The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
18 Jan 2022 Apache Airflow's Experimental API Authentication bypass
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache airflow 1.10.11
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-1188, CWE-306
18 Jan 2022 Drupal core Malicious file upload
Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 9.0.8, drupal 8.9.9, drupal 8.8.11, drupal 7.74
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-434
18 Jan 2022 Apache Airflow Command injection
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache airflow 1.10.11
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-78
10 Jan 2022 Hikvision Security cameras web server Command injection
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Jan 2022
- Weakness
- CWE-78
10 Jan 2022 FatPipe WARP, IPVPN, and MPVPN software Malicious file upload
A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p92 and 10.2.2r44p1 allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. The FatPipe advisory identifier for this vulnerability is FPSA006.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Jan 2022
- Weakness
- CWE-434
10 Jan 2022 VMware vCenter Server Path traversal
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Jan 2022
- Weakness
- CWE-23
10 Jan 2022 Google Chrome Media Memory corruption
Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 81.0.4044.92
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-416
10 Jan 2022 Synacor Zimbra Collaboration Suite (ZCS) XML external entity
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- synacor zimbra collaboration suite 8.7.11
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-611
10 Jan 2022 Elastic Kibana Remote code execution
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- elastic kibana 6.6.1, elastic kibana 5.6.15
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-94
10 Jan 2022 Oracle WebLogic Server Input validation flaw
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- oracle vm virtualbox 6.1.2, oracle vm virtualbox 6.0.16, oracle vm virtualbox 5.2.36
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-74
10 Jan 2022 Palo Alto Networks PAN-OS Memory corruption
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- paloaltonetworks pan-os 8.1.3, paloaltonetworks pan-os 8.0.12, paloaltonetworks pan-os 7.1.19
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-134
10 Jan 2022 Microsoft Win32k Security flaw
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Jul 2022
10 Jan 2022 Exim Mail Transfer Agent (MTA) Command injection
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-78
10 Jan 2022 Fortinet FortiOS and FortiProxy Memory corruption
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 6.0.5, fortinet fortios 5.6.11, fortinet fortios 5.4.13, fortinet fortios 5.2.15, fortinet fortiproxy 1.2.9
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-787
10 Jan 2022 Fortinet FortiOS and FortiProxy Access control flaw
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 6.0.5, fortinet fortios 5.6.9, fortinet fortios 5.4.11, fortinet fortiproxy 1.2.9
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-285
10 Jan 2022 Primetek Primefaces Application Weak cryptography
Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- primetek primefaces 5.3.8, primetek primefaces 5.2.21
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-326
10 Jan 2022 IBM WebSphere Application Server and Server Hypervisor Edition Remote code execution
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-94
10 Jan 2022 Microsoft WinVerifyTrust function Weak cryptography
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configure the EnableCertPaddingCheck registry value, the information herein remains unchanged from the original text published on December 10, 2013, Microsoft does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft Windows. This behavior remains available as an opt-in feature via reg key setting, and is available on supported editions of Windows released since December 10, 2013. This includes all currently supported versions of Windows 10 and Windows 11. The supporting code for this reg key was incorporated at the time of release for Windows 10 and Windows 11, so no security update is required; however, the reg key must be set. See the Security Updates table for the list of affected software. Vulnerability Description A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for portable executable (PE) files. An anonymous attacker could exploit the vulnerability by modifying an existing signed executable file to leverage unverified portions of the file in such a way as to add malicious code to the file without invalidating the signature. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Exploitation of this vulnerability requires that a user or application run or install a specially crafted, signed PE file. An attacker could modify an... See more at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Jul 2022
- Weakness
- CWE-20
15 Dec 2021 Microsoft Windows Security flaw
We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns. The attacker would then have to convince the user to open the specially crafted attachment. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Please see the Security Updates table for the link to the updated app. Alternatively you can download and install the Installer using the links provided in the FAQ section. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. December 27 2023 Update: In recent months, Microsoft Threat Intelligence has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme. To address this increase in activity, we have updated the App Installer to disable the ms-appinstaller protocol by default and recommend other potential mitigations.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft app installer 1.16, microsoft app installer 1.11
- CISA due date
- 29 Dec 2021
15 Dec 2021 Google Chromium V8 Memory corruption
Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- google chrome 96.0.4664.110
- CISA due date
- 29 Dec 2021
- Weakness
- CWE-416
10 Dec 2021 Zoho Desktop Central Security flaw
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- zohocorp manageengine desktop central 10.1.2137.3, zohocorp manageengine desktop central 10.1.2127.18
- CISA due date
- 24 Dec 2021
10 Dec 2021 Apache Log4j2 Remote code execution
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
