The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
13 Dec 2024 Cleo Multiple Products Malicious file upload
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- cleo harmony 5.8.0.21, cleo lexicom 5.8.0.21, cleo vltrader 5.8.0.21
- CISA due date
- 3 Jan 2025
- Weakness
- CWE-434
10 Dec 2024 Microsoft Windows Memory corruption
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1308, microsoft windows server 2022 10.0.20348.2966, microsoft windows server 2019 10.0.17763.6659, microsoft windows server 2016 10.0.14393.7606, microsoft windows 11 24h2 10.0.26100.2605 and 7 older
- CISA due date
- 31 Dec 2024
- Weakness
- CWE-122
4 Dec 2024 CyberPersons CyberPanel Command injection
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- cyberpanel 2.3.8
- CISA due date
- 25 Dec 2024
- Weakness
- CWE-276
3 Dec 2024 ProjectSend Authentication bypass
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- projectsend r1720
- CISA due date
- 24 Dec 2024
- Weakness
- CWE-287
3 Dec 2024 Zyxel Multiple Firewalls Path traversal
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware versions V5.00 through V5.38, USG FLEX 50(W) series firmware versions V5.10 through V5.38, and USG20(W)-VPN series firmware versions V5.10 through V5.38 could allow an attacker to download or upload files via a crafted URL.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 24 Dec 2024
- Weakness
- CWE-22
3 Dec 2024 North Grid Proself XML external entity
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- northgrid proself 5.63, northgrid proself 1.66, northgrid proself 1.09
- CISA due date
- 24 Dec 2024
- Weakness
- CWE-611
25 Nov 2024 Array Networks AG/vxAG ArrayOS Authentication bypass
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 16 Dec 2024
- Weakness
- CWE-306
21 Nov 2024 Apple Multiple Products Cross-site scripting
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to a cross site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple safari 18.1.1, apple ipados 18.1.1, apple iphone os 18.1.1, apple ipados 17.7.2, apple iphone os 17.7.2 and 2 older
- CISA due date
- 12 Dec 2024
- Weakness
- CWE-79
21 Nov 2024 Apple Multiple Products Security flaw
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia 15.1.1, visionOS 2.1.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple safari 18.1.1, apple ipados 18.1.1, apple iphone os 18.1.1, apple ipados 17.7.2, apple iphone os 17.7.2 and 2 older
- CISA due date
- 12 Dec 2024
21 Nov 2024 Oracle Agile Product Lifecycle Management (PLM) Access control flaw
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM Framework accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 12 Dec 2024
- Weakness
- CWE-863
20 Nov 2024 VMware vCenter Server Privilege escalation
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- vmware cloud foundation 5.2
- CISA due date
- 11 Dec 2024
- Weakness
- CWE-250, CWE-273
20 Nov 2024 VMware vCenter Server Memory corruption
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- vmware cloud foundation 5.2
- CISA due date
- 11 Dec 2024
- Weakness
- CWE-122
18 Nov 2024 Palo Alto Networks PAN-OS Command injection
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.
- Fixed in (NVD)
- paloaltonetworks pan-os 11.2.4, paloaltonetworks pan-os 11.1.5, paloaltonetworks pan-os 11.0.6, paloaltonetworks pan-os 10.2.12, paloaltonetworks pan-os 10.1.14
- CISA due date
- 9 Dec 2024
- Weakness
- CWE-77
18 Nov 2024 Progress Kemp LoadMaster Command injection
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- progress loadmaster 7.2.59.2, progress loadmaster 7.2.54.8, progress loadmaster 7.2.48.10
- CISA due date
- 9 Dec 2024
- Weakness
- CWE-78
18 Nov 2024 Palo Alto Networks PAN-OS Authentication bypass
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege escalation vulnerabilities like CVE-2024-9474 https://security.paloaltonetworks.com/CVE-2024-9474 . The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS 11.2 software. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.
