The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
14 Apr 2022 VMware Workspace ONE Access and Identity Manager Remote code execution
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 May 2022
- Weakness
- CWE-94
13 Apr 2022 Microsoft Windows Memory corruption
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.643, microsoft windows server 2019 10.0.17763.2803, microsoft windows server 2016 10.0.14393.5066, microsoft windows server 20h2 10.0.19042.1645, microsoft windows 11 21h2 10.0.22000.613 and 6 older
- CISA due date
- 4 May 2022
- Weakness
- CWE-787, CWE-1285
13 Apr 2022 Drupal Core Remote code execution
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 8.5.3, drupal 8.4.8, drupal 7.59
- CISA due date
- 4 May 2022
- Weakness
- CWE-94
13 Apr 2022 Kaseya Virtual System/Server Administrator (VSA) Security flaw
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- kaseya virtual system administrator 9.5.0.5, kaseya virtual system administrator 9.4.0.36, kaseya virtual system administrator 9.3.0.35
- CISA due date
- 4 May 2022
11 Apr 2022 Microsoft Active Directory Privilege escalation
Active Directory Domain Services Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.350, microsoft windows server 2019 10.0.17763.2300, microsoft windows server 2016 10.0.14393.4770, microsoft windows server 2004 10.0.19041.1348, microsoft windows server 20h2 10.0.19042.1348
- CISA due date
- 2 May 2022
- Weakness
- CWE-269
11 Apr 2022 Microsoft Active Directory Input validation flaw
Active Directory Domain Services Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.350, microsoft windows server 2019 10.0.17763.2300, microsoft windows server 2016 10.0.14393.4770, microsoft windows server 2004 10.0.19041.1348, microsoft windows server 20h2 10.0.19042.1348
- CISA due date
- 2 May 2022
- Weakness
- CWE-20
6 Apr 2022 Microsoft SMBv1 server Input validation flaw
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens acuson sc2000 firmware 4.0e
- CISA due date
- 27 Apr 2022
- Weakness
- CWE-20
31 Mar 2022 QNAP Network Attached Storage (NAS) Access control flaw
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- qnap hybrid backup sync 16.0.0419, qnap hybrid backup sync 16.0.0415, qnap hybrid backup sync 3.0.210412, qnap hybrid backup sync 3.0.210411
- CISA due date
- 21 Apr 2022
- Weakness
- CWE-285
31 Mar 2022 Dasan Gigabit Passive Optical Network (GPON) Routers Command injection
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 21 Apr 2022
- Weakness
- CWE-78
28 Mar 2022 Microsoft Office Security flaw
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
28 Mar 2022 Atlassian Confluence Server Access control flaw
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- atlassian confluence data center 7.12.3, atlassian confluence server 7.12.3, atlassian confluence data center 7.4.10, atlassian confluence server 7.4.10
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-425
28 Mar 2022 SonicWall Secure Remote Access (SRA) SQL injection
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running all 8.x firmware and 9.0.0.9-26sv or earlier
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- sonicwall sra 4600 firmware 9.0.0.10-28sv, sonicwall sra 1600 firmware 9.0.0.10-28sv, sonicwall sma 500v firmware 9.0.0.10-28sv, sonicwall sma 410 firmware 9.0.0.10-28sv, sonicwall sma 210 firmware 9.0.0.10-28sv and 1 older
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-89
28 Mar 2022 Microsoft Windows Security flaw
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
28 Mar 2022 Microsoft DirectX Graphics Kernel (DXGKRNL) Denial of service
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8405.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-404
28 Mar 2022 Microsoft DirectX Graphics Kernel (DXGKRNL) Denial of service
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-404
28 Mar 2022 Microsoft Windows Security flaw
Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
28 Mar 2022 Microsoft Internet Explorer Memory corruption
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-119
28 Mar 2022 Microsoft Client-Server Run-time Subsystem (CSRSS) Privilege escalation
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-264
28 Mar 2022 Microsoft Internet Explorer Memory corruption
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-416
28 Mar 2022 Oracle Java SE Security flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-693
25 Mar 2022 Microsoft Windows Path traversal
Windows Print Spooler Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.524, microsoft windows server 2019 10.0.17763.2565, microsoft windows server 2016 10.0.14393.4946, microsoft windows server 20h2 10.0.19042.1526, microsoft windows 11 21h2 10.0.22000.493 and 7 older
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-40, CWE-1386
25 Mar 2022 Sitecore XP Remote code execution
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-502
25 Mar 2022 Citrix ShareFile Access control flaw
Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix sharefile storagezones controller 5.11.20
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-284
25 Mar 2022 Palo Alto Networks PAN-OS Weak cryptography
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- paloaltonetworks pan-os 9.1.3, paloaltonetworks pan-os 9.0.9, paloaltonetworks pan-os 8.1.15
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-347
25 Mar 2022 Webmin Command injection
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-78
25 Mar 2022 PHP FastCGI Process Manager (FPM) Memory corruption
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- php 7.3.11, php 7.2.24, php 7.1.33, tenable.sc 5.19.0
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-120
25 Mar 2022 VMware Tanzu Spring Data Commons Remote code execution
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-94
25 Mar 2022 Quest KACE System Management Appliance Command injection
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-78
25 Mar 2022 Apache Tomcat Malicious file upload
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-434
On Hacker News
Remote code execution in Apache Tomcat 7.0 11 comments25 Mar 2022 Microsoft Windows Input validation flaw
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-20
25 Mar 2022 Adobe ColdFusion Path traversal
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-22
15 Mar 2022 SonicWall SonicOS Memory corruption
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. This vulnerability affected SonicOS Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-120
15 Mar 2022 Microsoft Windows Privilege escalation
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-269
15 Mar 2022 Microsoft Windows Security flaw
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1320, CVE-2019-1340.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
15 Mar 2022 Microsoft Windows Path traversal
An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1339, CVE-2019-1342.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-59
15 Mar 2022 Microsoft Windows Path traversal
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-59
15 Mar 2022 Microsoft Windows Path traversal
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1130.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-59
15 Mar 2022 Microsoft Task Scheduler Path traversal
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system. The security update addresses the vulnerability by correctly validating file operations.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-59
15 Mar 2022 Microsoft Windows Path traversal
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install programs; view, change or delete data. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The security update addresses the vulnerability by correcting how Windows AppX Deployment Service handles hard links.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-59
15 Mar 2022 Microsoft Windows Path traversal
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0730, CVE-2019-0731, CVE-2019-0796, CVE-2019-0805, CVE-2019-0836.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-59
15 Mar 2022 Microsoft Windows Authentication bypass
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-287
15 Mar 2022 Microsoft Win32k Denial of service
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8124, CVE-2018-8164, CVE-2018-8166.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-404
15 Mar 2022 Microsoft Windows Memory corruption
The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-119
15 Mar 2022 Microsoft Windows Security flaw
The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3308, CVE-2016-3310, and CVE-2016-3311.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-264
15 Mar 2022 Microsoft Win32k Memory corruption
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2518.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2022
- Weakness
- CWE-119
7 Mar 2022 Adobe BlazeDS Security flaw
Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex Data Services 2.0.1, and ColdFusion 7.0.2, 8.0, 8.0.1, and 9.0, allows remote attackers to obtain sensitive information via vectors that are associated with a request, and related to injected tags and external entity references in XML documents.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 7 Sep 2022
3 Mar 2022 Microsoft Windows Path traversal
Windows Installer Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.350, microsoft windows server 2019 10.0.17763.2300, microsoft windows server 2016 10.0.14393.4770, microsoft windows server 2004 10.0.19041.1348, microsoft windows 11 21h2 10.0.22000.318 and 7 older
- CISA due date
- 17 Mar 2022
- Weakness
- CWE-1386
3 Mar 2022 Microsoft Exchange Server Security flaw
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Mar 2022
3 Mar 2022 Adobe Flash Player Security flaw
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
3 Mar 2022 Adobe Flash Player Security flaw
Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.