The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
22 Feb 2022 Zabbix Frontend Authentication bypass
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 8 Mar 2022
- Weakness
- CWE-284
22 Feb 2022 Zabbix Frontend Authentication bypass
In the case of instances where the SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor, because a user login stored in the session was not verified. Malicious unauthenticated actor may exploit this issue to escalate privileges and gain admin access to Zabbix Frontend. To perform the attack, SAML authentication is required to be enabled and the actor has to know the username of Zabbix user (or use the guest account, which is disabled by default).
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 8 Mar 2022
- Weakness
- CWE-290
15 Feb 2022 Adobe Commerce and Magento Open Source Input validation flaw
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe commerce 2.3.0, adobe magento 2.3.0
- CISA due date
- 1 Mar 2022
- Weakness
- CWE-20
15 Feb 2022 Google Chromium Animation Memory corruption
Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 98.0.4758.102
- CISA due date
- 1 Mar 2022
- Weakness
- CWE-416
15 Feb 2022 Microsoft Internet Explorer Memory corruption
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Aug 2022
- Weakness
- CWE-843
15 Feb 2022 Microsoft Windows Memory corruption
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Aug 2022
- Weakness
- CWE-787
15 Feb 2022 RARLAB WinRAR Path traversal
In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Aug 2022
- Weakness
- CWE-36
15 Feb 2022 Adobe Flash Player Memory corruption
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 15 Aug 2022
- Weakness
- CWE-416
15 Feb 2022 PHPUnit Remote code execution
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- phpunit project phpunit 5.6.3
- CISA due date
- 15 Aug 2022
- Weakness
- CWE-94
15 Feb 2022 Microsoft Word Memory corruption
Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Aug 2022
- Weakness
- CWE-119
15 Feb 2022 Microsoft Graphics Component Remote code execution
GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Aug 2022
- Weakness
- CWE-94
11 Feb 2022 Apple iOS, iPadOS, and macOS Memory corruption
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8). Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 15.3.1, apple iphone os 15.3.1, apple safari 15.3, apple macos 12.2.1
- CISA due date
- 25 Feb 2022
- Weakness
- CWE-416
On Hacker News
Apple fixes actively exploited zero-day (CVE-2022-22620)10 Feb 2022 Microsoft Windows Access control flaw
An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability. After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows 10 2004 10.0.19041.1165, microsoft windows 10 1909 10.0.18363.1734, microsoft windows 10 1809 10.0.17763.2114, microsoft windows 10 21h1 10.0.19043.1165, microsoft windows 10 20h2 10.0.19042.1165
- CISA due date
- 24 Feb 2022
- Weakness
- CWE-1220
10 Feb 2022 Microsoft SMBv3 Memory corruption
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-119
10 Feb 2022 Jenkins Stapler Web Framework Remote code execution
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-502
10 Feb 2022 Apache Struts 1 Input validation flaw
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-20
10 Feb 2022 Microsoft Windows Security flaw
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Aug 2022
10 Feb 2022 Oracle WebLogic Server Authentication bypass
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-306
10 Feb 2022 Microsoft Win32k Memory corruption
The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-416
10 Feb 2022 Microsoft Office Security flaw
Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0261 and CVE-2017-0281.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Aug 2022
10 Feb 2022 Microsoft SMBv1 Input validation flaw
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens acuson sc2000 firmware 4.0e, siemens syngo sc2000 firmware 4.0e
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-20
10 Feb 2022 Microsoft SMBv1 Input validation flaw
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens acuson sc2000 firmware 4.0e, siemens syngo sc2000 firmware 4.0e
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-20
10 Feb 2022 Apache ActiveMQ Malicious file upload
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache activemq 5.14.0
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-20
10 Feb 2022 D-Link DIR-645 Router Command injection
The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- dlink dir-645 firmware 1.05b01
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-77
10 Feb 2022 Microsoft HTTP.sys Remote code execution
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-94
10 Feb 2022 Apple OS X Path traversal
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple mac os x 10.10.3
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-254
10 Feb 2022 Apple OS X Memory corruption
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple mac os x 10.10.3, apple mac os x 10.10.0, apple iphone os 8.0, apple tvos 7.0
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-119
4 Feb 2022 Microsoft Win32k Memory corruption
