The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
9 Jul 2024 Microsoft Windows Memory corruption
Windows Hyper-V Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1009, microsoft windows server 2022 10.0.20348.2582, microsoft windows 11 23h2 10.0.22631.3880, microsoft windows 11 22h2 10.0.22621.3880, microsoft windows 11 21h2 10.0.22000.3079
- CISA due date
- 30 Jul 2024
- Weakness
- CWE-190
9 Jul 2024 Rejetto HTTP File Server Remote code execution
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 30 Jul 2024
- Weakness
- CWE-1336
2 Jul 2024 Cisco NX-OS Command injection
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that are passed to specific configuration CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected configuration CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root. Note: To successfully exploit this vulnerability on a Cisco NX-OS device, an attacker must have Administrator credentials. The following Cisco devices already allow administrative users to access the underlying operating system through the bash-shell feature, so, for these devices, this vulnerability does not grant any additional privileges: Nexus 3000 Series Switches Nexus 7000 Series Switches that are running Cisco NX-OS Software releases 8.1(1) and later Nexus 9000 Series Switches in standalone NX-OS mode
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 23 Jul 2024
- Weakness
- CWE-78
26 Jun 2024 Linux Kernel Memory corruption
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
- What to do
- Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- Fixed in (NVD)
- siemens simatic s7-1500 tm mfp firmware 1.1, linux kernel 5.19.2, linux kernel 5.18.18, linux kernel 5.15.61, linux kernel 5.10.137 and 4 older
- CISA due date
- 17 Jul 2024
- Weakness
- CWE-416
26 Jun 2024 OSGeo JAI-EXT Remote code execution
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- geosolutionsgroup jai-ext 1.1.22
- CISA due date
- 17 Jul 2024
- Weakness
- CWE-94
26 Jun 2024 Roundcube Webmail Cross-site scripting
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- roundcube webmail 1.4.5, roundcube webmail 1.3.12
- CISA due date
- 17 Jul 2024
- Weakness
- CWE-80
13 Jun 2024 Progress Telerik Report Server Authentication bypass
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 4 Jul 2024
- Weakness
- CWE-290
13 Jun 2024 Android Pixel Security flaw
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 4 Jul 2024
- Weakness
- CWE-783
13 Jun 2024 Microsoft Windows Privilege escalation
Windows Error Reporting Service Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.763, microsoft windows server 2022 10.0.20348.2333, microsoft windows server 2019 10.0.17763.5576, microsoft windows 11 23h2 10.0.22631.3296, microsoft windows 11 22h2 10.0.22621.3296 and 6 older
- CISA due date
- 4 Jul 2024
- Weakness
- CWE-269
12 Jun 2024 Arm Mali GPU Kernel Driver Memory corruption
Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r34p0 through r40p0; Valhall GPU Kernel Driver: from r34p0 through r40p0.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- arm bifrost gpu kernel driver r41p0, arm valhall gpu kernel driver r41p0
- CISA due date
- 3 Jul 2024
- Weakness
- CWE-416
12 Jun 2024 PHP Group PHP Command injection
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- php 8.3.8, php 8.2.20, php 8.1.29
- CISA due date
- 3 Jul 2024
- Weakness
- CWE-78
3 Jun 2024 Oracle WebLogic Server Command injection
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 24 Jun 2024
- Weakness
- CWE-78
30 May 2024 Check Point Quantum Security Gateways Information disclosure
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 20 Jun 2024
- Weakness
- CWE-200
30 May 2024 Linux Kernel Memory corruption
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- linux kernel 6.7.3, linux kernel 6.6.15, linux kernel 6.1.76, linux kernel 5.15.149
- CISA due date
- 20 Jun 2024
- Weakness
- CWE-416
29 May 2024 Justice AV Solutions Viewer Security flaw
Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 19 Jun 2024
- Weakness
- CWE-506
28 May 2024 Google Chromium V8 Memory corruption
Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 125.0.6422.112
- CISA due date
- 18 Jun 2024
- Weakness
- CWE-843
23 May 2024 Apache Flink Access control flaw
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache flink 1.11.3
- CISA due date
- 13 Jun 2024
- Weakness
- CWE-552
20 May 2024 Google Chromium V8 Memory corruption
Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 125.0.6422.60
- CISA due date
- 10 Jun 2024
- Weakness
- CWE-843
20 May 2024 NextGen Healthcare Mirth Connect Remote code execution
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- nextgen mirth connect 4.4.1
- CISA due date
- 10 Jun 2024
- Weakness
- CWE-502
16 May 2024 Google Chromium V8 Memory corruption
Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 124.0.6367.207
- CISA due date
- 6 Jun 2024
- Weakness
- CWE-787
16 May 2024 D-Link DIR-605 Router Access control flaw
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
- What to do
- This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
- CISA due date
- 6 Jun 2024
- Weakness
- CWE-863
16 May 2024 D-Link DIR-600 Router Cross-site request forgery
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account or (2) enable remote management via a crafted configuration module to hedwig.cgi, (3) activate new configuration settings via a SETCFG,SAVE,ACTIVATE action to pigwidgeon.cgi, or (4) send a ping via a ping action to diagnostic.php.
