The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
18 Sep 2024 Apache HugeGraph-Server Access control flaw
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache hugegraph 1.3.0
- CISA due date
- 9 Oct 2024
- Weakness
- CWE-284
18 Sep 2024 Oracle ADF Faces Remote code execution
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 9 Oct 2024
- Weakness
- CWE-502
18 Sep 2024 Oracle WebLogic Server Security flaw
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 9 Oct 2024
18 Sep 2024 Microsoft SQL Server Remote code execution
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 9 Oct 2024
- Weakness
- CWE-502
17 Sep 2024 Adobe Flash Player Memory corruption
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- Fixed in (NVD)
- adobe flash player 12.0.0.70, adobe flash player 11.7.700.269, adobe flash player 11.2.202.341, adobe air sdk 4.0.0.1628, adobe air 4.0.0.1628
- CISA due date
- 8 Oct 2024
- Weakness
- CWE-399
On Hacker News
Building a Decoder for the CVE-2014-0502 Shellcode17 Sep 2024 Adobe Flash Player Memory corruption
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- Fixed in (NVD)
- google chrome 32.0.1700.107, adobe flash player 12.0.0.44, adobe flash player 11.7.700.261, adobe flash player 11.2.202.336
- CISA due date
- 8 Oct 2024
- Weakness
- CWE-191
17 Sep 2024 Adobe Flash Player Security flaw
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- Fixed in (NVD)
- adobe flash player 11.6.602.171, adobe flash player 11.2.202.273, adobe flash player 10.3.183.67
- CISA due date
- 8 Oct 2024
17 Sep 2024 Adobe Flash Player Privilege escalation
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
- What to do
- The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
- Fixed in (NVD)
- adobe flash player 11.6.602.171, adobe flash player 11.2.202.273, adobe flash player 10.3.183.67
- CISA due date
- 8 Oct 2024
- Weakness
- CWE-264
16 Sep 2024 Progress WhatsUp Gold SQL injection
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- progress whatsup gold 24.0
- CISA due date
- 7 Oct 2024
- Weakness
- CWE-89
16 Sep 2024 Microsoft Windows Security flaw
Windows MSHTML Platform Spoofing Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.6293, microsoft windows server 2016 10.0.14393.7336, microsoft windows 11 24h2 10.0.26100.1742, microsoft windows 11 23h2 10.0.22631.4169, microsoft windows 11 23h2 10.0.22621.4169 and 7 older
- CISA due date
- 7 Oct 2024
- Weakness
- CWE-451
13 Sep 2024 Ivanti Cloud Services Appliance Command injection
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
- What to do
- As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
- CISA due date
- 4 Oct 2024
- Weakness
- CWE-78
10 Sep 2024 Microsoft Publisher Security flaw
Microsoft Publisher Security Feature Bypass Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 1 Oct 2024
- Weakness
- CWE-693
10 Sep 2024 Microsoft Windows Security flaw
Windows Mark of the Web Security Feature Bypass Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2700, microsoft windows server 2019 10.0.17763.6293, microsoft windows server 2016 10.0.14393.7336, microsoft windows 11 24h2 10.0.26100.1742, microsoft windows 11 23h2 10.0.22631.4169 and 7 older
- CISA due date
- 1 Oct 2024
- Weakness
- CWE-693
10 Sep 2024 Microsoft Windows Privilege escalation
Windows Installer Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2700, microsoft windows server 2019 10.0.17763.6293, microsoft windows server 2016 10.0.14393.7336, microsoft windows 11 24h2 10.0.26100.1742, microsoft windows 11 23h2 10.0.22631.4169 and 7 older
- CISA due date
- 1 Oct 2024
- Weakness
- CWE-269
9 Sep 2024 SonicWall SonicOS Access control flaw
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- sonicwall sonicos 6.5.4.15.116n, sonicwall sonicos 6.5.2.8-2n, sonicwall sonicos 5.9.2.14-13o
- CISA due date
- 30 Sep 2024
- Weakness
- CWE-284
9 Sep 2024 Linux Kernel Memory corruption
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- linux kernel 4.0.2, linux kernel 3.19.7, linux kernel 3.18.14, linux kernel 3.16.35, linux kernel 3.14.41 and 4 older
- CISA due date
- 30 Sep 2024
- Weakness
- CWE-119
9 Sep 2024 ImageMagick Input validation flaw
