The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
22 Jun 2023 Roundcube Webmail Cross-site scripting
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- roundcube webmail 1.4.10, roundcube webmail 1.3.16, roundcube webmail 1.2.13
- CISA due date
- 13 Jul 2023
- Weakness
- CWE-79
22 Jun 2023 Mozilla Firefox, Firefox ESR, and Thunderbird Memory corruption
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 50.0.2, mozilla thunderbird 45.5.1, mozilla firefox 45.5.1
- CISA due date
- 13 Jul 2023
- Weakness
- CWE-416
7 Jun 2023 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 114.0.5735.110, couchbase server 7.1.5
- CISA due date
- 28 Jun 2023
- Weakness
- CWE-843
12 May 2023 Red Hat Polkit Access control flaw
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- polkit project polkit 0.119
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-863
12 May 2023 Apache Tomcat Access control flaw
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache tomcat 8.5.7, apache tomcat 8.0.39, apache tomcat 7.0.73, apache tomcat 6.0.48
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-284
12 May 2023 Oracle Java SE and JRockit Access control flaw
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache cassandra 3.11.8, apache cassandra 3.0.22, apache cassandra 2.2.18, apache cassandra 2.1.22
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-284
12 May 2023 Linux Kernel Race condition
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- linux kernel 3.14.4, linux kernel 3.12.20, linux kernel 3.10.40, linux kernel 3.4.91, linux kernel 3.2.59
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-362
12 May 2023 Linux Kernel Input validation flaw
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- linux kernel 2.6.36
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-20
21 Apr 2023 Google Chromium Skia Memory corruption
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 112.0.5615.137
- CISA due date
- 12 May 2023
- Weakness
- CWE-190
On Hacker News
Google Chrome Zero-Day 1 comment17 Apr 2023 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 112.0.5615.121, couchbase server 7.1.5
- CISA due date
- 8 May 2023
- Weakness
- CWE-843
30 Mar 2023 Linux Kernel Memory corruption
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 6.1.6, linux kernel 5.15.88, linux kernel 5.10.163, linux kernel 5.4.229, linux kernel 4.19.270 and 1 older
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-416
30 Mar 2023 Samba Remote code execution
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- samba 4.6.4, samba 4.5.10, samba 4.4.14, samba 4.4.0
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-94
10 Mar 2023 XStream Remote code execution
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- xstream 1.4.18
- CISA due date
- 31 Mar 2023
- Weakness
- CWE-94, CWE-502
20 Oct 2022 Linux Kernel Access control flaw
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- canonical ubuntu linux 20.10, canonical ubuntu linux 20.04, canonical ubuntu linux 18.04
- CISA due date
- 10 Nov 2022
- Weakness
- CWE-862
15 Sep 2022 Linux Kernel Input validation flaw
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 3.5.5, linux kernel 3.4.12, linux kernel 3.2.54
- CISA due date
- 6 Oct 2022
- Weakness
- CWE-20
15 Sep 2022 Linux Kernel Memory corruption
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 3.8.9, linux kernel 3.4.42, linux kernel 3.2.45, linux kernel 3.0.75
- CISA due date
- 6 Oct 2022
- Weakness
- CWE-189
15 Sep 2022 Linux Kernel Security flaw
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 3.8.9, linux kernel 3.4.42, linux kernel 3.2.45, linux kernel 3.0.75
- CISA due date
- 6 Oct 2022
- Weakness
- CWE-189
25 Aug 2022 PEAR Archive_Tar Path traversal
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 9.1.3, drupal 9.0.11, drupal 8.9.13, drupal 7.78
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-22, CWE-59
25 Aug 2022 PEAR Archive_Tar Input validation flaw
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 9.0.9, drupal 8.9.10, drupal 8.8.12, drupal 7.75, php archive tar 1.4.12
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-74
18 Aug 2022 Apple iOS and macOS Memory corruption
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple safari 15.6.1, apple ipados 15.6.1, apple iphone os 15.6.1, apple macos 12.5.1, webkitgtk 2.36.7 and 1 older
- CISA due date
- 8 Sep 2022
- Weakness
- CWE-20, CWE-787
9 Aug 2022 RARLAB UnRAR Path traversal
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- rarlab unrar 6.12
- CISA due date
- 30 Aug 2022
- Weakness
- CWE-22, CWE-59
8 Jun 2022 Google Chromium V8 Memory corruption
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 65.0.3325.146
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-190, CWE-787
8 Jun 2022 Google Chromium V8 Memory corruption
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 71.0.3578.80
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-787
