Designer Vulnerabilities

Below is a (mostly chronological) list of vulnerabilities that have “designer” names.

Total vulnerabilities:

• Bleichenbacher 1 million message attack (1998)
• Pizza Thief (CVE-1999-0351)
• DHEat (CVE-2002-20001)
• Etherleak (CVE-2003-0001)
• EDUCATEDSCHOLAR (CVE-2009-2532 & CVE-2009-3103)
• Evil Maid (1/2009)
• Cloudburst (6/2009)
• Tor’s Hammer (Early 2011)
• BEAST (CVE-2011-3389)
• Alert (2/2012)
• CRIME/TIME (CVE-2012-4929)
• BREACH (9/2012)
• Lucky Thirteen (CVE-2013-0169)
• Cookie Cutter (CVE-2013-2853)
• 3SHAKE (CVE-2013-6628 & more)
• Heartbleed (CVE-2014-0160)
• goto fail; (CVE-2014-1266)
• BERserk (CVE-2014-1568)
• Drupalgeddon (CVE-2014-3704)
• SandWorm (CVE-2014-4114)
• BadUSB (CVE-2014-4115)
• Thunderstrike (CVE-2014-4498)
• Shellshock (CVE-2014-6271)
• SKIP-TLS/SMACK (CVE-2014-6593 & CVE-2015-0205)
• POODLE (CVE-2014-8730)
• SENTER Sandman (2014)
• CREAM (11/2014)
• Diamond PAC (11/2014)
• FREAK/SMACK (CVE-2015-0204, 1067, 1637 & 2235)
• GHOST (CVE-2015-0235)
• Stagefright (CVE-2015-1538 & more)
• Superfish (CVE-2015-2077)
• BarMitzvah (CVE-2015-2808)
• Venom (CVE-2015-3456)
• Thunderstrike 2 (CVE-2015-3692)
• Rowhammer (CVE-2015-3693)
• Logjam (CVE-2015-4000)
• SLOTH (CVE-2015-7575)
• Drown (CVE-2016-0800)
• Badlock (CVE-2016-2118)
• Sweet32 (CVE-2016-2183)
• Rotten Potato (CVE-2016-3225)
• ImageTragick (CVE-2016-3714 & more)
• Dirty COW (CVE-2016-5195)
• Boomerang (CVE-2016-5349 & CVE-2016-8762-CVE-2016-8764)
• HEIST (CVE-2016-7152 & more)
• DUHK (CVE-2016-8492)
• unholy PAC (8/2016)
• SHAttered (1/2017)
• Cloudbleed (2/2017)
• alloc8 (4/2017)
• ETERNALBLUE (CVE-2017-0143 & CVE-2017-0144)
• ETERNALROMANCE (CVE-2017-0145)
• Spectre (CVE-2017-5715 & CVE-2017-5753)
• Meltdown (CVE-2017-5754)
• ROBOT (CVE-2017-6168 & more)
• SambaCry/EternalRed (CVE-2017-7494)
• Devil’s Ivy (CVE-2017-9765)
• OptionsBleed (CVE-2017-9798)
• KRACK (CVE-2017-13077 & more)
• BlueBorne (CVE-2017-14315 & more)
• EFAIL (CVE-2017-17688 & CVE-2017-17689)
• BroadPwn (7/2017)
• Epochalypse (7/2017)
• CLKSCREW (8/2017)
• DynoRoot (CVE-2018-1111)
• Foreshadow (CVE-2018-3615)
• Foreshadow-NG (CVE-2018-3620 & CVE-2018-3646)
• Lazy FP State Restore (CVE-2018-3665)
• SegmentSmack (CVE-2018-5390)
• FragmentSmack (CVE-2018-5391)
• PortSmash (CVE-2018-5407)
• BLEEDINGBIT (CVE-2018-7080 & CVE-2018-16986)
• Drupalgeddon 2 (CVE-2018-7600)
• Fallout (CVE-2018-12126)
• RIDL (CVE-2018-12127)
• ZombieLoad (CVE-2018-12130 & CVE-2019-11091)
• BranchScope (3/2018)
• ZipperDown (5/2018)
