The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
8 Nov 2022 Microsoft Windows Memory corruption
Windows Print Spooler Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1249, microsoft windows server 2019 10.0.17763.3650, microsoft windows server 2016 10.0.14393.5501, microsoft windows 11 22h2 10.0.22621.819, microsoft windows 11 21h2 10.0.22000.1219 and 7 older
- CISA due date
- 9 Dec 2022
- Weakness
- CWE-787
24 Oct 2022 Cisco AnyConnect Secure Security flaw
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- cisco anyconnect secure mobility client 4.9.00086
- CISA due date
- 14 Nov 2022
- Weakness
- CWE-427
24 Oct 2022 Cisco AnyConnect Secure Security flaw
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- cisco anyconnect secure mobility client 4.8.02042
- CISA due date
- 14 Nov 2022
- Weakness
- CWE-427
24 Oct 2022 GIGABYTE Multiple Products Security flaw
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- gigabyte aorus graphics engine 1.57, gigabyte xtreme gaming engine 1.26
- CISA due date
- 14 Nov 2022
24 Oct 2022 GIGABYTE Multiple Products Security flaw
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- gigabyte aorus graphics engine 1.57, gigabyte xtreme gaming engine 1.26
- CISA due date
- 14 Nov 2022
- Weakness
- CWE-749
24 Oct 2022 GIGABYTE Multiple Products Security flaw
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- gigabyte app center 19.0422.1, gigabyte aorus graphics engine 1.57, gigabyte xtreme gaming engine 1.26
- CISA due date
- 14 Nov 2022
24 Oct 2022 GIGABYTE Multiple Products Security flaw
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- gigabyte app center 19.0422.1, gigabyte aorus graphics engine 1.57, gigabyte xtreme gaming engine 1.26
- CISA due date
- 14 Nov 2022
20 Oct 2022 Synacor Zimbra Collaboration Suite (ZCS) Path traversal
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Nov 2022
- Weakness
- CWE-22
11 Oct 2022 Fortinet Multiple Products Authentication bypass
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 7.2.2, fortinet fortiproxy 7.0.7, fortinet fortios 7.0.7
- CISA due date
- 1 Nov 2022
- Weakness
- CWE-288
30 Sep 2022 Microsoft Exchange Server Remote code execution
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 21 Oct 2022
- Weakness
- CWE-502
30 Sep 2022 Microsoft Exchange Server Server-side request forgery
Microsoft Exchange Server Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 21 Oct 2022
- Weakness
- CWE-918
14 Sep 2022 Microsoft Windows Memory corruption
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1006, microsoft windows server 2019 10.0.17763.3406, microsoft windows server 2016 10.0.14393.5356, microsoft windows 11 21h2 10.0.22000.978, microsoft windows 10 1809 10.0.17763.3406 and 5 older
- CISA due date
- 5 Oct 2022
- Weakness
- CWE-20, CWE-787
8 Sep 2022 QNAP Photo Station Security flaw
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- qnap photo station 6.1.2, qnap photo station 6.0.22, qnap photo station 5.7.18, qnap photo station 5.4.15, qnap photo station 5.2.14
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-610
8 Sep 2022 D-Link Multiple Routers Command injection
OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.
- What to do
- The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-78
8 Sep 2022 Fortinet FortiOS and FortiADC Access control flaw
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 6.0.3, fortinet fortiadc 6.0.2, fortinet fortiadc 5.4.5
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-732
25 Aug 2022 dotCMS Path traversal
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-22, CWE-138
25 Aug 2022 WebRTC Memory corruption
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 103.0.5060.114, apple ipados 15.6, apple iphone os 15.6, apple tvos 15.6, apple macos 12.5 and 5 older
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-122
11 Aug 2022 Synacor Zimbra Collaboration Suite (ZCS) Path traversal
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Sep 2022
- Weakness
- CWE-23
11 Aug 2022 Synacor Zimbra Collaboration Suite (ZCS) Path traversal
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Sep 2022
- Weakness
- CWE-22
9 Aug 2022 RARLAB UnRAR Path traversal
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- rarlab unrar 6.12
- CISA due date
- 30 Aug 2022
- Weakness
- CWE-22, CWE-59
4 Aug 2022 Synacor Zimbra Collaboration Suite (ZCS) Input validation flaw
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 25 Aug 2022
- Weakness
- CWE-93
27 Jun 2022 Mitel MiVoice Connect Input validation flaw
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-20
27 Jun 2022 Red Hat Polkit Memory corruption
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens scalance lpe9403 firmware 2.0, polkit project polkit 121, siemens sinumerik edge 3.3.0
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-787
14 Jun 2022 Microsoft Windows Security flaw
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.770, microsoft windows server 2019 10.0.17763.3046, microsoft windows server 2016 10.0.14393.5192, microsoft windows server 20h2 10.0.19042.1766, microsoft windows 11 21h2 10.0.22000.739 and 6 older
- CISA due date
- 5 Jul 2022
- Weakness
- CWE-610
8 Jun 2022 QNAP Photo Station Path traversal
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- qnap photo station 6.0.3, qnap photo station 5.7.10, qnap photo station 5.4.9, qnap photo station 5.2.11
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-22
8 Jun 2022 QNAP Photo Station Path traversal
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- qnap photo station 6.0.3, qnap photo station 5.7.10, qnap photo station 5.4.9, qnap photo station 5.2.11
