The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
23 May 2022 Microsoft Windows Memory corruption
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0913, CVE-2020-1000, CVE-2020-1003.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-787
23 May 2022 Microsoft Update Notification Manager Path traversal
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-59
23 May 2022 WebKitGTK Memory corruption
A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- webkitgtk 2.26.0, wpewebkit wpe webkit 2.26.0
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-119
23 May 2022 Apple iOS Memory corruption
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 12.1.4
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-787
23 May 2022 Apple Multiple Products Memory corruption
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple iphone os 12.1.4, apple mac os x 10.14.3
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-787
23 May 2022 Google Chrome Blink Memory corruption
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 72.0.3626.121
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-416
23 May 2022 Meta Platforms WhatsApp Cross-site scripting
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- whatsapp 2.20.10, whatsapp 0.3.9309
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-79
23 May 2022 Microsoft Windows Path traversal
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-59
23 May 2022 Google Chrome WebAudio Memory corruption
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 78.0.3904.87
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-416
23 May 2022 Mozilla Firefox and Thunderbird Input validation flaw
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 67.0.4, mozilla firefox 60.7.2, mozilla thunderbird 60.7.2
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-20
23 May 2022 Mozilla Firefox and Thunderbird Memory corruption
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 67.0.3, mozilla thunderbird 60.7.2, mozilla firefox 60.7.1
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-843
23 May 2022 Microsoft Windows Path traversal
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1129.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-59
23 May 2022 Microsoft Windows Security flaw
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
23 May 2022 Microsoft Windows Security flaw
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0704, CVE-2019-0821.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
23 May 2022 Microsoft Internet Explorer Security flaw
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of files on disk, aka 'Internet Explorer Information Disclosure Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
23 May 2022 Microsoft Win32k Security flaw
An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
23 May 2022 Adobe Flash Player Memory corruption
Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-787
16 May 2022 Zyxel Multiple Firewalls Command injection
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- zyxel vpn1000 firmware 5.30, zyxel usg flex 700 firmware 5.30, zyxel atp700 firmware 5.30, zyxel atp500 firmware 5.30, zyxel vpn300 firmware 5.30 and 7 older
- CISA due date
- 6 Jun 2022
- Weakness
- CWE-78
16 May 2022 VMware Spring Cloud Gateway Remote code execution
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- vmware spring cloud gateway 3.0.7
- CISA due date
- 6 Jun 2022
- Weakness
- CWE-94
10 May 2022 F5 BIG-IP Authentication bypass
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- f5 big-ip access policy manager 16.1.2.2, f5 big-ip access policy manager 15.1.5.1, f5 big-ip access policy manager 14.1.4.6, f5 big-ip access policy manager 13.1.5, f5 big-ip analytics 16.1.2.2 and 7 older
- CISA due date
- 31 May 2022
- Weakness
- CWE-306
On Hacker News
F5 BIG-IP RCE exploitation (CVE-2022-1388)4 May 2022 Apple Multiple Products Memory corruption
A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4 and iPadOS 14.4, Safari 14.0.3. Processing maliciously crafted web content may lead to arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 14.4, apple iphone os 14.4, apple tvos 14.4, apple macos 11.2, apple mac os x 10.15.7 and 3 older
- CISA due date
- 25 May 2022
- Weakness
- CWE-843
4 May 2022 Apple Multiple Products Memory corruption
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple itunes 12.9.4, apple iphone os 12.2, apple tvos 12.2, apple safari 12.1, apple icloud 7.11 and 1 older
- CISA due date
- 25 May 2022
- Weakness
- CWE-843
4 May 2022 Microsoft Win32k Security flaw
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 25 May 2022
- Weakness
- CWE-264
4 May 2022 Microsoft Internet Explorer Memory corruption
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 25 May 2022
- Weakness
- CWE-416
On Hacker News
Dissecting the newest IE10 0-day exploit (CVE-2014-0322)4 May 2022 OpenSSL Memory corruption
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens elan-8.2 8.3.3, splunk 6.0.3, openssl 1.0.1g, filezilla-project filezilla server 0.9.44
- CISA due date
- 25 May 2022
- Weakness
- CWE-125
25 Apr 2022 WSO2 Multiple Products Path traversal
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 16 May 2022
- Weakness
- CWE-22
25 Apr 2022 Microsoft Windows Race condition
