The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
12 May 2023 Apache Tomcat Access control flaw
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache tomcat 8.5.7, apache tomcat 8.0.39, apache tomcat 7.0.73, apache tomcat 6.0.48
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-284
12 May 2023 Oracle Java SE and JRockit Access control flaw
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache cassandra 3.11.8, apache cassandra 3.0.22, apache cassandra 2.2.18, apache cassandra 2.1.22
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-284
12 May 2023 Jenkins User Interface (UI) Information disclosure
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-200
12 May 2023 Linux Kernel Race condition
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- linux kernel 3.14.4, linux kernel 3.12.20, linux kernel 3.10.40, linux kernel 3.4.91, linux kernel 3.2.59
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-362
12 May 2023 Linux Kernel Input validation flaw
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- linux kernel 2.6.36
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-20
9 May 2023 Microsoft Win32k Memory corruption
Win32k Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows 10 1607 10.0.14393.5921, microsoft windows 10 1507 10.0.10240.19926
- CISA due date
- 30 May 2023
- Weakness
- CWE-416
1 May 2023 Oracle WebLogic Server Remote code execution
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 May 2023
- Weakness
- CWE-502, CWE-306
1 May 2023 TP-Link Archer AX21 Command injection
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- tp-link archer ax21 firmware 1.1.4
- CISA due date
- 22 May 2023
- Weakness
- CWE-77
1 May 2023 Apache Log4j2 Remote code execution
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens e-car operation center 2021-12-13, siemens industrial edge management hub 2021-12-13, siemens navigator 2021-12-13, siemens mindsphere 2021-12-11, siemens solid edge harness design 2020 and 7 older
- CISA due date
- 22 May 2023
- Weakness
- CWE-917
21 Apr 2023 MinIO Information disclosure
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- minio 2023-03-20t20-16-18z
- CISA due date
- 12 May 2023
- Weakness
- CWE-200
21 Apr 2023 PaperCut MF/NG Access control flaw
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- papercut mf 22.0.9, papercut ng 22.0.9, papercut mf 21.2.11, papercut ng 21.2.11, papercut mf 20.1.7 and 1 older
- CISA due date
- 12 May 2023
- Weakness
- CWE-284
21 Apr 2023 Google Chromium Skia Memory corruption
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 112.0.5615.137
- CISA due date
- 12 May 2023
- Weakness
- CWE-190
On Hacker News
Google Chrome Zero-Day 1 comment19 Apr 2023 Cisco IOS and IOS XE Software Memory corruption
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device. The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system. Only traffic directed to the affected system can be used to exploit this vulnerability.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 May 2023
- Weakness
- CWE-119
17 Apr 2023 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 112.0.5615.121, couchbase server 7.1.5
- CISA due date
- 8 May 2023
- Weakness
- CWE-843
17 Apr 2023 Apple macOS Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple mac os x 10.14.4
- CISA due date
- 8 May 2023
- Weakness
- CWE-416
13 Apr 2023 Novi Survey Remote code execution
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- 3rdmill novi survey 8.9.43676
- CISA due date
- 4 May 2023
- Weakness
- CWE-94
13 Apr 2023 Android Framework Weak cryptography
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 4 May 2023
- Weakness
- CWE-295
11 Apr 2023 Microsoft Windows Memory corruption
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows 11 22h2 10.0.22621.1555, microsoft windows 11 21h2 10.0.22000.1817, microsoft windows 10 1809 10.0.17763.4252, microsoft windows 10 1607 10.0.14393.5850, microsoft windows 10 1507 10.0.10240.19869 and 3 older
- CISA due date
- 2 May 2023
- Weakness
- CWE-122
10 Apr 2023 Apple iOS, iPadOS, and macOS Memory corruption
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15.7.5, macOS Big Sur 11.7.6. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 16.4.1, apple iphone os 16.4.1, apple ipados 15.7.5, apple iphone os 15.7.5, apple macos 13.3.1 and 2 older
- CISA due date
- 1 May 2023
- Weakness
- CWE-787
10 Apr 2023 Apple Multiple Products Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple safari 16.4.1, apple ipados 16.4.1, apple iphone os 16.4.1, apple ipados 15.7.5, apple iphone os 15.7.5 and 1 older
- CISA due date
- 1 May 2023
- Weakness
- CWE-416
7 Apr 2023 Arm Mali Graphics Processing Unit (GPU) Denial of service
Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- arm bifrost gpu kernel driver r43p0, arm valhall gpu kernel driver r43p0, arm 5th gen gpu architecture kernel driver r43p0
