The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
15 Sep 2022 Linux Kernel Input validation flaw
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 3.5.5, linux kernel 3.4.12, linux kernel 3.2.54
- CISA due date
- 6 Oct 2022
- Weakness
- CWE-20
15 Sep 2022 Code Aurora ACDB Audio Driver Memory corruption
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that leverages /dev/msm_acdb access and provides a large size value in an ioctl argument.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 6 Oct 2022
- Weakness
- CWE-119
15 Sep 2022 Linux Kernel Memory corruption
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 3.8.9, linux kernel 3.4.42, linux kernel 3.2.45, linux kernel 3.0.75
- CISA due date
- 6 Oct 2022
- Weakness
- CWE-189
15 Sep 2022 Linux Kernel Security flaw
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 3.8.9, linux kernel 3.4.42, linux kernel 3.2.45, linux kernel 3.0.75
- CISA due date
- 6 Oct 2022
- Weakness
- CWE-189
15 Sep 2022 Microsoft Windows Input validation flaw
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 6 Oct 2022
- Weakness
- CWE-20
14 Sep 2022 Microsoft Windows Memory corruption
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1006, microsoft windows server 2019 10.0.17763.3406, microsoft windows server 2016 10.0.14393.5356, microsoft windows 11 21h2 10.0.22000.978, microsoft windows 10 1809 10.0.17763.3406 and 5 older
- CISA due date
- 5 Oct 2022
- Weakness
- CWE-20, CWE-787
14 Sep 2022 Apple iOS, iPadOS, and macOS Memory corruption
The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 15.7, apple iphone os 15.7, apple macos 12.6, apple macos 11.7
- CISA due date
- 5 Oct 2022
- Weakness
- CWE-20, CWE-787
8 Sep 2022 Google Chromium Mojo Input validation flaw
Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 105.0.5195.102
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-20
8 Sep 2022 QNAP Photo Station Security flaw
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- qnap photo station 6.1.2, qnap photo station 6.0.22, qnap photo station 5.7.18, qnap photo station 5.4.15, qnap photo station 5.2.14
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-610
8 Sep 2022 D-Link DIR-820L Command injection
D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-78
8 Sep 2022 Apple iOS, iPadOS, and macOS Security flaw
An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 13.6, apple iphone os 13.6, apple mac os x 10.15.6
- CISA due date
- 29 Sep 2022
8 Sep 2022 MikroTik RouterOS Memory corruption
A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. The overflow occurs before authentication takes place, so it is possible for an unauthenticated remote attacker to exploit it. All architectures and all devices running RouterOS before versions 6.41.3/6.42rc27 are vulnerable.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mikrotik routeros 6.41.3
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-119
8 Sep 2022 D-Link Multiple Routers Command injection
OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.
- What to do
- The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use.
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-78
8 Sep 2022 Oracle WebLogic Server Remote code execution
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-502
8 Sep 2022 Fortinet FortiOS and FortiADC Access control flaw
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 6.0.3, fortinet fortiadc 6.0.2, fortinet fortiadc 5.4.5
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-732
8 Sep 2022 NETGEAR Multiple Devices Information disclosure
An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely if the remote management option is set, and can also be exploited given access to the router over LAN or WLAN. When trying to access the web panel, a user is asked to authenticate; if the authentication is canceled and password recovery is not enabled, the user is redirected to a page that exposes a password recovery token. If a user supplies the correct token to the page /passwordrecovered.cgi?id=TOKEN (and password recovery is not enabled), they will receive the admin password for the router. If password recovery is set the exploit will fail, as it will ask the user for the recovery questions that were previously set when enabling that feature. This is persistent (even after disabling the recovery option, the exploit will fail) because the router will ask for the security questions.