- What to do
- This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
- CISA due date
- 6 Jun 2024
- Weakness
- CWE-352
14 May 2024 Microsoft DWM Core Library Memory corruption
Windows DWM Core Library Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2458, microsoft windows server 2019 10.0.17763.5820, microsoft windows server 2016 10.0.14393.6981, microsoft windows 11 23h2 10.0.22631.3593, microsoft windows 11 22h2 10.0.22621.3593 and 6 older
- CISA due date
- 4 Jun 2024
- Weakness
- CWE-122
14 May 2024 Microsoft Windows Input validation flaw
Windows MSHTML Platform Security Feature Bypass Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.887, microsoft windows server 2022 10.0.20348.2458, microsoft windows server 2019 10.0.17763.5820, microsoft windows server 2016 10.0.14393.6981, microsoft windows 11 23h2 10.0.22631.3593 and 7 older
- CISA due date
- 4 Jun 2024
- Weakness
- CWE-20
13 May 2024 Google Chromium Memory corruption
Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google chrome 124.0.6367.201
- CISA due date
- 3 Jun 2024
- Weakness
- CWE-416
1 May 2024 GitLab CE/EE Authentication bypass
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- gitlab 16.7.2, gitlab 16.6.4, gitlab 16.5.6, gitlab 16.4.5, gitlab 16.3.7 and 2 older
- CISA due date
- 22 May 2024
- Weakness
- CWE-284
On Hacker News
POC of Gitlab Account-Take-Over CVE-2023-702830 Apr 2024 Microsoft SmartScreen Prompt Security flaw
SmartScreen Prompt Security Feature Bypass Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.830, microsoft windows server 2022 10.0.20348.2402, microsoft windows server 2019 10.0.17763.5696, microsoft windows 11 23h2 10.0.22631.3447, microsoft windows 11 22h2 10.0.22621.3447 and 4 older
- CISA due date
- 21 May 2024
- Weakness
- CWE-693
24 Apr 2024 CrushFTP Remote code execution
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- crushftp 11.1.0, crushftp 10.7.1
- CISA due date
- 1 May 2024
- Weakness
- CWE-1336
24 Apr 2024 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Remote code execution
A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary code with root-level privileges. Administrator-level privileges are required to exploit this vulnerability. This vulnerability is due to improper validation of a file when it is read from system flash memory. An attacker could exploit this vulnerability by copying a crafted file to the disk0: file system of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the affected device after the next reload of the device, which could alter system behavior. Because the injected code could persist across device reboots, Cisco has raised the Security Impact Rating (SIR) of this advisory from Medium to High.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 1 May 2024
- Weakness
- CWE-94
24 Apr 2024 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Denial of service
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted web server on a device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 1 May 2024
- Weakness
- CWE-835
23 Apr 2024 Microsoft Windows Security flaw
Windows Print Spooler Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1129, microsoft windows server 2019 10.0.17763.3532, microsoft windows server 2016 10.0.14393.5427, microsoft windows 11 22h2 10.0.22621.674, microsoft windows 10 1809 10.0.17763.3532 and 7 older
- CISA due date
- 14 May 2024
12 Apr 2024 Palo Alto Networks PAN-OS Command injection
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
- What to do
- Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
- CISA due date
- 19 Apr 2024
- Weakness
- CWE-20, CWE-77
11 Apr 2024 D-Link Multiple NAS Devices Command injection
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- What to do
- This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
- CISA due date
- 2 May 2024
- Weakness
- CWE-77
On Hacker News
Honeypots: Focus on CVE-2024-327311 Apr 2024 D-Link Multiple NAS Devices Authentication bypass
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- What to do
- This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.
