The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
27 Jun 2022 Apple Multiple Products Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to execute arbitrary code with system privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 12.3, apple tvos 12.3, apple mac os x 10.14.5, apple watchos 5.2.1
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-416
27 Jun 2022 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 12.0, apple tvos 12.0, apple mac os x 10.14, apple watchos 5.0
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-119
14 Jun 2022 Microsoft Windows Security flaw
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.770, microsoft windows server 2019 10.0.17763.3046, microsoft windows server 2016 10.0.14393.5192, microsoft windows server 20h2 10.0.19042.1766, microsoft windows 11 21h2 10.0.22000.739 and 6 older
- CISA due date
- 5 Jul 2022
- Weakness
- CWE-610
9 Jun 2022 SAP NetWeaver Path traversal
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of the Java Server process. These commands can be used to read or modify any information on the server or shut the server down making it unavailable.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 30 Jun 2022
- Weakness
- CWE-23
9 Jun 2022 SAP NetWeaver Information disclosure
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 30 Jun 2022
- Weakness
- CWE-200
9 Jun 2022 SAP NetWeaver SQL injection
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 30 Jun 2022
- Weakness
- CWE-89
8 Jun 2022 QNAP Photo Station Path traversal
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- qnap photo station 6.0.3, qnap photo station 5.7.10, qnap photo station 5.4.9, qnap photo station 5.2.11
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-22
8 Jun 2022 QNAP Photo Station Path traversal
This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fix the vulnerability, QNAP recommend updating Photo Station to their latest versions.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- qnap photo station 6.0.3, qnap photo station 5.7.10, qnap photo station 5.4.9, qnap photo station 5.2.11
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-22
8 Jun 2022 QNAP QTS Input validation flaw
This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend updating QTS to their latest versions.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-20
8 Jun 2022 QNAP Photo Station Access control flaw
This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- qnap photo station 6.0.3, qnap photo station 5.7.10, qnap photo station 5.4.9, qnap photo station 5.2.11
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-863
8 Jun 2022 Google Chromium V8 Memory corruption
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 73.0.3683.86
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-787
8 Jun 2022 Cisco RV Series Routers Remote code execution
A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The attacker must have either a valid credential or an active session token. The vulnerability is due to lack of input validation of the HTTP payload. An attacker could exploit this vulnerability by sending a malicious HTTP request to the web-based management interface of the targeted device. A successful exploit could allow the attacker to execute commands with root privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- cisco rv082 dual wan vpn firmware 4.2.3.10, cisco rv042 dual wan vpn firmware 4.2.3.10, cisco rv042g dual gigabit wan vpn firmware 4.2.3.10, cisco rv016 multi-wan vpn firmware 4.2.3.10
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-502
8 Jun 2022 Google Chromium V8 Memory corruption
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 65.0.3325.146
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-190, CWE-787
8 Jun 2022 Adobe Acrobat and Reader Memory corruption
Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-415
8 Jun 2022 Google Chromium V8 Memory corruption
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 71.0.3578.80
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-787
8 Jun 2022 Google Chromium V8 Security flaw
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 70.0.3538.67
- CISA due date
- 22 Jun 2022
8 Jun 2022 NETGEAR Multiple Devices Memory corruption
NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses a parameter in the administration webapp. The NETGEAR ID is PSV-2016-0261.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- netgear wnr2000 firmware 1.1.2.14, netgear wnr2000 firmware 1.0.0.66, netgear wnr2000 firmware 1.0.0.42
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
8 Jun 2022 Google Chromium V8 Memory corruption
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 59.0.3071.92, google chrome 59.0.3071.86
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-843
8 Jun 2022 Google Chromium V8 Memory corruption
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 57.0.2987.108, google chrome 57.0.2987.98
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-125
8 Jun 2022 Google Chromium V8 Memory corruption
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 54.0.2840.90, google chrome 54.0.2840.87, google chrome 54.0.2840.85
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-125, CWE-787
8 Jun 2022 Google Chromium V8 Memory corruption
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 49.0.2623.108
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
8 Jun 2022 Microsoft Office Memory corruption
Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office document, leading to improper memory allocation, aka "Office Buffer Overflow Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
8 Jun 2022 Adobe Flash Player Memory corruption
Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 11.4.402.265
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-189
8 Jun 2022 Microsoft Internet Explorer Memory corruption
Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site, as exploited in the wild in September 2012.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-416
8 Jun 2022 Microsoft XML Core Services Memory corruption
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
8 Jun 2022 Adobe Flash Player Cross-site scripting
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 11.1.115.6, adobe flash player 11.1.111.6, adobe flash player 11.1.102.62, adobe flash player 10.3.183.15
