The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
8 Jan 2024 Adobe ColdFusion Remote code execution
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 29 Jan 2024
- Weakness
- CWE-502
8 Jan 2024 Adobe ColdFusion Remote code execution
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 29 Jan 2024
- Weakness
- CWE-502
7 Dec 2023 Qlik Sense Path traversal
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
- What to do
- Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- CISA due date
- 28 Dec 2023
- Weakness
- CWE-20
7 Dec 2023 Qlik Sense Input validation flaw
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.
- What to do
- Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- CISA due date
- 28 Dec 2023
- Weakness
- CWE-444
13 Nov 2023 SysAid Server Path traversal
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- sysaid 23.3.36
- CISA due date
- 4 Dec 2023
- Weakness
- CWE-22
7 Nov 2023 Atlassian Confluence Data Center and Server Access control flaw
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- atlassian confluence data center 8.5.3, atlassian confluence server 8.5.3, atlassian confluence data center 8.4.4, atlassian confluence server 8.4.4, atlassian confluence data center 8.3.4 and 3 older
- CISA due date
- 28 Nov 2023
- Weakness
- CWE-863
2 Nov 2023 Apache ActiveMQ Remote code execution
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache activemq 5.18.3, apache activemq legacy openwire module 5.18.3, apache activemq 5.17.6, apache activemq legacy openwire module 5.17.6, apache activemq 5.16.7 and 3 older
- CISA due date
- 23 Nov 2023
- Weakness
- CWE-502
31 Oct 2023 F5 BIG-IP Configuration Utility Authentication bypass
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 21 Nov 2023
- Weakness
- CWE-288
18 Oct 2023 Citrix NetScaler ADC and NetScaler Gateway Memory corruption
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
- What to do
- Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-8.50, citrix netscaler gateway 14.1-8.50, citrix netscaler application delivery controller 13.1-49.15, citrix netscaler gateway 13.1-49.15, citrix netscaler application delivery controller 13.1-37.164 and 3 older
- CISA due date
- 8 Nov 2023
- Weakness
- CWE-119
5 Oct 2023 Progress WS_FTP Server Remote code execution
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- progress ws ftp server 8.8.2, progress ws ftp server 8.7.4
- CISA due date
- 26 Oct 2023
- Weakness
- CWE-502
5 Oct 2023 Atlassian Confluence Data Center and Server Input validation flaw
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.
- Fixed in (NVD)
- atlassian confluence data center 8.5.2, atlassian confluence server 8.5.2, atlassian confluence data center 8.4.3, atlassian confluence server 8.4.3, atlassian confluence data center 8.3.3 and 1 older
- CISA due date
- 13 Oct 2023
- Weakness
- CWE-20
4 Oct 2023 JetBrains TeamCity Authentication bypass
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- jetbrains teamcity 2023.05.4
- CISA due date
- 25 Oct 2023
- Weakness
- CWE-288
18 Sep 2023 Laravel Ignition Security flaw
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- facade ignition 2.5.2
- CISA due date
- 9 Oct 2023
18 Sep 2023 Zyxel EMG2926 Routers Command injection
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 9 Oct 2023
- Weakness
- CWE-78
13 Sep 2023 Cisco Adaptive Security Appliance and Firepower Threat Defense Authentication bypass
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured. This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured. Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.
- What to do
- Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.