• NetSpectre (2018)
• TLBleed (8/2018)
• WebExec (CVE-2018-15442)
• Magellan (CVE-2018-20346, 20505 & 20506)
• RAMBleed (CVE-2019-0174)
• SMoTherSpectre (3/2019)
• MachSwap (4/2019)
• readfile (CVE-2019-0636)
• BlueKeep (CVE-2019-0708)
• angrypolarbearbug (CVE-2019-0863)
• Drop the MIC (CVE-2019-1040)
• SWAPGS (CVE-2019-1125)
• Drop the MIC 2 (CVE-2019-1166)
• DejaBlue (CVE-2019-1181 & CVE-2019-1182)
• Ghost Potato (CVE-2019-1384)
• Qu1ckR00t (CVE-2019-2215)
• PAYDAY (CVE-2019-2633 & CVE-2019-2638)
• pantsdown (CVE-2019-6260)
• Zombie POODLE (CVE-2019-6485)
• GOLDENDOODLE (2/2019)
• SockPuppet (CVE-2019-8605)
• ShazLocate! (CVE-2019-8791 & CVE-2019-8792)
• KNOB (CVE-2019-9506)
• Data Dribble (CVE-2019-9511)
• Ping Flood (CVE-2019-9512)
• Resource Loop (CVE-2019-9513)
• Reset Flood (CVE-2019-9514)
• Settings Flood (CVE-2019-9515)
• ZombieLoad v2 (CVE-2019-11135)
• Plundervolt / V0LTpwn (CVE-2019-11157)
• NetCAT (CVE-2019-11184 & more)
• SACK PANIC (CVE-2019-11477)
• URGENT/11 (CVE-2019-12255 & more)
• Dragonblood (CVE-2019-13377 & CVE-2019-13456)
• AirDoS (8/2019)
• Magellan 2.0 (CVE-2019-13734, 13750-13753)
• NUCLEUS:13 (CVE-2019-13939, CVE-2020-15795 & more)
• SHAmbles (CVE-2019-14855)
• Spectra (CVE-2019-15063 & more)
• Kr00k (CVE-2019-15126)
• SweynTooth (CVE-2019-16336 & more)
• Cable Haunt (CVE-2019-19494 & CVE-2019-19495)
• Shitrix (CVE-2019-19781)
• VoltJockey (11/2019)
• wInd3x (2020)
• StrandHogg (CVE-2020-0096)
• CopyCat (2/2020)
• BlueFrag (CVE-2020-0022)
• CrossTalk (CVE-2020-0543)
• CacheOut & SGAxe (CVE-2020-0549)
• LVI “Load Value Injection” (CVE-2020-0551)
• ChainOfFools/CurveBall (CVE-2020-0601)
• BlueGate (CVE-2020-0609 & CVE-2020-0610)
• SMBGhost/CoronaBlue/EternalDarkness (CVE-2020-0796)
• PrintDemon (CVE-2020-1048)
• FaxHell (4/2020)
• SMBleed (CVE-2020-1206)
• EvilPrinter (CVE-2020-1300)
• SMBLost (CVE-2020-1301)
• SIGRed (CVE-2020-1350)
• GlueBall (CVE-2020-1464)
• ZeroLogon (CVE-2020-1472)
• Raccoon Attack (CVE-2020-1596, CVE-2020-1968 & CVE-2020-5929)
• Ghostcat (CVE-2020-1938)
• BigDebIT (CVE-2020-2586 & CVE-2020-2587)
• CDPwn (CVE-2020-3110, 3111, 3118, 3119 & 3120)
• Thunderspy (4/2020)
• RECON (CVE-2020-6287)
• ELECTRIC CHROME (CVE-2020-6418)
• Gateway2Hell (CVE-2020-8257 & CVE-2020-8258)
• PLATYPUS (CVE-2029-8694 & CVE-2020-8695)
• Shadow Attacks (CVE-2020-9592 & CVE-2020-9596)
• Unauthd (CVE-2020–9854)
• BIAS (CVE-2020-10135)
• DABANGG (6/2020)
• SYLKin (6/2020)
• BootHole (CVE-2020-10713)
• Achilles (CVE-2020-11201 & more)
