The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
25 May 2022 Oracle Java Runtime Environment (JRE) Access control flaw
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
- Weakness
- CWE-264
25 May 2022 Oracle Java Runtime Environment (JRE) Security flaw
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Jun 2022
24 May 2022 Artifex Ghostscript Memory corruption
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- artifex ghostscript 9.21
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-704
23 May 2022 Android Kernel Memory corruption
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-362, CWE-416
23 May 2022 WebKitGTK Memory corruption
A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- webkitgtk 2.26.0, wpewebkit wpe webkit 2.26.0
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-119
23 May 2022 Adobe Flash Player Memory corruption
Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-787
25 Apr 2022 Linux Kernel Security flaw
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens scalance lpe9403 firmware 2.0, linux kernel 5.16.11, linux kernel 5.15.25, linux kernel 5.10.102
- CISA due date
- 16 May 2022
- Weakness
- CWE-665
13 Apr 2022 Drupal Core Remote code execution
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 8.5.3, drupal 8.4.8, drupal 7.59
- CISA due date
- 4 May 2022
- Weakness
- CWE-94
13 Apr 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 4 May 2022
- Weakness
- CWE-416
13 Apr 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 4 May 2022
- Weakness
- CWE-416
13 Apr 2022 Adobe Flash Player Memory corruption
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 18.0.0.194, adobe flash player 13.0.0.296, adobe flash player 11.2.202.468, hp insight orchestration 7.5.0, hp system management homepage 7.5.0 and 4 older
- CISA due date
- 4 May 2022
- Weakness
- CWE-119
13 Apr 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 16.0.0.305, adobe flash player 13.0.0.269, adobe flash player 11.2.202.442
- CISA due date
- 4 May 2022
- Weakness
- CWE-416
13 Apr 2022 Adobe Flash Player Security flaw
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 16.0.0.287
- CISA due date
- 4 May 2022
11 Apr 2022 Linux Kernel Memory corruption
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 5.15.11, linux kernel 5.10.88, linux kernel 5.4.168, linux kernel 4.19.222, linux kernel 4.14.259
- CISA due date
- 2 May 2022
- Weakness
- CWE-415
6 Apr 2022 Sudo Memory corruption
Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- beyondtrust privilege management for mac 21.1.1, beyondtrust privilege management for unix/linux 10.3.2-10, sudo project sudo 1.9.5, sudo project sudo 1.8.32
- CISA due date
- 27 Apr 2022
- Weakness
- CWE-122, CWE-193
28 Mar 2022 Adobe Reader and Acrobat Memory corruption
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 11.0.03, adobe acrobat reader 11.0.03, adobe acrobat 10.1.7, adobe acrobat reader 10.1.7, adobe acrobat 9.5.5 and 1 older
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-189
28 Mar 2022 Oracle Java SE Security flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-693
28 Mar 2022 Mozilla Firefox and Thunderbird Memory corruption
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 22.0, mozilla firefox 17.0.7, mozilla thunderbird 17.0.7, mozilla thunderbird esr 17.0.7
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-119
28 Mar 2022 Oracle Java SE Access control flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-284
28 Mar 2022 Adobe Flash Player Memory corruption
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-119
25 Mar 2022 OpenBSD OpenSMTPD Command injection
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-755, CWE-78
25 Mar 2022 PHP FastCGI Process Manager (FPM) Memory corruption
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- php 7.3.11, php 7.2.24, php 7.1.33, tenable.sc 5.19.0
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-120
25 Mar 2022 Apache Tomcat Malicious file upload
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache tomcat 9.0.1, apache tomcat 8.5.23, apache tomcat 8.0.47, apache tomcat 7.0.82
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-434
25 Mar 2022 Apache Tomcat Malicious file upload
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-434
On Hacker News
Remote code execution in Apache Tomcat 7.0 11 comments25 Mar 2022 Adobe Flash Player Security flaw
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 15 Apr 2022
25 Mar 2022 Rails Ruby on Rails Path traversal
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- rubyonrails rails 4.2.5.1, rubyonrails rails 4.1.14.1, rubyonrails rails 3.2.22.1
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-22
25 Mar 2022 Rails Ruby on Rails Path traversal
Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- rubyonrails rails 4.1.1, rubyonrails rails 4.0.5, rubyonrails rails 3.2.18
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-22
25 Mar 2022 PHP Command injection
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apple mac os x 10.8.2, apple mac os x 10.7.5, php 5.4.2, php 5.3.12
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-20
25 Mar 2022 Exim Command injection
Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-264
25 Mar 2022 Exim Memory corruption
Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- exim 4.70
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-119
25 Mar 2022 phpMyAdmin Remote code execution
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject arbitrary PHP code into a configuration file via the save action.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- phpmyadmin 3.1.3.1, phpmyadmin 2.11.9.5
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-94
3 Mar 2022 Exim Internet Mailer Memory corruption
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Mar 2022
- Weakness
- CWE-787
3 Mar 2022 Adobe Flash Player Memory corruption
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-843
3 Mar 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-416
3 Mar 2022 Linux Kernel Race condition
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- paloaltonetworks pan-os 7.1.8, paloaltonetworks pan-os 7.0.14, linux kernel 4.8.3, linux kernel 4.7.9, linux kernel 4.4.26 and 7 older
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-362
3 Mar 2022 Adobe Flash Player Security flaw
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
3 Mar 2022 Adobe Flash Player Security flaw
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
3 Mar 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-119
3 Mar 2022 Oracle Java SE Access control flaw
Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-284
3 Mar 2022 Adobe Flash Player Memory corruption
Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 17.0.0.169, adobe flash player 13.0.0.281, adobe flash player 11.2.202.457
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-787
3 Mar 2022 Oracle Java SE Security flaw
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
3 Mar 2022 Mozilla Firefox Memory corruption
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 21.0, mozilla firefox 17.0.6, mozilla thunderbird 17.0.6, mozilla thunderbird esr 17.0.6
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-119
3 Mar 2022 Adobe Reader Memory corruption
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 11.0.02, adobe acrobat reader 11.0.02, adobe acrobat 10.1.6, adobe acrobat reader 10.1.6, adobe acrobat 9.5.4 and 1 older
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-120
3 Mar 2022 Adobe Reader and Acrobat Memory corruption
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- adobe acrobat 11.0.02, adobe acrobat reader 11.0.02, adobe acrobat 10.1.6, adobe acrobat reader 10.1.6, adobe acrobat 9.5.4 and 1 older
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-787
3 Mar 2022 Oracle Java SE Access control flaw
Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-284
3 Mar 2022 Oracle Java SE Access control flaw
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- redhat icedtea6 1.11.3, redhat icedtea6 1.10.8
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-284
On Hacker News
The rise of a new Java vulnerability - CVE-2012-17233 Mar 2022 Adobe Flash Player Remote code execution
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 11.3.300.271, adobe flash player 11.2.202.238
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-20, CWE-94
3 Mar 2022 Oracle Java SE Memory corruption
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-843
3 Mar 2022 Oracle Java SE JDK and JRE Access control flaw
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- oracle jdk 1.6.0, oracle jre 1.6.0
- CISA due date
- 24 Mar 2022
- Weakness
- CWE-284
22 Feb 2022 Zabbix Frontend Authentication bypass
After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 8 Mar 2022
- Weakness
- CWE-284
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.