8 Jun 2022 Google Chromium V8 Security flaw
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 70.0.3538.67
- CISA due date
- 22 Jun 2022
8 Jun 2022 Google Chromium V8 Memory corruption
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 57.0.2987.108, google chrome 57.0.2987.98
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-125
8 Jun 2022 Google Chromium V8 Memory corruption
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 49.0.2623.108
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
25 May 2022 Mozilla Firefox Information disclosure
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 39.0.3, mozilla firefox 38.1.1, mozilla firefox os 2.2
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-200
25 May 2022 Linux Kernel Privilege escalation
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 3.14.6, linux kernel 3.12.22, linux kernel 3.10.42, linux kernel 3.4.92, linux kernel 3.2.60
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-269
25 May 2022 Oracle Java Runtime Environment (JRE) Access control flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-284
25 May 2022 Oracle Java Runtime Environment (JRE) Access control flaw
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-264
25 May 2022 Oracle Java Runtime Environment (JRE) Security flaw
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
24 May 2022 Artifex Ghostscript Memory corruption
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- artifex ghostscript 9.21
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-704
23 May 2022 Android Kernel Memory corruption
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-362, CWE-416
25 Apr 2022 Linux Kernel Security flaw
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens scalance lpe9403 firmware 2.0, linux kernel 5.16.11, linux kernel 5.15.25, linux kernel 5.10.102
- CISA due date
- 16 May 2022
- Weakness
- CWE-665
13 Apr 2022 Drupal Core Remote code execution
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 8.5.3, drupal 8.4.8, drupal 7.59
- CISA due date
- 4 May 2022
- Weakness
- CWE-94
11 Apr 2022 Linux Kernel Memory corruption
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 5.15.11, linux kernel 5.10.88, linux kernel 5.4.168, linux kernel 4.19.222, linux kernel 4.14.259
- CISA due date
- 2 May 2022
- Weakness
- CWE-415
6 Apr 2022 Sudo Memory corruption
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- beyondtrust privilege management for mac 21.1.1, beyondtrust privilege management for unix/linux 10.3.2-10, sudo project sudo 1.9.5, sudo project sudo 1.8.32
- CISA due date
- 27 Apr 2022
- Weakness
- CWE-122, CWE-193
28 Mar 2022 Oracle Java SE Security flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-693
28 Mar 2022 Mozilla Firefox and Thunderbird Memory corruption
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 22.0, mozilla firefox 17.0.7, mozilla thunderbird 17.0.7, mozilla thunderbird esr 17.0.7
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-119
28 Mar 2022 Oracle Java SE Access control flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-284
25 Mar 2022 OpenBSD OpenSMTPD Command injection
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-755, CWE-78
25 Mar 2022 PHP FastCGI Process Manager (FPM) Memory corruption
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- php 7.3.11, php 7.2.24, php 7.1.33, tenable.sc 5.19.0
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-120
25 Mar 2022 Apache Tomcat Malicious file upload
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache tomcat 9.0.1, apache tomcat 8.5.23, apache tomcat 8.0.47, apache tomcat 7.0.82
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-434
25 Mar 2022 Apache Tomcat Malicious file upload
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-434
On Hacker News
Remote code execution in Apache Tomcat 7.0 11 comments25 Mar 2022 Rails Ruby on Rails Path traversal
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- rubyonrails rails 4.2.5.1, rubyonrails rails 4.1.14.1, rubyonrails rails 3.2.22.1
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-22
25 Mar 2022 PHP Command injection
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple mac os x 10.8.2, apple mac os x 10.7.5, php 5.4.2, php 5.3.12
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-20
25 Mar 2022 Exim Command injection
Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-264
25 Mar 2022 Exim Memory corruption
Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- exim 4.70
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-119
25 Mar 2022 phpMyAdmin Remote code execution
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- phpmyadmin 3.1.3.1, phpmyadmin 2.11.9.5
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-94
3 Mar 2022 Exim Internet Mailer Memory corruption
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Mar 2022
- Weakness
- CWE-787
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.