• Ripple20 (CVE-2020-11896 through CVE-2020-11901)
• BleedingTooth (CVE-2020-12351)
• CallStranger (CVE-2020-12695)
• ZombieVPN (CVE-2020-12828)
• BadAlloc (CVE-2020-13603 & more)
• SLS (CVE-2020-13844)
• AMNESIA:33 (CVE-2020-13984 & more)
• BadPower (7/2020)
• SiteCloak (7/2020)
• EtherOops (8/2020)
• ReVoLTE (8/2020)
• ContainerDrip (CVE-2020-15157)
• BLURtooth (CVE-2020-15802)
• Kraken (9/2020)
• Bad Neighbor (CVE-2020-16898)
• “Ping of Death” 2020 (CVE-2020-16899)
• bits please! (CVE-2020-16938)
• DOS2RCE (10/2020)
• Kerberos Bronze Bit (CVE-2020-17049)
• Plug’nPwn (10/2020)
• SAD DNS (CVE-2020-25705)
• INFRA:HALT (CVE-2020-25767 & more)
• NUMBER:JACK (CVE-2020-27213 & more)
• KOFFEE (11/2020)
• XS-Leak (12/2020)
• SpecROP (2020)
• KISMET (12/2020)
• DNSpooq (1/2021)
• KindleDrip (1/2021)
• SmashEx (CVE-2021-0186)
• RemotePotato0 (4/2021)
• ALHACK (CVE-2021-0674, CVE-2021-0675 & CVE-2021-30351)
• PrintNightmare (CVE-2021-1675 & CVE-2021-34527)
• Mistune (CVE-2021-1748 & CVE-2021-1864)
• Baron Samedit/pwnEDIT (CVE-2021-3156)
• Blue Klotski (CVE-2021-3573)
• PwnKit (CVE-2021-4034)
• vScalation (CVE-2021-22015)
• ModiPwn (CVE-2021-22779)
• Packet of the Death (CVE-2021-24086)
• failStrike (CVE-2021-24348)
• FragAttack (CVE-2020-24586 & more)
• ISaPWN (CVE-2020-25176, CVE-2020-25180 and CVE-2020-25182)
• Blackswan (CVE-2021-26442 & more)
• ProxyLogon (CVE-2021-26855)
• SMASH (3/2021)
• NAME:WRECK (4/2021)
• Evil Maid (Vacuum) (4/2021)
• Relaying Potatoes (4/2021)
• PrivateDrop (4/2021)
• 21Nails (CVE-2020-28017 & more)
• BRAKTOOTH (CVE-2021-28139 & more)
• Airstrike Attack (CVE-2021-28316)
• tsuNAME (5/2021)
• Half-Double (5/2021)
• MouseTrap (CVE-2021-27569 - CVE-2021-27574 | Vuln List)
• Talkative Marmot (CVE-2021-28500)
• M1RACLES (CVE-2021-30747)
• FORCEDENTRY (CVE-2021-30860)
• Shrootless (CVE-2021-30892)
• powerdir (CVE-2021-30970)
• ProxyOracle (CVE-2021-31195 & CVE-2021-31196)
• ProxyShell (CVE-2021-31207, CVE-2021-34473 & CVE-2021-34523)
• ALPACA (CVE-2021-31971)
• Process Ghosting (6/2021)
• WiFiDemon (7/2021)
• ProxyToken (CVE-2021-33766)
• LATENTIMAGE (1/2022)
• SymStealer (CVE-2022-3656)
• ProxyRelay (CVE-2021-33768, CVE-2022-21979 & CVE-2021-26414)
• Sequoia (CVE-2021-33909)
• Trivial Authentication (CVE-2021-36367, 36368 & 36369)
• Hotcobalt (CVE-2021-36798)
• HiveNightmare / SeriousSAM (CVE-2021-36934)
• MarkdownTime (CVE-2022-2931 & CVE-2022-39209)
• PetitPotam (CVE-2022-26925)
• FINDMYPWN (6/2022)
• EfsPotato (8/2021)
• Glowworm Attack (8/2021)
• ChaosDB (8/2021)