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-22
8 Jun 2022 QNAP QTS Input validation flaw
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-20
8 Jun 2022 QNAP Photo Station Access control flaw
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- qnap photo station 6.0.3, qnap photo station 5.7.10, qnap photo station 5.4.9, qnap photo station 5.2.11
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-863
2 Jun 2022 Atlassian Confluence Server/Data Center Remote code execution
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
- What to do
- Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
- Fixed in (NVD)
- atlassian confluence data center 7.17.4, atlassian confluence server 7.17.4, atlassian confluence data center 7.16.4, atlassian confluence server 7.16.4, atlassian confluence data center 7.15.2 and 7 older
- CISA due date
- 6 Jun 2022
- Weakness
- CWE-917
25 May 2022 Microsoft Silverlight Input validation flaw
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
- What to do
- The impacted products are end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- microsoft silverlight 5.1.41212.0
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-20
25 May 2022 IBM InfoSphere BigInsights Path traversal
IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified API calls.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- ibm infosphere biginsights 2.1.0.3
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-264
25 May 2022 Oracle Java Runtime Environment (JRE) Security flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-693
25 May 2022 Oracle Java Runtime Environment (JRE) Access control flaw
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-264
25 May 2022 Microsoft Silverlight Security flaw
Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- microsoft silverlight 5.1.20125.0
- CISA due date
- 15 Jun 2022
25 May 2022 Oracle Fusion Middleware Security flaw
Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a different vulnerability than CVE-2012-1709.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
25 May 2022 Red Hat JBoss Security flaw
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-264
25 May 2022 Red Hat JBoss Security flaw
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-264
24 May 2022 QNAP Network Attached Storage (NAS) Cross-site scripting
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- qnap qts 4.4.2.1231, qnap qts 4.4.1.1201, qnap qts 4.3.6.1218, qnap qts 4.3.4.1190, qnap qts 4.3.3.1161 and 1 older
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-79, CWE-80
24 May 2022 QNAP Network Attached Storage (NAS) Command injection
If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- qnap qts 4.4.2.1231, qnap qts 4.4.1.1201, qnap qts 4.3.6.1218, qnap qts 4.3.4.1190, qnap qts 4.3.3.1161 and 1 older
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-20, CWE-77, CWE-78
24 May 2022 QNAP Network Attached Storage (NAS) Cross-site scripting
If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the following QTS versions. QTS 4.4.2.1270 build 20200410 and later QTS 4.4.1.1261 build 20200330 and later QTS 4.3.6.1263 build 20200330 and later QTS 4.3.4.1282 build 20200408 and later QTS 4.3.3.1252 build 20200409 and later QTS 4.2.6 build 20200421 and later
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- qnap qts 4.4.2.1270, qnap qts 4.4.1.1261, qnap qts 4.3.6.1263, qnap qts 4.3.4.1282, qnap qts 4.3.3.1252 and 1 older
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-79, CWE-80
24 May 2022 Kaseya Virtual System/Server Administrator (VSA) SQL injection
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-89
24 May 2022 Microsoft SMBv1 server Information disclosure
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka "Windows SMB Information Disclosure Vulnerability."
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens acuson sc2000 firmware 4.0e, siemens syngo sc2000 firmware 4.0e
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-200
24 May 2022 Microsoft Internet Explorer and Edge Information disclosure
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-200
On Hacker News
Microsoft Patches CVE-2016-3351 Zero-Day, Exploited23 May 2022 Microsoft Update Notification Manager Path traversal
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-59
23 May 2022 Microsoft Windows Path traversal
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-59
23 May 2022 Microsoft Windows Path traversal
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1129.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-59
10 May 2022 F5 BIG-IP Authentication bypass
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- f5 big-ip access policy manager 16.1.2.2, f5 big-ip access policy manager 15.1.5.1, f5 big-ip access policy manager 14.1.4.6, f5 big-ip access policy manager 13.1.5, f5 big-ip analytics 16.1.2.2 and 7 older
- CISA due date
- 31 May 2022
- Weakness
- CWE-306
On Hacker News
F5 BIG-IP RCE exploitation (CVE-2022-1388)25 Apr 2022 WSO2 Multiple Products Path traversal
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 16 May 2022
- Weakness
- CWE-22
19 Apr 2022 Synacor Zimbra Collaboration Suite (ZCS) Cross-site scripting
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- synacor zimbra collaboration suite 8.7.0
- CISA due date
- 10 May 2022
- Weakness
- CWE-79
15 Apr 2022 D-Link DNS-320 Storage Device Command injection
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 6 May 2022
- Weakness
- CWE-78
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.