The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
3 Nov 2021 Accellion FTA Command injection
Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20, CWE-78
3 Nov 2021 Accellion FTA SQL injection
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-89, CWE-138
3 Nov 2021 Microsoft Exchange Server Path traversal
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-39
3 Nov 2021 Microsoft Exchange Server Security flaw
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
3 Nov 2021 Microsoft Exchange Server Remote code execution
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-502
3 Nov 2021 Microsoft Exchange Server Server-side request forgery
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-918
3 Nov 2021 Microsoft Internet Explorer Memory corruption
Internet Explorer Memory Corruption Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-416
3 Nov 2021 Atlassian Confluence Server and Data Center Remote code execution
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- atlassian confluence data center 7.12.5, atlassian confluence server 7.12.5, atlassian confluence data center 7.11.6, atlassian confluence server 7.11.6, atlassian confluence data center 7.4.11 and 3 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-917
3 Nov 2021 F5 BIG-IP and BIG-IQ Centralized Management Server-side request forgery
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- f5 big-ip access policy manager 16.0.1.1, f5 big-ip access policy manager 15.1.2.1, f5 big-ip access policy manager 14.1.4, f5 big-ip access policy manager 13.1.3.6, f5 big-ip access policy manager 12.1.5.3 and 7 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-863
3 Nov 2021 Ivanti Pulse Connect Secure Authentication bypass
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-287
On Hacker News
CVE-2021-22893 exploit honey"POC"3 Nov 2021 GitLab Community and Enterprise Editions Remote code execution
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- gitlab 13.10.3, gitlab 13.9.6, gitlab 13.8.8
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20, CWE-95
On Hacker News
Gitlab CVE-2021-22205: RCE by unauthenticated curl -F3 Nov 2021 VMware vCenter Server Path traversal
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- vmware cloud foundation 5.0
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-23
3 Nov 2021 VMware vCenter Server Server-side request forgery
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- vmware cloud foundation 4.2.1, vmware cloud foundation 3.10.2.1
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-20, CWE-470, CWE-918
3 Nov 2021 VMware vCenter Server Path traversal
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- vmware cloud foundation 4.2, vmware cloud foundation 3.10.1.2
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-23
On Hacker News
CVE-2021-21972 RCE POC3 Nov 2021 SonicWall Email Security Path traversal
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall email security appliance 9000 firmware 10.0.9.6177, sonicwall email security appliance 8300 firmware 10.0.9.6177, sonicwall email security appliance 7050 firmware 10.0.9.6177, sonicwall email security appliance 7000 firmware 10.0.9.6177, sonicwall email security appliance 5050 firmware 10.0.9.6177 and 6 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-22
3 Nov 2021 SonicWall Email Security Malicious file upload
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall email security appliance 9000 firmware 10.0.9.6105, sonicwall email security appliance 8300 firmware 10.0.9.6105, sonicwall email security appliance 7050 firmware 10.0.9.6105, sonicwall email security appliance 7000 firmware 10.0.9.6105, sonicwall email security appliance 5050 firmware 10.0.9.6105 and 6 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-434
3 Nov 2021 SonicWall Email Security Privilege escalation
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall email security appliance 9000 firmware 10.0.9.6105, sonicwall email security appliance 8300 firmware 10.0.9.6105, sonicwall email security appliance 7050 firmware 10.0.9.6105, sonicwall email security appliance 7000 firmware 10.0.9.6105, sonicwall email security appliance 5050 firmware 10.0.9.6105 and 6 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-306
3 Nov 2021 SonicWall SSLVPN SMA100 SQL injection
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. This vulnerability impacts SMA100 build version 10.x.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall sma 100 firmware 10.2.0.5-d-29sv
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-89
3 Nov 2021 Microsoft Win32k Memory corruption
Windows Win32k Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-787
3 Nov 2021 Microsoft Windows Access control flaw
Windows Print Spooler Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.1999, microsoft windows server 2016 10.0.14393.4467, microsoft windows server 2004 10.0.19041.1052, microsoft windows 10 2004 10.0.19041.1052, microsoft windows 10 1909 10.0.18363.1621 and 5 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-285
3 Nov 2021 F5 BIG-IP Path traversal
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- f5 big-ip access policy manager 15.1.0.4, f5 big-ip access policy manager 14.1.2.6, f5 big-ip access policy manager 13.1.3.4, f5 big-ip access policy manager 12.1.5.2, f5 big-ip access policy manager 11.6.5.2 and 7 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 VMware ESXi Memory corruption
OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- vmware cloud foundation 4.1.0.1, vmware cloud foundation 3.10.1.2
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Cross-site scripting
Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Note: These vulnerabilities affect only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- cisco adaptive security appliance software 9.15.1.15, cisco adaptive security appliance software 9.14.2.8, cisco adaptive security appliance software 9.13.1.21, cisco adaptive security appliance software 9.12.4.13, cisco adaptive security appliance software 9.9.2.85 and 4 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-79
3 Nov 2021 Microsoft Netlogon Weak cryptography
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- samba 4.12.7, samba 4.11.13, samba 4.10.18, synology directory server 4.4.5-0101
- CISA due date
- 3 May 2022
- Weakness
- CWE-330
3 Nov 2021 Fortinet FortiOS Authentication bypass
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 6.2.4, fortinet fortios 6.0.10
- CISA due date
- 3 May 2022
- Weakness
- CWE-178, CWE-287
3 Nov 2021 Sophos SFOS SQL injection
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-89
3 Nov 2021 Microsoft Internet Explorer Memory corruption
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0970.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Microsoft Edge and Internet Explorer Memory corruption
<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers, and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically via an enticement in email or instant message, or by getting them to open an email attachment.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory.</p>
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Microsoft Exchange Server Authentication bypass
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-287
3 Nov 2021 SonicWall SMA100 SQL injection
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vulnerablity impacted SMA100 version 9.0.0.3 and earlier.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonicwall sma 100 firmware 9.0.0.4
- CISA due date
- 3 May 2022
- Weakness
- CWE-89
3 Nov 2021 Fortinet FortiOS Authentication bypass
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-306
3 Nov 2021 VMware ESXi and Horizon DaaS Memory corruption
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- vmware horizon daas 9.0.0.0
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Atlassian Confluence Server and Data Server Path traversal
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- atlassian confluence server 6.14.2, atlassian confluence server 6.13.3, atlassian confluence server 6.12.3, atlassian confluence server 6.6.12
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Path traversal
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 Progress Telerik UI for ASP.NET AJAX Remote code execution
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-502
3 Nov 2021 Microsoft Internet Explorer Memory corruption
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1221.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Citrix StoreFront Server XML external entity
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix storefront server 1903, citrix storefront server 3.12.4000, citrix storefront server 3.0.8000
- CISA due date
- 3 May 2022
- Weakness
- CWE-611
3 Nov 2021 Microsoft Windows Privilege escalation
An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-269
On Hacker News
CVE-2019-1215 Analysis of a Use After Free in Ws2ifsl3 Nov 2021 Citrix Workspace Application and Receiver for Windows Access control flaw
Citrix Workspace App before 1904 for Windows has Incorrect Access Control.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix workspace 1904
- CISA due date
- 3 May 2022
- Weakness
- CWE-284
3 Nov 2021 Atlassian Crowd and Crowd Data Center Security flaw
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- atlassian crowd 3.4.4, atlassian crowd 3.3.5, atlassian crowd 3.2.8, atlassian crowd 3.1.6, atlassian crowd 3.0.5
- CISA due date
- 3 May 2022
3 Nov 2021 Ivanti Pulse Connect Secure and Pulse Policy Secure Command injection
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-78
3 Nov 2021 Ivanti Pulse Connect Secure Path traversal
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 Microsoft Win32k Security flaw
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0803.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
3 Nov 2021 Microsoft Win32k Security flaw
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0859.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
3 Nov 2021 Microsoft Remote Desktop Services Memory corruption
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 Microsoft SharePoint Input validation flaw
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 Drupal Core Input validation flaw
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 8.5.1, drupal 8.4.6, drupal 8.3.9
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 Exim Memory corruption
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- exim 4.90.1
- CISA due date
- 3 May 2022
- Weakness
- CWE-119
3 Nov 2021 Adobe Flash Player Memory corruption
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 28.0.0.161
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 SAP Customer Relationship Management (CRM) Path traversal
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.