• SPARROW (CVD-2021-0045 | 8/2021)
• VoltPillager (8/2021)
• PwnedPiper (CVE-2021-37160 & more)
• OMIGOD (CVE-2021-38645, 38647, 38648 & 38649)
• Printer Shellz (CVE-2021-39237 & CVE-2021-39238)
• CallbackHell (CVE-2021-40449)
• Demon’s Cries (CVE-2021-40866)
• Draconian Fear (CVE-2021-40867)
• Seventh Inferno (CVE-2021-41314)
• Azurescape (9/2021)
• Spook.js (9/2021)
• LANTENNA (10/2021)
• Gummy Browsers (10/2021)
• PWNYOURHOME (10/2021)
• InstallerFileTakeOver (CVE-2021-41379)
• Blacksmith (CVE-2021-42114)
• Doller Ticket (CVE-2021-42278, CVE-2021-42282 & CVE-2021-42291)
• CredManifest (CVE-2021-42306)
• ProxyNotRelay (CVE-2021-42321)
• Trojan Source (CVE-2021-42574 & CVE-2021-42694)
• BigSig (CVE-2021-43527)
• Log4Shell (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, CVE-2021-4104 & CVE-2021-44832)
• NotLegit (12/2021)
• Rolling-PWN (CVE-2021-46145)
• SQUIP (CVE-2021-46778)
• doorLock (1/2022)
• TLStorm (CVE-2022-0715 & more)
• cr8escape (CVE-2022-0811)
• Dirty Pipe (CVE-2022-0847)
• Y2K22 (1/2022)
• NoReboot (1/2022)
• Superglue (1/2022)
• DrawnApart (1/2022)
• JekyllBot:5 (CVE-2022-1059, 1066, 1070, 26423, 27494)
• DirtyCred (CVE-2022-2588)
• EntryBleed (CVE-2022-4543)
• ÆPIC Leak (CVE-2022-21233)
• Psychic Signatures (CVE-2022-21449)
• SpoolFool (CVE-2022-22718)
• Windows Dirty Pipe (CVE-2022-22715)
• XMPP Stanza Smuggling (CVE-2022-22784, CVE-2022-22785, CVE-2022-22786 and CVE-2022-22787)
• Spring4Shell/SpringShell (CVE-2022-22965 & CVE-2010-1622)
• TLStorm 2 (CVE-2022-23676, 23677, 29860 & 29861)
• Hertzbleed (CVE-2022-23823 & CVE-2022-24436)
• GitBleed (CVE-2022-24975)
• Unbridled Optimism (2/2022)
• Ice Phishing (2/2022)
• BrokenPrint (2/2022)
• Golden GMSA Attack (3/2022)
• RevEAL (3/2022)
• AutoWarp (3/2022)
• Access:7 (CVE-2022-25249 & more)
• TP240PhoneHome (CVE-2022-26143)
• Branch History Injection (3/2022)
• Browser in the Browser (BITB) Attack (3/2022)
• Brokenwire (4/2022)
• NotGitBleed (4/2022)
• Frozen Heart (4/2022)
• Certifried (CVE-2022-26923)
• Nimbuspwn (CVE-2022-29799 & CVE-2022-29800)
• Package Planting (4/2022)
• ExtraReplica (4/2022)
• Augury (4/2022)
• Retbleed (CVE-2022-29900 & CVE-2022-29901)
• OT:ICEFALL (CVE-2022-29952 & 55 more)
• SynLapse (CVE-2022-29972)
• CrateDepression (5/2022)
• ExplosION (5/2022)
• GhostTouch (5/2022)
• FabricScape (CVE-2022-30137)
• Follina (CVE-2022-30190)
• PACMAN (6/2022)
• GhostToken (6/2022)
• SiriSpy (CVE-2022-32946)
• Demonic (CVE-2022-32969)
• Screams of Power (CVE-2022-33174 & CVE-2022-33175)