- What to do
- Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-200
8 Sep 2022 D-Link DIR-300 Router Information disclosure
The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-310
8 Sep 2022 Android OS Memory corruption
The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local users to execute arbitrary code and gain root privileges via a negative index that bypasses a maximum-only signed integer check in the DirectVolume::handlePartitionAdded method, which triggers memory corruption, as demonstrated by Gingerbreak.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google android 2.3.4
- CISA due date
- 29 Sep 2022
- Weakness
- CWE-189
25 Aug 2022 dotCMS Path traversal
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-22, CWE-138
25 Aug 2022 Apache CouchDB Security flaw
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache couchdb 3.2.2
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-1188
25 Aug 2022 Apache APISIX Authentication bypass
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache apisix 2.12.1, apache apisix 2.10.4
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-290
25 Aug 2022 VMware Tanzu Spring Cloud Remote code execution
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-94
25 Aug 2022 WebRTC Memory corruption
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 103.0.5060.114, apple ipados 15.6, apple iphone os 15.6, apple tvos 15.6, apple macos 12.5 and 5 older
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-122
25 Aug 2022 Grafana Labs Grafana Authentication bypass
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- grafana 8.1.6, grafana 7.5.11
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-287
25 Aug 2022 Delta Electronics DOPSoft 2 Memory corruption
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-787
On Hacker News
CVE-2021-38406 or CISA KEV Catalog Lacks Accountability25 Aug 2022 Apple iOS, macOS, watchOS Remote code execution
A deserialization issue was addressed through improved validation. This issue is fixed in Security Update 2021-005 Catalina, iOS 12.5.5, iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, watchOS 7.6.2. A sandboxed process may be able to circumvent sandbox restrictions. Apple was aware of a report that this issue may have been actively exploited at the time of release..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.8, apple iphone os 14.8, apple iphone os 12.5.5, apple macos 11.6, apple mac os x 10.15.7 and 1 older
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-20, CWE-502
25 Aug 2022 PEAR Archive_Tar Path traversal
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 9.1.3, drupal 9.0.11, drupal 8.9.13, drupal 7.78
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-22, CWE-59
25 Aug 2022 PEAR Archive_Tar Input validation flaw
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 9.0.9, drupal 8.9.10, drupal 8.8.12, drupal 7.75, php archive tar 1.4.12
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-74
22 Aug 2022 Palo Alto Networks PAN-OS Security flaw
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (virtual) and CN-Series (container) firewall against an attacker-specified target. To be misused by an external attacker, the firewall configuration must have a URL filtering profile with one or more blocked categories assigned to a source zone that has an external facing interface. This configuration is not typical for URL filtering and, if set, is likely unintended by the administrator. If exploited, this issue would not impact the confidentiality, integrity, or availability of our products. However, the resulting denial-of-service (DoS) attack may help obfuscate the identity of the attacker and implicate the firewall as the source of the attack. We have taken prompt action to address this issue in our PAN-OS software. All software updates for this issue are expected to be released no later than the week of August 15, 2022. This issue does not impact Panorama M-Series or Panorama virtual appliances. This issue has been resolved for all Cloud NGFW and Prisma Access customers and no additional action is required from them.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- paloaltonetworks pan-os 10.2.2, paloaltonetworks pan-os 10.1.6, paloaltonetworks pan-os 10.0.11, paloaltonetworks pan-os 9.1.14, paloaltonetworks pan-os 9.0.16 and 1 older
- CISA due date
- 12 Sep 2022
- Weakness
- CWE-940
18 Aug 2022 Apple iOS and macOS Memory corruption
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 15.6.1, apple iphone os 15.6.1, apple macos 12.5.1, apple macos 11.7, apple watchos 9.0
- CISA due date
- 8 Sep 2022
- Weakness
- CWE-20, CWE-787
18 Aug 2022 Apple iOS and macOS Memory corruption
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple safari 15.6.1, apple ipados 15.6.1, apple iphone os 15.6.1, apple macos 12.5.1, webkitgtk 2.36.7 and 1 older
- CISA due date