- CISA due date
- 9 Dec 2024
- Weakness
- CWE-306
14 Nov 2024 Palo Alto Networks Expedition SQL injection
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- paloaltonetworks expedition 1.2.96
- CISA due date
- 5 Dec 2024
- Weakness
- CWE-89
14 Nov 2024 Palo Alto Networks Expedition Command injection
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- paloaltonetworks expedition 1.2.96
- CISA due date
- 5 Dec 2024
- Weakness
- CWE-78
12 Nov 2024 Microsoft Windows Authentication bypass
Windows Task Scheduler Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1251, microsoft windows server 2022 10.0.20348.2849, microsoft windows server 2019 10.0.17763.6532, microsoft windows server 2016 10.0.14393.7515, microsoft windows 11 24h2 10.0.26100.2314 and 7 older
- CISA due date
- 3 Dec 2024
- Weakness
- CWE-287
12 Nov 2024 Microsoft Windows Path traversal
NTLM Hash Disclosure Spoofing Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1251, microsoft windows server 2022 10.0.20348.2849, microsoft windows server 2019 10.0.17763.6532, microsoft windows server 2016 10.0.14393.7515, microsoft windows 11 24h2 10.0.26100.2314 and 7 older
- CISA due date
- 3 Dec 2024
- Weakness
- CWE-73
12 Nov 2024 Metabase Path traversal
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 3 Dec 2024
- Weakness
- CWE-200
12 Nov 2024 Atlassian Jira Server and Data Center Path traversal
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- atlassian jira data center 8.16.1, atlassian jira server 8.16.1, atlassian jira data center 8.13.6, atlassian jira server 8.13.6, atlassian jira data center 8.5.14 and 1 older
- CISA due date
- 3 Dec 2024
- Weakness
- CWE-22
12 Nov 2024 Cisco Adaptive Security Appliance (ASA) Cross-site scripting
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 3 Dec 2024
- Weakness
- CWE-79
7 Nov 2024 Palo Alto Networks Expedition Authentication bypass
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- paloaltonetworks expedition 1.2.92
- CISA due date
- 28 Nov 2024
- Weakness
- CWE-306
7 Nov 2024 CyberPersons CyberPanel Authentication bypass
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- cyberpanel 2.3.8
- CISA due date
- 28 Nov 2024
- Weakness
- CWE-276
7 Nov 2024 Android Framework Security flaw
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 28 Nov 2024
- Weakness
- CWE-176
7 Nov 2024 Nostromo nhttpd Path traversal
Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- nazgul nostromo nhttpd 1.9.7
- CISA due date
- 28 Nov 2024
- Weakness
- CWE-22
4 Nov 2024 PTZOptics PT30X-SDI/NDI Cameras Command injection
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntp_addr configuration value which may lead to arbitrary command execution when ntp_client is started. When chained with CVE-2024-8956, a remote and unauthenticated attacker can execute arbitrary OS commands on affected devices.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- ptzoptics pt30x-sdi firmware 6.3.40, ptzoptics pt30x-ndi-xx-g2 firmware 6.3.40
- CISA due date
- 25 Nov 2024
- Weakness
- CWE-78
4 Nov 2024 PTZOptics PT30X-SDI/NDI Cameras Authentication bypass
PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- ptzoptics pt30x-sdi firmware 6.3.40, ptzoptics pt30x-ndi-xx-g2 firmware 6.3.40
- CISA due date
- 25 Nov 2024
- Weakness
- CWE-287
24 Oct 2024 Roundcube Webmail Cross-site scripting
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- roundcube webmail 1.6.7, roundcube webmail 1.5.7
- CISA due date
- 14 Nov 2024
- Weakness
- CWE-79
24 Oct 2024 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Denial of service
A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) of the RAVPN service. This vulnerability is due to resource exhaustion. An attacker could exploit this vulnerability by sending a large number of VPN authentication requests to an affected device. A successful exploit could allow the attacker to exhaust resources, resulting in a DoS of the RAVPN service on the affected device. Depending on the impact of the attack, a reload of the device may be required to restore the RAVPN service. Services that are not related to VPN are not affected. Cisco Talos discussed these attacks in the blog post Large-scale brute-force activity targeting VPNs, SSH services with commonly used login credentials.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 14 Nov 2024
- Weakness
- CWE-772
23 Oct 2024 Fortinet FortiManager Authentication bypass
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- fortinet fortimanager 7.4.5, fortinet fortimanager cloud 7.4.5, fortinet fortimanager 7.2.8, fortinet fortimanager cloud 7.2.8, fortinet fortimanager 7.0.13 and 3 older
- CISA due date
- 13 Nov 2024
- Weakness
- CWE-306
22 Oct 2024 Microsoft SharePoint Remote code execution
Microsoft SharePoint Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 12 Nov 2024