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 30 Sep 2024
- Weakness
- CWE-20
3 Sep 2024 Kingsoft WPS Office Path traversal
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- kingsoft wps office 12.2.0.16412
- CISA due date
- 24 Sep 2024
- Weakness
- CWE-22
3 Sep 2024 DrayTek VigorConnect Path traversal
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 24 Sep 2024
- Weakness
- CWE-22
3 Sep 2024 DrayTek VigorConnect Path traversal
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 24 Sep 2024
- Weakness
- CWE-22
28 Aug 2024 Google Chromium V8 Memory corruption
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 128.0.6613.84, microsoft edge chromium 128.0.2739.42
- CISA due date
- 18 Sep 2024
- Weakness
- CWE-358
On Hacker News
Zooming in on CVE-2024–796527 Aug 2024 Apache OFBiz Access control flaw
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache ofbiz 18.12.15
- CISA due date
- 17 Sep 2024
- Weakness
- CWE-863
On Hacker News
Apache OFBiz RCE Scanner and Exploit (CVE-2024-38856)26 Aug 2024 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 128.0.6613.84, microsoft edge 128.0.2739.42
- CISA due date
- 16 Sep 2024
- Weakness
- CWE-843
23 Aug 2024 Versa Director Malicious file upload
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 13 Sep 2024
- Weakness
- CWE-434
21 Aug 2024 Linux Kernel Memory corruption
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
- What to do
- Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- Fixed in (NVD)
- linux kernel 5.16.2, linux kernel 5.15.16, linux kernel 5.10.93, linux kernel 5.4.173
- CISA due date
- 11 Sep 2024
- Weakness
- CWE-190
21 Aug 2024 Dahua IP Camera Firmware Authentication bypass
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- dahuasecurity vth-542xh firmware 4.500.0000002.0.r.210715, dahuasecurity vto-75x95x firmware 4.300.0000003.0.r.210714, dahuasecurity vto-65xxx firmware 4.300.0000004.0.r.210715, dahuasecurity ipc-hum7xxx firmware 2.820.0000000.5.r.210705, dahuasecurity nvr-6xx firmware 4.001.0000001.1.r.210716 and 7 older
- CISA due date
- 11 Sep 2024
- Weakness
- CWE-287
21 Aug 2024 Dahua IP Camera Firmware Authentication bypass
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- dahuasecurity tpc-bf2221 firmware 2.630.0000000.10.r.210707, dahuasecurity tpc-bf1241 firmware 2.630.0000000.6.r.210707, dahuasecurity sd52c firmware 2.812.0000007.0.r.210706, dahuasecurity sd50 firmware 2.812.0000007.0.r.210706, dahuasecurity sd49 firmware 2.812.0000007.0.r.210706 and 7 older
- CISA due date
- 11 Sep 2024
- Weakness
- CWE-287
21 Aug 2024 Microsoft Exchange Server Security flaw
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 11 Sep 2024
19 Aug 2024 Jenkins Command Line Interface (CLI) Path traversal
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- jenkins 2.442, jenkins 2.426.3
- CISA due date
- 9 Sep 2024
- Weakness
- CWE-27
15 Aug 2024 SolarWinds Web Help Desk Remote code execution
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 5 Sep 2024
- Weakness
- CWE-502
13 Aug 2024 Microsoft Windows Security flaw
Windows Mark of the Web Security Feature Bypass Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2522, microsoft windows server 2019 10.0.17763.5936, microsoft windows server 2016 10.0.14393.7070, microsoft windows server 2012 6.2.9200.24919, microsoft windows 11 23h2 10.0.22631.3737 and 7 older
- CISA due date
- 3 Sep 2024
- Weakness
- CWE-693
13 Aug 2024 Microsoft Windows Memory corruption
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.6189, microsoft windows server 2016 10.0.14393.7259, microsoft windows server 2012 6.2.9200.25031, microsoft windows 11 24h2 10.0.26100.1457, microsoft windows 11 23h2 10.0.22631.4037 and 7 older
- CISA due date
- 3 Sep 2024
- Weakness
- CWE-416
13 Aug 2024 Microsoft Project Input validation flaw
Microsoft Project Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft project 2016 16.0.5461.1001
- CISA due date
- 3 Sep 2024
- Weakness
- CWE-20
13 Aug 2024 Microsoft Windows Memory corruption