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-79
8 Jun 2022 Adobe Flash Player Memory corruption
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 11.1.115.6, adobe flash player 11.1.111.6, adobe flash player 11.1.102.62, adobe flash player 10.3.183.15
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-787
8 Jun 2022 Microsoft Windows Input validation flaw
The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute arbitrary code via a modified file with additional content, aka "WinVerifyTrust Signature Validation Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-20
8 Jun 2022 Adobe Reader and Acrobat Memory corruption
Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-787
8 Jun 2022 Adobe Flash Player Security flaw
Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- google chrome 10.0.648.134
- CISA due date
- 22 Jun 2022
8 Jun 2022 Adobe Acrobat and Reader Memory corruption
Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 9.4, adobe acrobat reader 9.4, adobe acrobat 8.2.5, adobe acrobat reader 8.2.5
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
On Hacker News
Critical vulnerability in Adobe Reader8 Jun 2022 Microsoft PowerPoint Memory corruption
Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document, aka "PowerPoint Parsing Buffer Overflow Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
8 Jun 2022 Adobe Flash Player Memory corruption
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 10.1.53.64, adobe acrobat 9.3.3, adobe flash player 9.0.277.0, adobe acrobat 8.2.3, adobe air 2.0.2.12610
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-787
8 Jun 2022 Adobe Acrobat and Reader Memory corruption
Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 9.3, adobe acrobat reader 9.3, adobe acrobat 8.2, adobe acrobat reader 8.2
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-399
8 Jun 2022 Adobe Acrobat and Reader Memory corruption
The U3D implementation in Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2 on Windows and Mac OS X, and 7.x before 7.1.4 allows remote attackers to execute arbitrary code via malformed U3D data in a PDF document, related to a CLODProgressiveMeshDeclaration "array boundary issue," a different vulnerability than CVE-2009-2994.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 9.3, adobe acrobat 8.2, adobe acrobat 7.1.4
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
8 Jun 2022 Adobe Acrobat and Reader, Flash Player Memory corruption
Unspecified vulnerability in Adobe Reader and Acrobat 9.x through 9.1.2, and Adobe Flash Player 9.x through 9.0.159.0 and 10.x through 10.0.22.87, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via (1) a crafted Flash application in a .pdf file or (2) a crafted .swf file, related to authplay.dll, as exploited in the wild in July 2009.
- What to do
- For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-94
8 Jun 2022 Microsoft Office Memory corruption
Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
8 Jun 2022 Microsoft Office Remote code execution
Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System SP1 and SP2; Open XML File Format Converter for Mac; Microsoft Office Excel Viewer 2003 SP3; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Object Record Corruption Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-94
8 Jun 2022 Adobe Acrobat and Reader Information disclosure
Multiple unspecified vulnerabilities in Adobe Reader and Acrobat before 8.1.2 have unknown impact and attack vectors.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 8.1.2, adobe acrobat reader 8.1.2
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-200
8 Jun 2022 Adobe Acrobat and Reader Memory corruption
Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long arguments to unspecified JavaScript methods. NOTE: this issue might be subsumed by CVE-2008-0655.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 8.1.2, adobe acrobat reader 8.1.2
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-119
8 Jun 2022 Microsoft Word Memory corruption
Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 22 Jun 2022
- Weakness
- CWE-120
2 Jun 2022 Atlassian Confluence Server/Data Center Remote code execution
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.
- What to do
- Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules.
- Fixed in (NVD)
- atlassian confluence data center 7.17.4, atlassian confluence server 7.17.4, atlassian confluence data center 7.16.4, atlassian confluence server 7.16.4, atlassian confluence data center 7.15.2 and 7 older
- CISA due date
- 6 Jun 2022
- Weakness
- CWE-917
25 May 2022 Oracle Solaris Security flaw
Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
25 May 2022 Microsoft Windows Access control flaw
atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Open Type Font Remote Code Execution Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-284
25 May 2022 Microsoft Windows Access control flaw
Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component RCE Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-284
25 May 2022 Adobe Flash Player and AIR Memory corruption
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-0993.
- What to do
- The impacted products are end-of-life and should be disconnected if still in use.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-190
25 May 2022 Adobe Flash Player and AIR Memory corruption
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.
- What to do
- The impacted products are end-of-life and should be disconnected if still in use.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-416
25 May 2022 Microsoft Silverlight Input validation flaw
Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."
- What to do
- The impacted products are end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- microsoft silverlight 5.1.41212.0
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-20
25 May 2022 Adobe Flash Player Memory corruption
Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 20.0.0.267, adobe air sdk 20.0.0.233, adobe air sdk & compiler 20.0.0.233, adobe air 20.0.0.233, adobe flash player 18.0.0.324 and 6 older
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-189
25 May 2022 Microsoft Windows Security flaw
The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-264
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.