- CISA due date
- 4 Oct 2023
- Weakness
- CWE-288
24 Aug 2023 RARLAB WinRAR Security flaw
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- rarlab winrar 6.23
- CISA due date
- 14 Sep 2023
- Weakness
- CWE-351
22 Aug 2023 Ivanti Sentry Access control flaw
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 12 Sep 2023
- Weakness
- CWE-863
22 Aug 2023 Veeam Backup & Replication Authentication bypass
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- veeam backup & replication 11.0.1.1261
- CISA due date
- 12 Sep 2023
- Weakness
- CWE-306
25 Jul 2023 Ivanti Endpoint Manager Mobile (EPMM) Authentication bypass
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- ivanti endpoint manager mobile 11.10.0.2, ivanti endpoint manager mobile 11.9.1.1, ivanti endpoint manager mobile 11.8.1.1
- CISA due date
- 15 Aug 2023
- Weakness
- CWE-287
19 Jul 2023 Citrix NetScaler ADC and NetScaler Gateway Remote code execution
Unauthenticated remote code execution
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- citrix netscaler application delivery controller 13.1-49.13, citrix netscaler gateway 13.1-49.13, citrix netscaler application delivery controller 13.1-37.159, citrix netscaler application delivery controller 13.0-91.13, citrix netscaler gateway 13.0-91.13 and 1 older
- CISA due date
- 9 Aug 2023
- Weakness
- CWE-94
17 Jul 2023 Microsoft Windows Race condition
Windows Search Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1903, microsoft windows server 2019 10.0.17763.4737, microsoft windows server 2016 10.0.14393.6167, microsoft windows 11 22h2 10.0.22621.2134, microsoft windows 11 21h2 10.0.22000.2295 and 5 older
- CISA due date
- 29 Aug 2023
- Weakness
- CWE-362
11 Jul 2023 Netwrix Auditor Remote code execution
Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.
- What to do
- Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- Fixed in (NVD)
- netwrix auditor 10.5
- CISA due date
- 1 Aug 2023
- Weakness
- CWE-502, CWE-122
13 Jun 2023 Fortinet FortiOS and FortiProxy SSL-VPN Memory corruption
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 4 Jul 2023
- Weakness
- CWE-122
2 Jun 2023 Progress MOVEit Transfer SQL injection
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- progress moveit transfer 2023.0.2, progress moveit transfer 2022.1.6, progress moveit transfer 2022.0.5, progress moveit transfer 2021.1.5, progress moveit transfer 2021.0.7 and 3 older
- CISA due date
- 23 Jun 2023
- Weakness
- CWE-89
1 May 2023 Apache Log4j2 Remote code execution
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens e-car operation center 2021-12-13, siemens industrial edge management hub 2021-12-13, siemens navigator 2021-12-13, siemens mindsphere 2021-12-11, siemens solid edge harness design 2020 and 7 older
- CISA due date
- 22 May 2023
- Weakness
- CWE-917
21 Apr 2023 PaperCut MF/NG Access control flaw
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- papercut mf 22.0.9, papercut ng 22.0.9, papercut mf 21.2.11, papercut ng 21.2.11, papercut mf 20.1.7 and 1 older
- CISA due date
- 12 May 2023
- Weakness
- CWE-284
11 Apr 2023 Microsoft Windows Memory corruption
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows 11 22h2 10.0.22621.1555, microsoft windows 11 21h2 10.0.22000.1817, microsoft windows 10 1809 10.0.17763.4252, microsoft windows 10 1607 10.0.14393.5850, microsoft windows 10 1507 10.0.10240.19869 and 3 older
- CISA due date
- 2 May 2023
- Weakness
- CWE-122
7 Apr 2023 Veritas Backup Exec Agent Authentication bypass
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- veritas backup exec 21.2
- CISA due date
- 28 Apr 2023
- Weakness
- CWE-287
7 Apr 2023 Veritas Backup Exec Agent Authentication bypass
An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- veritas backup exec 21.2
- CISA due date
- 28 Apr 2023
- Weakness
- CWE-287
7 Apr 2023 Veritas Backup Exec Agent Authentication bypass
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- veritas backup exec 21.2
- CISA due date
- 28 Apr 2023
- Weakness
- CWE-287
7 Apr 2023 Microsoft Windows Privilege escalation
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 28 Apr 2023
- Weakness
- CWE-269
30 Mar 2023 Samba Remote code execution
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- samba 4.6.4, samba 4.5.10, samba 4.4.14, samba 4.4.0
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-94
14 Mar 2023 Microsoft Windows Access control flaw