Scripting Engine Memory Corruption Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2655, microsoft windows server 2019 10.0.17763.6189, microsoft windows server 2016 10.0.14393.7259, microsoft windows 11 24h2 10.0.26100.1457, microsoft windows 11 23h2 10.0.22631.4037 and 7 older
- CISA due date
- 3 Sep 2024
- Weakness
- CWE-843
13 Aug 2024 Microsoft Windows Memory corruption
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.6189, microsoft windows server 2016 10.0.14393.7259, microsoft windows server 2012 6.2.9200.25031, microsoft windows 11 24h2 10.0.26100.1457, microsoft windows 11 23h2 10.0.22631.4037 and 7 older
- CISA due date
- 3 Sep 2024
- Weakness
- CWE-416
13 Aug 2024 Microsoft Windows Security flaw
Windows Kernel Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2655, microsoft windows server 2019 10.0.17763.6189, microsoft windows server 2016 10.0.14393.7259, microsoft windows 11 24h2 10.0.26100.1457, microsoft windows 11 23h2 10.0.22631.4037 and 7 older
- CISA due date
- 3 Sep 2024
- Weakness
- CWE-591
7 Aug 2024 Android Kernel Memory corruption
In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- linux kernel 6.9.4, linux kernel 6.6.34, linux kernel 6.1.94, linux kernel 5.15.161, linux kernel 5.10.219 and 2 older
- CISA due date
- 28 Aug 2024
- Weakness
- CWE-416
7 Aug 2024 Apache OFBiz Path traversal
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache ofbiz 18.12.13
- CISA due date
- 28 Aug 2024
- Weakness
- CWE-22
5 Aug 2024 Microsoft Windows Remote code execution
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 26 Aug 2024
- Weakness
- CWE-502
30 Jul 2024 VMware ESXi Authentication bypass
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- vmware cloud foundation 5.2
- CISA due date
- 20 Aug 2024
- Weakness
- CWE-305
29 Jul 2024 ServiceNow Utah, Vancouver, and Washington DC Now Platform Security flaw
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 19 Aug 2024
- Weakness
- CWE-184
29 Jul 2024 ServiceNow Utah, Vancouver, and Washington DC Now Platform Input validation flaw
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 19 Aug 2024
- Weakness
- CWE-1287
29 Jul 2024 Acronis Cyber Infrastructure (ACI) Security flaw
Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- acronis cyber infrastructure 5.4.4-132, acronis cyber infrastructure 5.3.1-53, acronis cyber infrastructure 5.2.1-69, acronis cyber infrastructure 5.1.1-71, acronis cyber infrastructure 5.0.1-61
- CISA due date
- 19 Aug 2024
- Weakness
- CWE-1393
23 Jul 2024 Twilio Authy Information disclosure
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- twilio authy 26.1.0, twilio authy authenticator 25.1.0
- CISA due date
- 13 Aug 2024
- Weakness
- CWE-203
23 Jul 2024 Microsoft Internet Explorer Memory corruption
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 13 Aug 2024
- Weakness
- CWE-416
17 Jul 2024 Adobe Commerce and Magento Open Source XML external entity
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- adobe commerce webhooks 1.5.0
- CISA due date
- 7 Aug 2024
- Weakness
- CWE-611
17 Jul 2024 SolarWinds Serv-U Path traversal
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- solarwinds serv-u 15.4.2
- CISA due date
- 7 Aug 2024
- Weakness
- CWE-22
17 Jul 2024 VMware vCenter Server Security flaw
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to the vCenter Server may exploit this issue to gain access to sensitive information.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- vmware cloud foundation 4.4.1, vmware cloud foundation 3.11
- CISA due date
- 7 Aug 2024
- Weakness
- CWE-276
15 Jul 2024 OSGeo GeoServer Remote code execution
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- geotools 31.2, geotools 30.4, geotools 29.6, geoserver 2.25.2, geoserver 2.24.4 and 2 older
- CISA due date
- 5 Aug 2024
- Weakness
- CWE-95
9 Jul 2024 Microsoft Windows Security flaw
Windows MSHTML Platform Spoofing Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1009, microsoft windows server 2022 10.0.20348.2582, microsoft windows server 2019 10.0.17763.6054, microsoft windows server 2016 10.0.14393.7159, microsoft windows 11 23h2 10.0.22631.3880 and 7 older
- CISA due date
- 30 Jul 2024
- Weakness
- CWE-451
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.