Windows User Profile Service Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.643, microsoft windows server 2019 10.0.17763.2803, microsoft windows server 2016 10.0.14393.5066, microsoft windows server 20h2 10.0.19042.1645, microsoft windows 11 21h2 10.0.22000.613 and 7 older
- CISA due date
- 16 May 2022
- Weakness
- CWE-362
25 Apr 2022 Microsoft Windows Path traversal
Windows User Profile Service Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.469, microsoft windows server 2019 10.0.17763.2452, microsoft windows server 2016 10.0.14393.4886, microsoft windows server 20h2 10.0.19042.1466, microsoft windows 11 21h2 10.0.22000.434 and 7 older
- CISA due date
- 16 May 2022
- Weakness
- CWE-1386
25 Apr 2022 Linux Kernel Security flaw
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens scalance lpe9403 firmware 2.0, linux kernel 5.16.11, linux kernel 5.15.25, linux kernel 5.10.102
- CISA due date
- 16 May 2022
- Weakness
- CWE-665
25 Apr 2022 Microsoft Win32k Security flaw
Win32k Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.288, microsoft windows server 2004 10.0.19041.1288, microsoft windows server 20h2 10.0.19042.1288, microsoft windows 11 21h2 10.0.22000.258, microsoft windows 10 2004 10.0.19041.1288 and 2 older
- CISA due date
- 16 May 2022
25 Apr 2022 Microsoft Win32k Security flaw
Win32k Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.288, microsoft windows server 2019 10.0.17763.2237, microsoft windows server 2004 10.0.19041.1288, microsoft windows server 20h2 10.0.19042.1288, microsoft windows 11 21h2 10.0.22000.258 and 5 older
- CISA due date
- 16 May 2022
25 Apr 2022 Jenkins Script Security Plugin Security flaw
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 16 May 2022
19 Apr 2022 Microsoft Windows Security flaw
Windows Print Spooler Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.524, microsoft windows server 2019 10.0.17763.2565, microsoft windows server 2016 10.0.14393.4946, microsoft windows server 20h2 10.0.19042.1526, microsoft windows 11 21h2 10.0.22000.493 and 6 older
- CISA due date
- 10 May 2022
19 Apr 2022 Meta Platforms WhatsApp Memory corruption
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- whatsapp 2.19.134, whatsapp 2.19.51, whatsapp business 2.19.51, whatsapp business 2.19.44, whatsapp 2.18.348 and 1 older
- CISA due date
- 10 May 2022
- Weakness
- CWE-122
19 Apr 2022 Synacor Zimbra Collaboration Suite (ZCS) Cross-site scripting
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- synacor zimbra collaboration suite 8.7.0
- CISA due date
- 10 May 2022
- Weakness
- CWE-79
15 Apr 2022 VMware Multiple Products Access control flaw
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- vmware vrealize suite lifecycle manager 9.0, vmware cloud foundation 5.0
- CISA due date
- 6 May 2022
- Weakness
- CWE-250
15 Apr 2022 Google Chromium V8 Memory corruption
Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 100.0.4896.127
- CISA due date
- 6 May 2022
- Weakness
- CWE-843
15 Apr 2022 Crestron Multiple Products Command injection
The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- barco wepresent wipg-1600w firmware 2.4.1.19
- CISA due date
- 6 May 2022
- Weakness
- CWE-79
15 Apr 2022 D-Link DNS-320 Storage Device Command injection
The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 6 May 2022
- Weakness
- CWE-78
15 Apr 2022 Schneider Electric U.motion Builder SQL injection
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 6 May 2022
- Weakness
- CWE-89
15 Apr 2022 Trihedral VTScada (formerly VTS) Memory corruption
The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- trihedral vtscada 11.2.02
- CISA due date
- 6 May 2022
- Weakness
- CWE-119
15 Apr 2022 InduSoft Web Studio Path traversal
Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files, and consequently execute arbitrary code, via unspecified web requests.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 6 May 2022
- Weakness
- CWE-22
15 Apr 2022 Ubiquiti AirOS Command injection
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- ui airos 5.4.5, ui airos 5.3.5, ui airos 4.0.1
- CISA due date
- 6 May 2022
- Weakness
- CWE-77
15 Apr 2022 Alcatel OmniPCX Enterprise Command injection
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 6 May 2022
- Weakness
- CWE-20
14 Apr 2022 VMware Workspace ONE Access and Identity Manager Remote code execution
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 5 May 2022
- Weakness
- CWE-94
13 Apr 2022 Microsoft Windows Memory corruption
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.643, microsoft windows server 2019 10.0.17763.2803, microsoft windows server 2016 10.0.14393.5066, microsoft windows server 20h2 10.0.19042.1645, microsoft windows 11 21h2 10.0.22000.613 and 6 older
- CISA due date
- 4 May 2022
- Weakness
- CWE-787, CWE-1285
13 Apr 2022 Drupal Core Remote code execution
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 8.5.3, drupal 8.4.8, drupal 7.59
- CISA due date
- 4 May 2022
- Weakness
- CWE-94
13 Apr 2022 Kaseya Virtual System/Server Administrator (VSA) Security flaw
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- kaseya virtual system administrator 9.5.0.5, kaseya virtual system administrator 9.4.0.36, kaseya virtual system administrator 9.3.0.35
- CISA due date
- 4 May 2022
13 Apr 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 4 May 2022
- Weakness
- CWE-416
13 Apr 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 4 May 2022
- Weakness
- CWE-416
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.