- CISA due date
- 28 Apr 2023
- Weakness
- CWE-401
7 Apr 2023 Veritas Backup Exec Agent Authentication bypass
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. The attacker could use one of these commands to execute an arbitrary command on the system using system privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- veritas backup exec 21.2
- CISA due date
- 28 Apr 2023
- Weakness
- CWE-287
7 Apr 2023 Veritas Backup Exec Agent Authentication bypass
An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- veritas backup exec 21.2
- CISA due date
- 28 Apr 2023
- Weakness
- CWE-287
7 Apr 2023 Veritas Backup Exec Agent Authentication bypass
An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability in the SHA Authentication scheme, an attacker is able to gain unauthorized access and complete the authentication process. Subsequently, the client can execute data management protocol commands on the authenticated connection. By using crafted input parameters in one of these commands, an attacker can access an arbitrary file on the system using System privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- veritas backup exec 21.2
- CISA due date
- 28 Apr 2023
- Weakness
- CWE-287
7 Apr 2023 Microsoft Windows Privilege escalation
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 28 Apr 2023
- Weakness
- CWE-269
3 Apr 2023 Synacor Zimbra Collaboration Suite (ZCS) Cross-site scripting
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Apr 2023
- Weakness
- CWE-79, CWE-138
30 Mar 2023 Linux Kernel Memory corruption
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 6.1.6, linux kernel 5.15.88, linux kernel 5.10.163, linux kernel 5.4.229, linux kernel 4.19.270 and 1 older
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-416
30 Mar 2023 Fortra Cobalt Strike Input validation flaw
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-79, CWE-116
30 Mar 2023 Fortra Cobalt Strike Cross-site scripting
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- helpsystems cobalt strike 4.7.1
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-20, CWE-79
30 Mar 2023 Arm Mali Graphics Processing Unit (GPU) Memory corruption
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-416
30 Mar 2023 Google Chromium Network Service Memory corruption
Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 105.0.5195.52
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-416
30 Mar 2023 Arm Mali Graphics Processing Unit (GPU) Memory corruption
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0, Bifrost r0p0 through r35p0, and Valhall r19p0 through r35p0.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- arm bifrost gpu kernel driver r36p0, arm valhall gpu kernel driver r36p0, arm midgard gpu kernel driver r32p0
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-119
30 Mar 2023 Apple iOS, iPadOS, and macOS Memory corruption
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A malicious application may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.8.1, apple iphone os 14.8.1, apple macos 11.6.1
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-20, CWE-787
30 Mar 2023 Samba Remote code execution
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- samba 4.6.4, samba 4.5.10, samba 4.4.14, samba 4.4.0
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-94
30 Mar 2023 Microsoft Internet Explorer Memory corruption
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3144 and CVE-2013-3151.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 20 Apr 2023
- Weakness
- CWE-94
15 Mar 2023 Adobe ColdFusion Access control flaw
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 Apr 2023
- Weakness
- CWE-284
14 Mar 2023 Microsoft Windows Access control flaw
Windows SmartScreen Security Feature Bypass Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1602, microsoft windows server 2019 10.0.17763.4131, microsoft windows server 2016 10.0.14393.5786, microsoft windows 11 22h2 10.0.22000.1413, microsoft windows 11 21h2 10.0.22000.1696 and 5 older
- CISA due date
- 4 Apr 2023
- Weakness
- CWE-863
14 Mar 2023 Microsoft Office Authentication bypass
Microsoft Outlook Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 4 Apr 2023
- Weakness
- CWE-294
14 Mar 2023 Fortinet FortiOS Path traversal
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 7.2.4, fortinet fortios 7.0.10, fortinet fortios 6.4.12, fortinet fortios 6.2.14
- CISA due date
- 4 Apr 2023
- Weakness
- CWE-22
10 Mar 2023 XStream Remote code execution
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- xstream 1.4.18
- CISA due date
- 31 Mar 2023
- Weakness
- CWE-94, CWE-502
10 Mar 2023 Plex Media Server Remote code execution
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- plex media server 1.19.3
- CISA due date
- 31 Mar 2023
- Weakness
- CWE-502
7 Mar 2023 Teclib GLPI Input validation flaw