Windows SmartScreen Security Feature Bypass Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1602, microsoft windows server 2019 10.0.17763.4131, microsoft windows server 2016 10.0.14393.5786, microsoft windows 11 22h2 10.0.22000.1413, microsoft windows 11 21h2 10.0.22000.1696 and 5 older
- CISA due date
- 4 Apr 2023
- Weakness
- CWE-863
27 Feb 2023 ZK Framework AuUploader Security flaw
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- zkoss zk framework 9.6.2, zkoss zk framework 9.5.1.3, zkoss zk framework 9.0.1.3, zkoss zk framework 8.6.4.2
- CISA due date
- 20 Mar 2023
- Weakness
- CWE-441
21 Feb 2023 IBM Aspera Faspex Remote code execution
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 14 Mar 2023
- Weakness
- CWE-502
21 Feb 2023 Mitel MiVoice Connect Remote code execution
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 14 Mar 2023
- Weakness
- CWE-94
21 Feb 2023 Mitel MiVoice Connect Command injection
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 14 Mar 2023
- Weakness
- CWE-77
14 Feb 2023 Microsoft Windows Memory corruption
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1540, microsoft windows server 2019 10.0.17763.4010, microsoft windows server 2016 10.0.14393.5717, microsoft windows 11 22h2 10.0.22621.1265, microsoft windows 11 21h2 10.0.22000.1574 and 6 older
- CISA due date
- 7 Mar 2023
- Weakness
- CWE-122
10 Feb 2023 Fortra GoAnywhere MFT Remote code execution
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortra goanywhere managed file transfer 7.1.2
- CISA due date
- 3 Mar 2023
- Weakness
- CWE-502
10 Feb 2023 TerraMaster OS Authentication bypass
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in the response.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- terra-master terramaster operating system 4.2.31
- CISA due date
- 3 Mar 2023
- Weakness
- CWE-306
10 Feb 2023 Intel Ethernet Diagnostics Driver for Windows Input validation flaw
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 Mar 2023
- Weakness
- CWE-20
2 Feb 2023 Oracle E-Business Suite Authentication bypass
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 23 Feb 2023
- Weakness
- CWE-306
26 Jan 2023 Telerik User Interface (UI) for ASP.NET AJAX Malicious file upload
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform arbitrary file uploads or execute arbitrary code.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- progress telerik ui for asp.net ajax 2020.1.114
- CISA due date
- 16 Feb 2023
- Weakness
- CWE-20
23 Jan 2023 Zoho ManageEngine Input validation flaw
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- zohocorp manageengine pam360 5.7, zohocorp manageengine ad360 4.3, zohocorp manageengine servicedesk plus 14.0, zohocorp manageengine servicedesk plus msp 13.0, zohocorp manageengine password manager pro 12.1 and 7 older
- CISA due date
- 13 Feb 2023
- Weakness
- CWE-20
10 Jan 2023 Microsoft Exchange Server Security flaw
Microsoft Exchange Server Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 31 Jan 2023
13 Dec 2022 Microsoft Defender Security flaw
Windows SmartScreen Security Feature Bypass Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1366, microsoft windows server 2019 10.0.17763.3770, microsoft windows server 2016 10.0.14393.5582, microsoft windows 11 21h2 10.0.22000.1335, microsoft windows 10 1809 10.0.17763.3770 and 5 older
- CISA due date
- 3 Jan 2023
- Weakness
- CWE-755
13 Dec 2022 Fortinet FortiOS Memory corruption
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 7.2.3, fortinet fortiproxy 7.2.2, fortinet fortios 7.0.9, fortinet fortiproxy 7.0.8, fortinet fortios 7.0.8 and 6 older
- CISA due date
- 3 Jan 2023
- Weakness
- CWE-197
13 Dec 2022 Veeam Backup & Replication Authentication bypass
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- veeam backup & replication 11.0.1.1261, veeam backup & replication 10.0.1.4854
- CISA due date
- 3 Jan 2023
- Weakness
- CWE-306
13 Dec 2022 Veeam Backup & Replication Path traversal
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- veeam backup & replication 11.0.1.1261, veeam backup & replication 10.0.1.4854
- CISA due date
- 3 Jan 2023
- Weakness
- CWE-22
8 Nov 2022 Microsoft Windows Access control flaw
Windows Mark of the Web Security Feature Bypass Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1249, microsoft windows server 2019 10.0.17763.3650, microsoft windows server 2016 10.0.14393.5501, microsoft windows 11 22h2 10.0.22621.819, microsoft windows 11 21h2 10.0.22000.1219 and 7 older
- CISA due date
- 9 Dec 2022
- Weakness
- CWE-863
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.