The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
13 Nov 2023 Juniper Junos OS Security flaw
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- juniper junos 20.4
- CISA due date
- 17 Nov 2023
- Weakness
- CWE-473
On Hacker News
Fileless Remote Code Execution on Juniper Firewalls13 Nov 2023 Juniper Junos OS Security flaw
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R3-S1; * 22.4 versions prior to 22.4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- juniper junos 20.4
- CISA due date
- 17 Nov 2023
- Weakness
- CWE-473
8 Nov 2023 IETF Service Location Protocol (SLP) Security flaw
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.
- What to do
- Apply mitigations per vendor instructions or disable SLP service or port 427/UDP on all systems running on untrusted networks, including those directly connected to the Internet.
- Fixed in (NVD)
- vmware esxi 7.0
- CISA due date
- 29 Nov 2023
On Hacker News
Reflective DoS amplification attack via SLP 1 comment7 Nov 2023 Atlassian Confluence Data Center and Server Access control flaw
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- atlassian confluence data center 8.5.3, atlassian confluence server 8.5.3, atlassian confluence data center 8.4.4, atlassian confluence server 8.4.4, atlassian confluence data center 8.3.4 and 3 older
- CISA due date
- 28 Nov 2023
- Weakness
- CWE-863
2 Nov 2023 Apache ActiveMQ Remote code execution
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache activemq 5.18.3, apache activemq legacy openwire module 5.18.3, apache activemq 5.17.6, apache activemq legacy openwire module 5.17.6, apache activemq 5.16.7 and 3 older
- CISA due date
- 23 Nov 2023
- Weakness
- CWE-502
31 Oct 2023 F5 BIG-IP Configuration Utility SQL injection
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 21 Nov 2023
- Weakness
- CWE-89
31 Oct 2023 F5 BIG-IP Configuration Utility Authentication bypass
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 21 Nov 2023
- Weakness
- CWE-288
26 Oct 2023 Roundcube Webmail Cross-site scripting
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- roundcube webmail 1.6.4, roundcube webmail 1.5.5, roundcube webmail 1.4.15
- CISA due date
- 16 Nov 2023
- Weakness
- CWE-79
23 Oct 2023 Cisco IOS XE Web UI Command injection
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- cisco ios xe 17.9.4a, cisco ios xe 17.6.6a, cisco ios xe 17.3.8a, cisco ios xe 16.12.10a
- CISA due date
- 27 Oct 2023
- Weakness
- CWE-78
18 Oct 2023 Citrix NetScaler ADC and NetScaler Gateway Memory corruption
Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
- What to do
- Apply mitigations and kill all active and persistent sessions per vendor instructions [https://www.netscaler.com/blog/news/cve-2023-4966-critical-security-update-now-available-for-netscaler-adc-and-netscaler-gateway/] OR discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- citrix netscaler application delivery controller 14.1-8.50, citrix netscaler gateway 14.1-8.50, citrix netscaler application delivery controller 13.1-49.15, citrix netscaler gateway 13.1-49.15, citrix netscaler application delivery controller 13.1-37.164 and 3 older
- CISA due date
- 8 Nov 2023
- Weakness
- CWE-119
16 Oct 2023 Cisco IOS XE Web UI Security flaw
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issues. The attacker first exploited CVE-2023-20198 to gain initial access and issued a privilege 15 command to create a local user and password combination. This allowed the user to log in with normal user access. The attacker then exploited another component of the web UI feature, leveraging the new local user to elevate privilege to root and write the implant to the file system. Cisco has assigned CVE-2023-20273 to this issue. CVE-2023-20198 has been assigned a CVSS Score of 10.0. CVE-2023-20273 has been assigned a CVSS Score of 7.2. Both of these CVEs are being tracked by CSCwh87343.