• FirmwareBleed (7/2022)
• SATAn (7/2022)
• PassBleed (7/2022)
• ParseThru (8/2022)
• Paracosme (CVE-2022-33318)
• DogWalk (CVE-2022-34713)
• EvilESP (CVE-2022-34718)
• The Miracle Exploit (CVE-2022-35587)
• Evil PLC (8/2022)
• ETHERLED (8/2022)
• GIFShell (9/2022)
• Spell-Jacking (9/2022)
• AttachMe (9/2022)
• FabriXss (CVE-2022-35829)
• Sandbreak (CVE-2022-36067)
• OverLog (CVE-2022-37981)
• Crowbleed (CVE-2022-38668)
• ProxyNotShell¹ (CVE-2022–41040 & CVE-2022–41082)
• OWASSRF (CVE-2022–41080 + CVE-2022–41082)
• Dirty Vanity (10/2022)
• Text4Shell (CVE-2022-42889)
• LogCrusher (10/2022)
• ZippyReads (CVE-2022-41091)
• Leeloo Multipath (CVE-2022-41973 & CVE-2022-41974)
• PCspooF (11/2022)
• SyncJacking (11/2022)
• LCDPwn (12/2022)
• Hell’s Keychain (12/2022)
• CertPotato (12/2022)
• COVID-bit (12/2022)
• Achilles (CVE-2022-42821)
• Blindside (12/2022)
• ACSESSED (12/2022)
• PMFault (CVE-2022-43309)
• ENLBufferPwn (CVE-2022-47949)
• Headroll (CVE-2023-0704)
• aCropalypse (CVE-2023-21036 & CVE-2023-28303)
• QueueJumper (CVE-2023-21554)
• bitpixie (CVE-2023-21563)
• LocalPotato (CVE-2023-21746)
• Blank Image (1/2023)
• EmojiDeploy (1/2023)
• SH1MMER (1/2023)
• NVLeak (3/2023)
• Polynonce (3/2023)
• Super FabriXss (CVE-2023-23383)
• Bad Appointment (CVE-2023-23397)
• PwnAgent (CVE-2023-24749)
• FriendlyName (CVE-2023-27217)
• CorePlague (CVE-2023-27898 & CVE-2023-27905)
• Red pills (3/2023)
• BingBang (3/2023)
• WarpAttack (4/2023)
• Shadow Ban (CVE-2023-29218)
• Dirty Vanity (4/2023)
• BrokenSesame (4/2023)
• PPLFault (5/2023)
• GodFault (5/2023)
• BrutePrint (5/2023)
• Hot Pixels (5/2023)
• Migraine (CVE-2023-32369)
• ZipJar (6/2023)

*Disclaimer: This is a best effort at getting all “named” vulnerabilities. It’s very likely I have missed a few.

Feel free to let me know if there are any vulns I am missing! This list will continue to be updated as new named vulnerabilities are announced.

Shout-Outs

- These names are not be confused with those produced by vulnonym.
- Shout out to the folks at 0day.marketing - we have them to thank for some of this madness =).
- I’d like to call out this site which has provided a useful timeline for low-level attacks.
- Cheers to nate at GreyNoise for crediting my list as data-inspiration for this cool infographic and timeline.

CVE Search

Use the search box below to query the NVD or MITRE database(s) for more information on other vulnerabilities!

^{Search for a particular CVE value or any other search term (e.g. “Heartbleed”)}