- Weakness
- CWE-502
21 Oct 2024 ScienceLogic SL1 Security flaw
ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component packaged with SL1. The vulnerability is addressed in SL1 versions 12.1.3+, 12.2.3+, and 12.3+. Remediations have been made available for all SL1 versions back to version lines 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- sciencelogic sl1 12.2.3, sciencelogic sl1 12.1.3
- CISA due date
- 11 Nov 2024
17 Oct 2024 Veeam Backup & Replication Remote code execution
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- veeam backup & replication 12.2.0.334
- CISA due date
- 7 Nov 2024
- Weakness
- CWE-502
15 Oct 2024 Mozilla Firefox Memory corruption
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- mozilla firefox 131.0.2, mozilla firefox 128.3.1, mozilla thunderbird 128.3.1, mozilla firefox 115.16.1, mozilla thunderbird 115.16.0
- CISA due date
- 5 Nov 2024
- Weakness
- CWE-416
On Hacker News
Firefox use-after-free RCE15 Oct 2024 Microsoft Windows Race condition
Windows Kernel Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.950, microsoft windows server 2022 10.0.20348.2522, microsoft windows server 2019 10.0.17763.5936, microsoft windows server 2016 10.0.14393.7070, microsoft windows 11 23h2 10.0.22631.3737 and 7 older
- CISA due date
- 5 Nov 2024
- Weakness
- CWE-367
15 Oct 2024 SolarWinds Web Help Desk Authentication bypass
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- solarwinds web help desk 12.8.3
- CISA due date
- 5 Nov 2024
- Weakness
- CWE-798
9 Oct 2024 Ivanti Cloud Services Appliance (CSA) Command injection
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
- What to do
- As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
- Fixed in (NVD)
- ivanti endpoint manager cloud services appliance 5.0.2
- CISA due date
- 30 Oct 2024
- Weakness
- CWE-77
9 Oct 2024 Ivanti Cloud Services Appliance (CSA) SQL injection
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
- What to do
- As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
- Fixed in (NVD)
- ivanti endpoint manager cloud services appliance 5.0.2
- CISA due date
- 30 Oct 2024
- Weakness
- CWE-89
9 Oct 2024 Fortinet Multiple Products Memory corruption
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 30 Oct 2024
- Weakness
- CWE-134
8 Oct 2024 Microsoft Windows Cross-site scripting
Windows MSHTML Platform Spoofing Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2762, microsoft windows server 2019 10.0.17763.6414, microsoft windows server 2016 10.0.14393.7428, microsoft windows 11 24h2 10.0.26100.2033, microsoft windows 11 23h2 10.0.22631.4317 and 7 older
- CISA due date
- 29 Oct 2024
- Weakness
- CWE-79
8 Oct 2024 Microsoft Windows Security flaw
Microsoft Management Console Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2762, microsoft windows server 2019 10.0.17763.6414, microsoft windows server 2016 10.0.14393.7428, microsoft windows 11 24h2 10.0.26100.2033, microsoft windows 11 23h2 10.0.22631.4317 and 7 older
- CISA due date
- 29 Oct 2024
- Weakness
- CWE-707
8 Oct 2024 Qualcomm Multiple Chipsets Memory corruption
Memory corruption while maintaining memory maps of HLOS memory.
- What to do
- Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
- CISA due date
- 29 Oct 2024
- Weakness
- CWE-416
3 Oct 2024 Synacor Zimbra Collaboration Suite (ZCS) Command injection
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- synacor zimbra collaboration suite 10.0.9, synacor zimbra collaboration suite 8.8.15
- CISA due date
- 24 Oct 2024
- Weakness
- CWE-284
2 Oct 2024 Ivanti Endpoint Manager (EPM) SQL injection
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- ivanti endpoint manager 2022
- CISA due date
- 23 Oct 2024
- Weakness
- CWE-89
30 Sep 2024 D-Link DIR-820 Router Command injection
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- CISA due date
- 21 Oct 2024
- Weakness
- CWE-78
30 Sep 2024 DrayTek Multiple Vigor Routers Command injection
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- draytek vigor3900 firmware 1.5.1, draytek vigor2960 firmware 1.5.1, draytek vigor300b firmware 1.5.1
- CISA due date
- 21 Oct 2024
- Weakness
- CWE-78
30 Sep 2024 SAP Commerce Cloud Remote code execution
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 21 Oct 2024
- Weakness
- CWE-502
24 Sep 2024 Ivanti Virtual Traffic Manager Authentication bypass
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 15 Oct 2024
- Weakness
- CWE-287, CWE-303
19 Sep 2024 Ivanti Cloud Services Appliance (CSA) Path traversal
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
- What to do
- As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
- CISA due date
- 10 Oct 2024
- Weakness
- CWE-22
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.