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 28 Mar 2023
- Weakness
- CWE-74
7 Mar 2023 Apache Spark Command injection
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 28 Mar 2023
- Weakness
- CWE-78
7 Mar 2023 Zoho ManageEngine Command injection
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- zohocorp manageengine adselfservice plus 6.1
- CISA due date
- 28 Mar 2023
- Weakness
- CWE-78, CWE-259
27 Feb 2023 ZK Framework AuUploader Security flaw
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- zkoss zk framework 9.6.2, zkoss zk framework 9.5.1.3, zkoss zk framework 9.0.1.3, zkoss zk framework 8.6.4.2
- CISA due date
- 20 Mar 2023
- Weakness
- CWE-441
21 Feb 2023 IBM Aspera Faspex Remote code execution
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 14 Mar 2023
- Weakness
- CWE-502
21 Feb 2023 Mitel MiVoice Connect Remote code execution
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 14 Mar 2023
- Weakness
- CWE-94
21 Feb 2023 Mitel MiVoice Connect Command injection
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 14 Mar 2023
- Weakness
- CWE-77
16 Feb 2023 Cacti Command injection
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device. The vulnerability resides in the `remote_agent.php` file. This file can be accessed without authentication. This function retrieves the IP address of the client via `get_client_addr` and resolves this IP address to the corresponding hostname via `gethostbyaddr`. After this, it is verified that an entry within the `poller` table exists, where the hostname corresponds to the resolved hostname. If such an entry was found, the function returns `true` and the client is authorized. This authorization can be bypassed due to the implementation of the `get_client_addr` function. The function is defined in the file `lib/functions.php` and checks serval `$_SERVER` variables to determine the IP address of the client. The variables beginning with `HTTP_` can be arbitrarily set by an attacker. Since there is a default entry in the `poller` table with the hostname of the server running Cacti, an attacker can bypass the authentication e.g. by providing the header `Forwarded-For: <TARGETIP>`. This way the function `get_client_addr` returns the IP address of the server running Cacti. The following call to `gethostbyaddr` will resolve this IP address to the hostname of the server, which will pass the `poller` hostname check because of the default entry. After the authorization of the `remote_agent.php` file is bypassed, an attacker can trigger different actions. One of these actions is called `polldata`. The called function `poll_for_data` retrieves a few request parameters and loads the corresponding `poller_item` entries from the database. If the `action` of a `poller_item` equals `POLLER_ACTION_SCRIPT_PHP`, the function `proc_open` is used to execute a PHP script. The attacker-controlled parameter `$poller_id` is retrieved via the function `get_nfilter_request_var`, which allows arbitrary strings. This variable is later inserted into the string passed to `proc_open`, which leads to a command injection vulnerability. By e.g. providing the `poller_id=;id` the `id` command is executed. In order to reach the vulnerable call, the attacker must provide a `host_id` and `local_data_id`, where the `action` of the corresponding `poller_item` is set to `POLLER_ACTION_SCRIPT_PHP`. Both of these ids (`host_id` and `local_data_id`) can easily be bruteforced. The only requirement is that a `poller_item` with an `POLLER_ACTION_SCRIPT_PHP` action exists. This is very likely on a productive instance because this action is added by some predefined templates like `Device - Uptime` or `Device - Polling Time`. This command injection vulnerability allows an unauthenticated user to execute arbitrary commands if a `poller_item` with the `action` type `POLLER_ACTION_SCRIPT_PHP` (`2`) is configured. The authorization bypass should be prevented by not allowing an attacker to make `get_client_addr` (file `lib/functions.php`) return an arbitrary IP address. This could be done by not honoring the `HTTP_...` `$_SERVER` variables. If these should be kept for compatibility reasons it should at least be prevented to fake the IP address of the server running Cacti. This vulnerability has been addressed in both the 1.2.x and 1.3.x release branches with `1.2.23` being the first release containing the patch.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- cacti 1.2.23
- CISA due date
- 9 Mar 2023
- Weakness
- CWE-74
14 Feb 2023 Apple Multiple Products Memory corruption
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 16.3.1, apple iphone os 16.3.1, apple safari 16.3, apple ipados 15.7.4, apple iphone os 15.7.4 and 1 older
- CISA due date
- 7 Mar 2023
- Weakness
- CWE-843
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.