- 8 Sep 2022
- Weakness
- CWE-20, CWE-787
18 Aug 2022 Google Chromium Intents Input validation flaw
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 104.0.5112.102, google chrome 104.0.5112.101
- CISA due date
- 8 Sep 2022
- Weakness
- CWE-20
18 Aug 2022 Microsoft Active Directory Weak cryptography
Active Directory Domain Services Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.1668, microsoft windows server 2019 10.0.17763.4252, microsoft windows server 2016 10.0.14393.5850, microsoft windows 11 21h2 10.0.22000.1817, microsoft windows 10 1909 10.0.18363.2274 and 6 older
- CISA due date
- 8 Sep 2022
- Weakness
- CWE-295
18 Aug 2022 SAP Multiple Products Input validation flaw
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 8 Sep 2022
- Weakness
- CWE-444
18 Aug 2022 Microsoft Windows Memory corruption
Windows Runtime Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.524, microsoft windows server 2019 10.0.17763.2565, microsoft windows server 20h2 10.0.19042.1526, microsoft windows 11 21h2 10.0.22000.493, microsoft windows 10 1909 10.0.18363.2094 and 4 older
- CISA due date
- 8 Sep 2022
- Weakness
- CWE-824
18 Aug 2022 Palo Alto Networks PAN-OS Memory corruption
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- paloaltonetworks pan-os 8.0.6, paloaltonetworks pan-os 7.1.14, paloaltonetworks pan-os 7.0.19, paloaltonetworks pan-os 6.1.19
- CISA due date
- 8 Sep 2022
- Weakness
- CWE-20, CWE-119
11 Aug 2022 Synacor Zimbra Collaboration Suite (ZCS) Path traversal
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Sep 2022
- Weakness
- CWE-23
11 Aug 2022 Synacor Zimbra Collaboration Suite (ZCS) Path traversal
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Sep 2022
- Weakness
- CWE-22
9 Aug 2022 Microsoft Windows Security flaw
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.887, microsoft windows server 2019 10.0.17763.3287, microsoft windows server 2016 10.0.14393.5291, microsoft windows server 20h2 10.0.19042.1889, microsoft windows 11 21h2 10.0.22000.856 and 6 older
- CISA due date
- 30 Aug 2022
9 Aug 2022 RARLAB UnRAR Path traversal
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- rarlab unrar 6.12
- CISA due date
- 30 Aug 2022
- Weakness
- CWE-22, CWE-59
4 Aug 2022 Synacor Zimbra Collaboration Suite (ZCS) Input validation flaw
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 25 Aug 2022
- Weakness
- CWE-93
29 Jul 2022 Atlassian Confluence Authentication bypass
The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the hardcoded password could exploit this to log into Confluence and access all content accessible to users in the confluence-users group. This user account is created when installing versions 2.7.34, 2.7.35, and 3.0.2 of the app.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 19 Aug 2022
- Weakness
- CWE-798
12 Jul 2022 Microsoft Windows Security flaw
Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.825, microsoft windows server 2019 10.0.17763.3165, microsoft windows server 2016 10.0.14393.5246, microsoft windows server 20h2 10.0.19042.1826, microsoft windows 11 21h2 10.0.22000.795 and 6 older
- CISA due date
- 2 Aug 2022
- Weakness
- CWE-426
1 Jul 2022 Microsoft Windows Authentication bypass
Windows LSA Spoofing Vulnerability
- What to do
- Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.707, microsoft windows server 2019 10.0.17763.2928, microsoft windows server 2016 10.0.14393.5125, microsoft windows server 20h2 10.0.19042.1706, microsoft windows 11 21h2 10.0.22000.675 and 7 older
- CISA due date
- 22 Jul 2022
- Weakness
- CWE-306
27 Jun 2022 Mitel MiVoice Connect Input validation flaw
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-20
27 Jun 2022 Red Hat Polkit Memory corruption
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens scalance lpe9403 firmware 2.0, polkit project polkit 121, siemens sinumerik edge 3.3.0
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-787
27 Jun 2022 Apple iOS and iPadOS Memory corruption
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 15.2 and iPadOS 15.2. An application may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 15.2, apple iphone os 15.2
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-119
27 Jun 2022 Google Chromium PopupBlocker Access control flaw
Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 91.0.4472.77
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-863
27 Jun 2022 Apple Multiple Products Memory corruption
A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 13.6, apple iphone os 13.6, apple tvos 13.4.8
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-787
27 Jun 2022 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 13.3.1, apple iphone os 13.3.1, apple tvos 13.3.1, apple mac os x 10.15.3, apple watchos 6.1.2
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-787
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.