title":"CVE-2018-8355: A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…","content_text":"Microsoft · ChakraCore. Not in CISA KEV. EPSS 67.9% (higher than 99.32% of CVEs). Public exploit code exists. ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 24.9 of 100.","summary":"A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…","date_published":"2018-08-15T00:00:00.000Z","date_modified":"2024-08-05T06:54:35.000Z","tags":["public-exploit","T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":24.9,"kev":null,"epss":{"score":0.67896,"percentile":0.9932},"cvss":null,"vendor":"Microsoft","product":"ChakraCore","techniqueIds":["T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-8248","url":"https://patchfirst.co/cve/CVE-2018-8248/","title":"CVE-2018-8248: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle…","content_text":"Microsoft · Microsoft Office. Not in CISA KEV. EPSS 21.4% (higher than 97.6% of CVEs). ATT&CK: T1189 Drive-by Compromise; T1204.002 Malicious File; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.5 of 100.","summary":"A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle…","date_published":"2018-06-14T00:00:00.000Z","date_modified":"2024-08-05T06:46:13.000Z","tags":["T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.5,"kev":null,"epss":{"score":0.21421,"percentile":0.97607},"cvss":null,"vendor":"Microsoft","product":"Microsoft Office","techniqueIds":["T1189","T1204.002","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8110","url":"https://patchfirst.co/cve/CVE-2018-8110/","title":"CVE-2018-8110: A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft…","content_text":"Microsoft · Microsoft Edge. Not in CISA KEV. EPSS 16.9% (higher than 97.1% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.4 of 100.","summary":"A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft…","date_published":"2018-06-14T00:00:00.000Z","date_modified":"2024-08-05T06:46:13.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.4,"kev":null,"epss":{"score":0.16906,"percentile":0.97051},"cvss":null,"vendor":"Microsoft","product":"Microsoft Edge","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-8111","url":"https://patchfirst.co/cve/CVE-2018-8111/","title":"CVE-2018-8111: A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft…","content_text":"Microsoft · Microsoft Edge. Not in CISA KEV. EPSS 16.9% (higher than 97% of CVEs). ATT&CK: T1204.002 Malicious File; T1566 Phishing; T1499.004 Application or System Exploitation; T1574 Hijack Execution Flow; T1005 Data from Local System; T1136 Create Account; +2 more. Priority 19.4 of 100.","summary":"A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft…","date_published":"2018-06-14T00:00:00.000Z","date_modified":"2024-08-05T06:46:13.000Z","tags":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"_patchfirst":{"reason":"published","priority":19.4,"kev":null,"epss":{"score":0.16906,"percentile":0.9705},"cvss":null,"vendor":"Microsoft","product":"Microsoft Edge","techniqueIds":["T1204.002","T1566","T1499.004","T1574","T1005","T1136","T1485","T1565"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2018-5459","url":"https://patchfirst.co/cve/CVE-2018-5459/","title":"CVE-2018-5459: An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X","content_text":"Not in CISA KEV. EPSS 2.7% (higher than 85.8% of CVEs). ATT&CK: T1005 Data from Local System; T1485 Data Destruction; T1565.001 Stored Data Manipulation. Priority 17.2 of 100.","summary":"An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X","date_published":"2018-02-13T00:00:00.000Z","date_modified":"2024-08-05T05:33:44.000Z","tags":["T1005","T1485","T1565.001"],"_patchfirst":{"reason":"published","priority":17.2,"kev":null,"epss":{"score":0.02676,"percentile":0.85778},"cvss":null,"vendor":null,"product":null,"techniqueIds":["T1005","T1485","T1565.001"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}