- What to do
- For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
- Fixed in (NVD)
- siemens e-car operation center 2021-12-13, siemens capital 2019.1, siemens comos 10.4.2, siemens 6bk1602-0aa52-0tp0 firmware 2.7.0, siemens 6bk1602-0aa42-0tp0 firmware 2.7.0 and 7 older
- CISA due date
- 24 Dec 2021
- Weakness
- CWE-20, CWE-400, CWE-502
10 Dec 2021 Fortinet FortiOS Security flaw
A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 7.0.3, fortinet fortios 6.4.8, fortinet fortios 6.2.10, fortinet fortios 6.0.14
- CISA due date
- 24 Dec 2021
- Weakness
- CWE-494
10 Dec 2021 Realtek Jungle Software Development Kit (SDK) Command injection
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 24 Dec 2021
- Weakness
- CWE-78, CWE-138
10 Dec 2021 Pi-hole AdminLTE Command injection
Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-78
On Hacker News
Pi-hole Remote Code Execution 41 comments10 Dec 2021 Fuel CMS SQL injection
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-89
10 Dec 2021 Sonatype Nexus Repository Manager Security flaw
Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- sonatype nexus repository manager 3.15.0
- CISA due date
- 10 Jun 2022
10 Dec 2021 Linux Kernel Privilege escalation
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- linux kernel 5.1.17, linux kernel 4.19.58, linux kernel 4.14.133, linux kernel 4.9.185, linux kernel 4.9 and 3 older
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-269
10 Dec 2021 MongoDB mongo-express Remote code execution
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mongo-express project mongo-express 0.54.0
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-94
10 Dec 2021 Apache Solr Remote code execution
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache solr 8.1.2, apache solr 7.7.3
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-94
10 Dec 2021 Embedthis GoAhead Input validation flaw
Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- embedthis goahead 3.6.5
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-20
10 Dec 2021 Red Hat JBoss Application Server Remote code execution
In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-502
10 Dec 2021 Red Hat JBoss Seam 2 Remote code execution
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-20
1 Dec 2021 Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus Authentication bypass
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- zohocorp manageengine servicedesk plus 11.1, zohocorp manageengine supportcenter plus 11.0, zohocorp manageengine servicedesk plus msp 10.5
- CISA due date
- 15 Dec 2021
- Weakness
- CWE-306
1 Dec 2021 Apache Server-side request forgery
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens sinema remote connect server 3.1, siemens sinec nms 1.0.3
- CISA due date
- 15 Dec 2021
- Weakness
- CWE-918
On Hacker News
Building a POC for CVE-2021-404381 Dec 2021 Zoho ManageEngine ServiceDesk Plus (SDP) Authentication bypass
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Dec 2021
- Weakness
- CWE-306
1 Dec 2021 Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables Memory corruption
Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Jun 2022
- Weakness
- CWE-20
1 Dec 2021 MikroTik RouterOS Path traversal
MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Jun 2022
- Weakness
- CWE-22
17 Nov 2021 Microsoft Exchange Remote code execution
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Dec 2021
- Weakness
- CWE-184, CWE-502
17 Nov 2021 Microsoft Office Security flaw
Microsoft Excel Security Feature Bypass Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 1 Dec 2021
- Weakness
- CWE-357
17 Nov 2021 Microsoft Windows Memory corruption
Win32k Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.288, microsoft windows server 2019 10.0.17763.2237, microsoft windows server 2016 10.0.14393.4704, microsoft windows server 2004 10.0.19041.1288, microsoft windows 11 21h2 10.0.22000.258 and 7 older
- CISA due date
- 1 Dec 2021
- Weakness
- CWE-416
17 Nov 2021 Perl Exiftool Remote code execution
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- exiftool project exiftool 12.24
- CISA due date
- 1 Dec 2021
- Weakness
- CWE-95
3 Nov 2021 BQE BillQuick Web Suite SQL injection
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- bqe billquick web suite 22.0.9.1
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-89
3 Nov 2021 Apache HTTP Server Path traversal
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- oracle secure backup 18.1.0.1.0, oracle jd edwards enterpriseone tools 9.2.6.0
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-22
3 Nov 2021 Apache HTTP Server Path traversal
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-22
3 Nov 2021 Zoho ManageEngine Security flaw
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- zohocorp manageengine adselfservice plus 6.1
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-55
3 Nov 2021 Microsoft MSHTML Path traversal
Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Microsoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: “Suspicious Cpl File Execution”. Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs. Please see the Mitigations and Workaround sections for important information about steps you can take to protect your system from this vulnerability. UPDATE September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.230, microsoft windows server 2019 10.0.17763.2183, microsoft windows server 2016 10.0.14393.4651, microsoft windows server 2004 10.0.19041.1237, microsoft windows server 20h2 10.0.19042.1237 and 7 older
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-22
3 Nov 2021 Microsoft Open Management Infrastructure (OMI) Security flaw
Open Management Infrastructure Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft open management infrastructure 1.6.8-1
- CISA due date
- 17 Nov 2021
3 Nov 2021 Microsoft Open Management Infrastructure (OMI) Authentication bypass
Open Management Infrastructure Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft open management infrastructure 1.6.8-1
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-1390
3 Nov 2021 Microsoft Open Management Infrastructure (OMI) Authentication bypass
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft open management infrastructure 1.6.8-1
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-1390
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.