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- rockwellautomation allen-bradley stratix 5800 firmware 17.12.02, rockwellautomation allen-bradley stratix 5200 firmware 17.12.02, cisco ios xe 17.9.4a, cisco ios xe 17.6.6a, cisco ios xe 17.3.8a and 1 older
- CISA due date
- 20 Oct 2023
- Weakness
- CWE-420
On Hacker News
Cisco iOS XE Web UI Privilege Escalation Vulnerability10 Oct 2023 IETF HTTP/2 Denial of service
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
- What to do
- Apply the vendor's update or fix. If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- eclipse jetty 12.0.2, eclipse jetty 11.0.17, eclipse jetty 10.0.17, eclipse jetty 9.4.53, siemens st7 scadaconnect 1.1 and 7 older
- CISA due date
- 31 Oct 2023
- Weakness
- CWE-400
10 Oct 2023 Microsoft Skype for Business Server-side request forgery
Skype for Business Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 31 Oct 2023
- Weakness
- CWE-918
10 Oct 2023 Microsoft WordPad Input validation flaw
Microsoft WordPad Information Disclosure Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.2031, microsoft windows server 2019 10.0.17763.4974, microsoft windows server 2016 10.0.14393.6351, microsoft windows 11 22h2 10.0.22621.2428, microsoft windows 11 21h2 10.0.22000.2538 and 5 older
- CISA due date
- 31 Oct 2023
- Weakness
- CWE-20
10 Oct 2023 Adobe Acrobat and Reader Memory corruption
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 31 Oct 2023
- Weakness
- CWE-416
10 Oct 2023 Cisco IOS and IOS XE Memory corruption
A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 31 Oct 2023
- Weakness
- CWE-787
5 Oct 2023 Apple iOS and iPadOS Security flaw
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 17.0.3, apple iphone os 17.0.3, apple ipados 16.7.1, apple iphone os 16.7.1
- CISA due date
- 26 Oct 2023
5 Oct 2023 Progress WS_FTP Server Remote code execution
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- progress ws ftp server 8.8.2, progress ws ftp server 8.7.4
- CISA due date
- 26 Oct 2023
- Weakness
- CWE-502
5 Oct 2023 Atlassian Confluence Data Center and Server Input validation flaw
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.
- Fixed in (NVD)
- atlassian confluence data center 8.5.2, atlassian confluence server 8.5.2, atlassian confluence data center 8.4.3, atlassian confluence server 8.4.3, atlassian confluence data center 8.3.3 and 1 older
- CISA due date
- 13 Oct 2023
- Weakness
- CWE-20
4 Oct 2023 JetBrains TeamCity Authentication bypass
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- jetbrains teamcity 2023.05.4
- CISA due date
- 25 Oct 2023
- Weakness
- CWE-288
4 Oct 2023 Microsoft Windows CNG Key Isolation Service Security flaw
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows 11 22h2 10.0.22621.1555, microsoft windows 11 21h2 10.0.22000.1817, microsoft windows 10 1809 10.0.17763.4252, microsoft windows 10 1607 10.0.14393.5850, microsoft windows 10 1507 10.0.10240.19869 and 3 older
- CISA due date
- 25 Oct 2023
- Weakness
- CWE-591
3 Oct 2023 Arm Mali GPU Kernel Driver Memory corruption
A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- arm bifrost gpu kernel driver r43p0, arm valhall gpu kernel driver r43p0, arm 5th gen gpu architecture kernel driver r43p0
- CISA due date
- 24 Oct 2023
- Weakness
- CWE-416
2 Oct 2023 Google Chromium libvpx Memory corruption
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- mozilla firefox 118.1, mozilla firefox 118.0.1, google chrome 117.0.5938.132, mozilla firefox 115.3.1, mozilla thunderbird 115.3.1 and 3 older
- CISA due date
- 23 Oct 2023
- Weakness
- CWE-787
28 Sep 2023 Red Hat JBoss RichFaces Framework Remote code execution
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 19 Oct 2023
- Weakness
- CWE-94
25 Sep 2023 Apple Multiple Products Security flaw
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 17.0.1, apple iphone os 17.0.1, apple macos 14.0, webkitgtk+ 2.42.2
- CISA due date
- 16 Oct 2023
- Weakness
- CWE-754
25 Sep 2023 Apple Multiple Products Security flaw
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 16.7, apple iphone os 16.7, apple macos 13.6, apple macos 12.7
- CISA due date
- 16 Oct 2023
- Weakness
- CWE-754
25 Sep 2023 Apple Multiple Products Weak cryptography
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 16.7, apple iphone os 16.7, apple macos 13.6
- CISA due date
- 16 Oct 2023
- Weakness
- CWE-295
21 Sep 2023 Trend Micro Apex One and Worry-Free Business Security Remote code execution
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation. Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 12 Oct 2023
- Weakness
- CWE-94
19 Sep 2023 MinIO Privilege escalation
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- minio 2023-03-20t20-16-18z
- CISA due date
- 10 Oct 2023
- Weakness
- CWE-269
18 Sep 2023 Samsung Mobile Devices Security flaw
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 9 Oct 2023