- CISA due date
- 2 May 2024
- Weakness
- CWE-798
4 Apr 2024 Android Pixel Security flaw
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- google android 2024-04-05
- CISA due date
- 25 Apr 2024
- Weakness
- CWE-280
4 Apr 2024 Android Pixel Security flaw
there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 25 Apr 2024
- Weakness
- CWE-908
26 Mar 2024 Microsoft SharePoint Server Remote code execution
Microsoft SharePoint Server Remote Code Execution Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 16 Apr 2024
- Weakness
- CWE-94
25 Mar 2024 Fortinet FortiClient EMS SQL injection
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- fortinet forticlient enterprise management server 7.2.3, fortinet forticlient enterprise management server 7.0.11
- CISA due date
- 15 Apr 2024
- Weakness
- CWE-89
25 Mar 2024 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Remote code execution
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 15 Apr 2024
- Weakness
- CWE-94
25 Mar 2024 Nice Linear eMerge E3-Series Command injection
Linear eMerge E3-Series devices allow Command Injections.
- What to do
- Contact the vendor for guidance on remediating firmware, per their advisory.
- CISA due date
- 15 Apr 2024
- Weakness
- CWE-78
7 Mar 2024 JetBrains TeamCity Authentication bypass
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- jetbrains teamcity 2023.11.4
- CISA due date
- 28 Mar 2024
- Weakness
- CWE-288
6 Mar 2024 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.7, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 17.4, apple iphone os 17.4, apple tvos 17.4, apple ipados 16.7.8, apple iphone os 16.7.8 and 5 older
- CISA due date
- 27 Mar 2024
- Weakness
- CWE-787
On Hacker News
CVE-2024-232966 Mar 2024 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 17.4, apple iphone os 17.4, apple tvos 17.4, apple ipados 16.7.6, apple iphone os 16.7.6 and 5 older
- CISA due date
- 27 Mar 2024
- Weakness
- CWE-787
5 Mar 2024 Android Pixel Information disclosure
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 26 Mar 2024
- Weakness
- CWE-200
5 Mar 2024 Sunhillo SureLine Command injection
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- sunhillo sureline 8.7.0.1.1
- CISA due date
- 26 Mar 2024
- Weakness
- CWE-78
4 Mar 2024 Microsoft Windows Memory corruption
Windows Kernel Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2322, microsoft windows server 2019 10.0.17763.5458, microsoft windows 11 23h2 10.0.22631.3155, microsoft windows 11 22h2 10.0.22621.3155, microsoft windows 11 21h2 10.0.22000.2777 and 3 older
- CISA due date
- 25 Mar 2024
- Weakness
- CWE-822
29 Feb 2024 Microsoft Streaming Service Memory corruption
Microsoft Streaming Service Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1784, microsoft windows server 2019 10.0.17763.4499, microsoft windows server 2016 10.0.14393.5989, microsoft windows 11 22h2 10.0.22621.1848, microsoft windows 11 21h2 10.0.22000.2057 and 4 older
- CISA due date
- 21 Mar 2024
- Weakness
- CWE-822
22 Feb 2024 ConnectWise ScreenConnect Authentication bypass
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- connectwise screenconnect 23.9.8
- CISA due date
- 29 Feb 2024
- Weakness
- CWE-288
15 Feb 2024 Microsoft Exchange Server Authentication bypass
Microsoft Exchange Server Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 7 Mar 2024
- Weakness
- CWE-287
15 Feb 2024 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Information disclosure
A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information. The vulnerability is due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. An attacker could exploit this vulnerability by sending a crafted GET request to the web services interface. A successful exploit could allow the attacker to retrieve memory contents, which could lead to the disclosure of confidential information. Note: This vulnerability affects only specific AnyConnect and WebVPN configurations. For more information, see the Vulnerable Products section.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- cisco adaptive security appliance software 9.13.1.10, cisco adaptive security appliance software 9.12.3.9, cisco adaptive security appliance software 9.10.1.40, cisco adaptive security appliance software 9.9.2.67, cisco adaptive security appliance software 9.8.4.20 and 4 older
- CISA due date
- 7 Mar 2024
- Weakness
- CWE-200
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.