Win32k Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.469, microsoft windows server 2019 10.0.17763.2452, microsoft windows server 20h2 10.0.19042.1466, microsoft windows 11 21h2 10.0.22000.434, microsoft windows 10 1909 10.0.18363.2037 and 4 older
- CISA due date
- 18 Feb 2022
- Weakness
- CWE-787
28 Jan 2022 Apple iOS and macOS Memory corruption
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS Monterey 12.2. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple ipados 15.3, apple iphone os 15.3, apple macos 12.2, apple macos 11.6.3
- CISA due date
- 11 Feb 2022
- Weakness
- CWE-20, CWE-787
28 Jan 2022 SonicWall SMA 100 Appliances Memory corruption
A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' user in the appliance. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances firmware 10.2.0.8-37sv, 10.2.1.1-19sv, 10.2.1.2-24sv and earlier versions.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 11 Feb 2022
- Weakness
- CWE-121
28 Jan 2022 Grandstream UCM6200 SQL injection
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- grandstream ucm6200 firmware 1.0.19.20
- CISA due date
- 28 Jul 2022
- Weakness
- CWE-89
28 Jan 2022 Microsoft Windows Path traversal
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 28 Jul 2022
- Weakness
- CWE-269, CWE-59
28 Jan 2022 Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege escalation
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens simatic itp1000 firmware 9.1.41.3024, siemens simatic ipc847d firmware 9.1.41.3024, siemens simatic ipc847c firmware 6.2.61.3535, siemens simatic ipc827d firmware 9.1.41.3024, siemens simatic ipc827c firmware 6.2.61.3535 and 7 older
- CISA due date
- 28 Jul 2022
- Weakness
- CWE-269
On Hacker News
Intel AMT Vulnerability CVE-2017-5689 Tracking Page28 Jan 2022 GNU Bourne-Again Shell (Bash) Command injection
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- ibm storwize v7000 firmware 7.3.0.7, ibm storwize v7000 firmware 7.2.0.9, ibm storwize v7000 firmware 1.5.0.4, ibm storwize v7000 firmware 1.4.3.5, arista eos 4.14.4f and 7 older
- CISA due date
- 28 Jul 2022
- Weakness
- CWE-78
28 Jan 2022 GNU Bourne-Again Shell (Bash) Command injection
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- ibm storwize v7000 firmware 7.3.0.7, ibm storwize v7000 firmware 7.2.0.9, ibm storwize v7000 firmware 1.5.0.4, ibm storwize v7000 firmware 1.4.3.5, arista eos 4.14.4f and 7 older
- CISA due date
- 28 Jul 2022
- Weakness
- CWE-78
28 Jan 2022 Microsoft Internet Explorer Memory corruption
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 28 Jul 2022
- Weakness
- CWE-416
21 Jan 2022 SolarWinds Serv-U Input validation flaw
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- solarwinds serv-u 15.3
- CISA due date
- 4 Feb 2022
- Weakness
- CWE-20
21 Jan 2022 Microsoft Win32k Denial of service
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 21 Jul 2022
- Weakness
- CWE-404
21 Jan 2022 Apache Struts 2 Remote code execution
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache struts 2.2.3.1
- CISA due date
- 21 Jul 2022
- Weakness
- CWE-20
21 Jan 2022 Apache Struts 1 Security flaw
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache struts 1.2.9
- CISA due date
- 21 Jul 2022
- Weakness
- CWE-749
18 Jan 2022 Aviatrix Controller Path traversal
An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- aviatrix controller 6.5.1922, aviatrix controller 6.4.2838, aviatrix controller 6.3.2490, aviatrix controller 6.2.2043
- CISA due date
- 1 Feb 2022
- Weakness
- CWE-25, CWE-96
18 Jan 2022 Microsoft Exchange Server Authentication bypass
Microsoft Exchange Server Information Disclosure Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Feb 2022
- Weakness
- CWE-287
18 Jan 2022 October CMS Authentication bypass
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- octobercms october 1.1.5
- CISA due date
- 1 Feb 2022
- Weakness
- CWE-287
18 Jan 2022 Nagios XI Command injection
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Feb 2022
- Weakness
- CWE-78, CWE-138
18 Jan 2022 Nagios XI Command injection
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Feb 2022
- Weakness
- CWE-78, CWE-138
18 Jan 2022 Nagios XI Command injection
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Feb 2022
- Weakness
- CWE-78, CWE-138
18 Jan 2022 F5 BIG-IP Traffic Management Microkernel Memory corruption
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- f5 big-ip access policy manager 16.0.1.1, f5 big-ip access policy manager 15.1.2.1, f5 big-ip access policy manager 14.1.4, f5 big-ip access policy manager 13.1.3.6, f5 big-ip access policy manager 12.1.5.3 and 7 older
- CISA due date
- 1 Feb 2022
- Weakness
- CWE-119
18 Jan 2022 VMware vRealize Operations Manager API Server-side request forgery
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Feb 2022
- Weakness
- CWE-918
18 Jan 2022 Npm package System Information Library for Node.JS Command injection
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- systeminformation 5.3.1
- CISA due date
- 1 Feb 2022
- Weakness
- CWE-78
18 Jan 2022 Oracle Intelligence Enterprise Edition Path traversal
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-22
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.