- Weakness
- CWE-703
18 Sep 2023 Laravel Ignition Security flaw
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- facade ignition 2.5.2
- CISA due date
- 9 Oct 2023
18 Sep 2023 Zyxel EMG2926 Routers Command injection
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 9 Oct 2023
- Weakness
- CWE-78
18 Sep 2023 Realtek SDK Input validation flaw
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- dlink dir-900l firmware 1.15b01
- CISA due date
- 9 Oct 2023
- Weakness
- CWE-20
14 Sep 2023 Adobe Acrobat and Reader Memory corruption
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- adobe acrobat dc 23.006.20320, adobe acrobat reader dc 23.006.20320, adobe acrobat 20.005.30524, adobe acrobat reader 20.005.30524
- CISA due date
- 5 Oct 2023
- Weakness
- CWE-787
13 Sep 2023 Google Chromium WebP Memory corruption
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- bentley seequent leapfrog 2023.2, mozilla firefox 117.0.1, google chrome 116.0.5845.187, microsoft edge chromium 116.0.1938.81, mozilla thunderbird 115.2.2 and 7 older
- CISA due date
- 4 Oct 2023
- Weakness
- CWE-787
13 Sep 2023 Android Framework Privilege escalation
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 4 Oct 2023
- Weakness
- CWE-269
13 Sep 2023 Cisco Adaptive Security Appliance and Firepower Threat Defense Authentication bypass
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user. This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following: Identify valid credentials that could then be used to establish an unauthorized remote access VPN session. Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier). Notes: Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured. This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured. Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.
- What to do
- Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.
- CISA due date
- 4 Oct 2023
- Weakness
- CWE-288
12 Sep 2023 Microsoft Streaming Service Proxy Memory corruption
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1970, microsoft windows server 2019 10.0.17763.4851, microsoft windows 11 22h2 10.0.22621.2275, microsoft windows 11 21h2 10.0.22000.2416, microsoft windows 10 1809 10.0.17763.4851 and 2 older
- CISA due date
- 3 Oct 2023
- Weakness
- CWE-416
12 Sep 2023 Microsoft Word Input validation flaw
Microsoft Word Information Disclosure Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 3 Oct 2023
- Weakness
- CWE-668
11 Sep 2023 Apple iOS, iPadOS, and macOS Memory corruption
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 16.6.1, apple iphone os 16.6.1, apple ipados 15.7.9, apple iphone os 15.7.9, apple macos 13.5.2 and 2 older
- CISA due date
- 2 Oct 2023
- Weakness
- CWE-120
11 Sep 2023 Apple iOS, iPadOS, and watchOS Input validation flaw
A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apple ipados 16.6.1, apple iphone os 16.6.1, apple watchos 9.6.2
- CISA due date
- 2 Oct 2023
- Weakness
- CWE-20
6 Sep 2023 Apache RocketMQ Remote code execution
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache rocketmq 5.1.1, apache rocketmq 4.9.6
- CISA due date
- 27 Sep 2023
- Weakness
- CWE-94
24 Aug 2023 RARLAB WinRAR Security flaw
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through October 2023.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- rarlab winrar 6.23
- CISA due date
- 14 Sep 2023
- Weakness
- CWE-351
24 Aug 2023 Ignite Realtime Openfire Path traversal
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- igniterealtime openfire 4.7.5, igniterealtime openfire 4.6.8
- CISA due date
- 14 Sep 2023
- Weakness
- CWE-22
22 Aug 2023 Ivanti Sentry Access control flaw
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 12 Sep 2023
- Weakness
- CWE-863
22 Aug 2023 Veeam Backup & Replication Authentication bypass
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- veeam backup & replication 11.0.1.1261
- CISA due date
- 12 Sep 2023
- Weakness
- CWE-306
21 Aug 2023 Adobe ColdFusion Remote code execution
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 11 Sep 2023
- Weakness
- CWE-502
16 Aug 2023 Citrix Content Collaboration Access control flaw
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- citrix sharefile storage zones controller 5.11.24
- CISA due date
- 6 Sep 2023
- Weakness
- CWE-284
9 Aug 2023 Microsoft .NET Core and Visual Studio Denial of service
.NET and Visual Studio Denial of Service Vulnerability
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- microsoft visual studio 2022 17.6.6, microsoft visual studio 2022 17.4.10, microsoft visual studio 2022 17.2.18, microsoft .net 7.0.10, microsoft .net 6.0.21 and 1 older
- CISA due date
- 30 Aug 2023
- Weakness
- CWE-400
7 Aug 2023 Zyxel P660HN-T1A Routers Command injection
The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 28 Aug 2023
- Weakness
- CWE-78
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.