Skip to content
Noroxi

Amazon records

209 published records for vendor Amazon. 2 of them have been exploited in the wild (listed in CISA KEV) and 2 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
2 · 1%
Weaponized
2 · 1%
Pre-auth RCE
17
With a fix record
45%
Median publish → KEV
5 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

209 records
  • CVE-2023-44487
    90Now

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmwareOct 10, 2023

  • CVE-2026-31431
    90Now

    crypto: algif_aead - Revert to operating out-of-place

    HighCVSS 7.8KEVWeaponizedEPSS 98%

    linux · linux kernelApr 22, 2026

  • CVE-2024-6387
    62This week

    Openssh: regresshion - race condition in ssh allows rce/dos

    HighCVSS 8.1Proof of conceptEPSS 99%

    sonicwall · sma 6200 firmwareJul 1, 2024

  • CVE-2012-4249
    41Plan

    The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute

    CriticalCVSS 10.0No exploitEPSS 3%

    amazon · kindle touchAug 12, 2012

  • CVE-2019-3984
    40Plan

    Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly saniti

    CriticalCVSS 9.8No exploitEPSS 3%

    amazon · blink xt2 sync module firmwareDec 31, 2019

  • CVE-2019-3989
    40Plan

    Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly saniti

    CriticalCVSS 9.8No exploitEPSS 3%

    amazon · blink xt2 sync module firmwareDec 11, 2019

  • CVE-2022-25809
    40Plan

    Improper Neutralization of audio output from 3rd and 4th Generation Amazon Echo Dot devices allows arbitrary voice command execution on thes

    CriticalCVSS 9.8No exploitEPSS 3%

    amazon · echo dot firmwareFeb 24, 2022

  • CVE-2019-18960
    40Plan

    Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0.

    CriticalCVSS 9.8No exploitEPSS 3%

    amazon · firecrackerDec 11, 2019

  • CVE-2020-28472
    40Plan

    This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0.

    CriticalCVSS 9.8No exploitEPSS 2%

    amazon · aws sdk for javasciptJan 19, 2021

  • CVE-2015-7292
    40Plan

    Stack-based buffer overflow in the havok_write function in drivers/staging/havok/havok.c in Amazon Fire OS before 2016-01-15 allows attacker

    CriticalCVSS 9.8No exploitEPSS 1%

    amazon · fire osApr 9, 2017

  • CVE-2024-28056
    39Monitor

    Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects.

    CriticalCVSS 9.8No exploitEPSS 1%

    amazon · aws amplify cliApr 15, 2024

  • CVE-2019-10777
    39Monitor

    In aws-lambda versions prior to version 1.0.5, the "config.FunctioName" is used to construct the argument used within the "exec" function wi

    CriticalCVSS 9.8No exploitEPSS 1%

    amazon · aws lambdaJan 8, 2020

  • CVE-2021-44833
    39Monitor

    The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file.

    CriticalCVSS 9.8No exploitEPSS 1%

    amazon · aws opensearchDec 12, 2021

  • CVE-2021-31571
    39Monitor

    The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation.

    CriticalCVSS 9.8No exploitEPSS 1%

    amazon · freertosApr 22, 2021

  • CVE-2021-31572
    39Monitor

    The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in stream_buffer.c for a stream buffer.

    CriticalCVSS 9.8No exploitEPSS 1%

    amazon · freertosApr 22, 2021

  • CVE-2021-32020
    39Monitor

    The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap memory.

    CriticalCVSS 9.8No exploitEPSS 1%

    amazon · freertosMay 3, 2021

  • CVE-2025-20286
    39Monitor

    ISE on AWS Static Credential

    CriticalCVSS 9.8No exploitEPSS 1%

    cisco · identity services engineJun 4, 2025

  • CVE-2022-4725
    39Monitor

    AWS SDK XML Parser XpathUtils.java XpathUtils server-side request forgery

    CriticalCVSS 9.8No exploitEPSS 0%

    amazon · aws software development kitDec 27, 2022

  • CVE-2020-36363
    39Monitor

    Amazon AWS CloudFront TLSv1.2_2019 allows TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, which some entiti

    CriticalCVSS 9.8No exploitEPSS 0%

    amazon · amazon cloudfrontAug 12, 2021

  • CVE-2012-4248
    38Monitor

    The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow r

    CriticalCVSS 9.3No exploitEPSS 3%

    amazon · kindle touchAug 12, 2012

  • CVE-2021-30354
    37Monitor

    Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in func

    HighCVSS 8.6No exploitEPSS 8%

    amazon · kindle firmwareSep 1, 2021

  • CVE-2021-38112
    37Monitor

    In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote

    HighCVSS 8.8No exploitEPSS 7%

    amazon · aws workspacesSep 21, 2021

  • CVE-2026-77234
    37Monitor

    Improper input validation in FreeRTOS-Kernel timer command handling

    CriticalCVSS 9.3No exploitEPSS 0%

    amazon · freertosAug 21, 2026

  • CVE-2021-30355
    36Monitor

    Amazon Kindle e-reader prior to and including version 5.13.4 improperly manages privileges, allowing the framework user to elevate privilege

    HighCVSS 8.6No exploitEPSS 6%

    amazon · kindle firmwareSep 1, 2021

  • CVE-2018-1169
    36Monitor

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213.

    HighCVSS 8.8No exploitEPSS 2%

    amazon · amazon musicMar 1, 2018