The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
3 Nov 2021 Atlassian Confluence Server and Data Center Path traversal
Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x), from 6.7.0 before 6.12.4 (the fixed version for 6.12.x), from 6.13.0 before 6.13.4 (the fixed version for 6.13.x), from 6.14.0 before 6.14.3 (the fixed version for 6.14.x), and from 6.15.0 before 6.15.2 are affected by this vulnerability.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- atlassian confluence server 6.15.2, atlassian confluence server 6.14.3, atlassian confluence server 6.13.4, atlassian confluence server 6.12.4, atlassian confluence server 6.6.13
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 Atlassian Confluence Server and Data Server Path traversal
The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x), from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x), from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x), and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x), allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- atlassian confluence server 6.14.2, atlassian confluence server 6.13.3, atlassian confluence server 6.12.3, atlassian confluence server 6.6.12
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 Android Kernel Memory corruption
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- huawei bla-l29c firmware 9.1.0.300\(c432e4r1p11t8\), huawei berkeley-tl10 firmware 9.1.0.333\(c01e333r1p1t8\), huawei ares-al10d firmware 9.1.0.165\(c00e165r2p5t8\), huawei berkeley-l09 firmware 9.1.0.351\(c432e5r1p13t8\), huawei bla-al00b firmware 10.0.0.170\(c786e170r2p4\) and 7 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 TVT NVMS-1000 Path traversal
TVT NVMS-1000 devices allow GET /.. Directory Traversal
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance Path traversal
An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 Netis WF2419 Devices Command injection
Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page, it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-78
3 Nov 2021 TeamViewer Desktop Authentication bypass
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product. If an attacker were to know this key, they could decrypt protect information stored in the registry or configuration files of TeamViewer. With versions before v9.x , this allowed for attackers to decrypt the Unattended Access password to the system (which allows for remote login to the system as well as headless file browsing). The latest version still uses the same key for OptionPasswordAES but appears to have changed how the Unattended Access password is stored. While in most cases an attacker requires an existing session on a system, if the registry/configuration keys were stored off of the machine (such as in a file share or online), an attacker could then decrypt the required password to login to the system.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-521
3 Nov 2021 Progress Telerik UI for ASP.NET AJAX Remote code execution
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-502
3 Nov 2021 Trend Micro OfficeScan Path traversal
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 Apache Solr Input validation flaw
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache solr 8.4.0, apache solr 7.7.3
- CISA due date
- 3 May 2022
- Weakness
- CWE-74
3 Nov 2021 Mozilla Firefox and Thunderbird Memory corruption
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- mozilla firefox 72.0.1, mozilla firefox 68.4.1, mozilla thunderbird 68.4.1
- CISA due date
- 3 May 2022
- Weakness
- CWE-843
On Hacker News
Mozilla Firefox Vulnerability3 Nov 2021 vBulletin Remote code execution
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-94
On Hacker News
Protection against CVE-2019-16759 in vBulletin3 Nov 2021 Cisco Small Business RV320 and RV325 Routers Access control flaw
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-284
3 Nov 2021 SIMalliance Toolbox Browser Security flaw
Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote attackers to retrieve location and IMEI information, or retrieve other data or execute certain commands, via SIM Toolkit (STK) instructions in an SMS message, aka Simjacker.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
3 Nov 2021 Nagios XI Command injection
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- nagios xi 5.6.6
- CISA due date
- 3 May 2022
- Weakness
- CWE-78
3 Nov 2021 Docker Desktop Community Edition Access control flaw
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- docker 2.1.0.1
- CISA due date
- 3 May 2022
- Weakness
- CWE-732
3 Nov 2021 Microsoft Internet Explorer Memory corruption
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1428.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-416, CWE-787
3 Nov 2021 Microsoft Internet Explorer Memory corruption
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1221.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Citrix StoreFront Server XML external entity
Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE attacks.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix storefront server 1903, citrix storefront server 3.12.4000, citrix storefront server 3.0.8000
- CISA due date
- 3 May 2022
- Weakness
- CWE-611
3 Nov 2021 Microsoft Windows Privilege escalation
An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-269
On Hacker News
CVE-2019-1215 Analysis of a Use After Free in Ws2ifsl3 Nov 2021 Microsoft Windows Memory corruption
An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-119
3 Nov 2021 Citrix Workspace Application and Receiver for Windows Access control flaw
Citrix Workspace App before 1904 for Windows has Incorrect Access Control.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- citrix workspace 1904
- CISA due date
- 3 May 2022
- Weakness
- CWE-284
3 Nov 2021 Atlassian Crowd and Crowd Data Center Security flaw
Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x), from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x), from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x), from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x), and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- atlassian crowd 3.4.4, atlassian crowd 3.3.5, atlassian crowd 3.2.8, atlassian crowd 3.1.6, atlassian crowd 3.0.5
- CISA due date
- 3 May 2022
3 Nov 2021 Ivanti Pulse Connect Secure and Pulse Policy Secure Command injection
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-78
3 Nov 2021 Ivanti Pulse Connect Secure Path traversal
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 Microsoft Windows Security flaw
An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
3 Nov 2021 Microsoft Win32k Security flaw
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0803.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
3 Nov 2021 Microsoft Win32k Security flaw
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0797.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
3 Nov 2021 Microsoft Win32k Security flaw
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0685, CVE-2019-0859.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
3 Nov 2021 Microsoft Win32k Security flaw
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0808.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
3 Nov 2021 Microsoft Remote Desktop Services Memory corruption
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 Microsoft SharePoint Input validation flaw
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 Microsoft MSHTML Command injection
A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-77
3 Nov 2021 Apache HTTP Server Memory corruption
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 Microsoft Internet Explorer Memory corruption
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8643.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Drupal Core Input validation flaw
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- drupal 8.5.1, drupal 8.4.6, drupal 8.3.9
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 Exim Memory corruption
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- exim 4.90.1
- CISA due date
- 3 May 2022
- Weakness
- CWE-119
3 Nov 2021 Adobe ColdFusion Remote code execution
Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-502
3 Nov 2021 Adobe Flash Player Memory corruption
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 28.0.0.161
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 SAP Customer Relationship Management (CRM) Path traversal
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
3 Nov 2021 ThinkPHP noneCms Input validation flaw
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 DotNetNuke (DNN) Weak cryptography
DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-326
3 Nov 2021 Adobe ColdFusion Malicious file upload
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-434
3 Nov 2021 DotNetNuke (DNN) Weak cryptography
DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-326
3 Nov 2021 Tenda AC7, AC9, and AC10 Routers Command injection
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10 devices with firmware through V15.03.06.23_CN(AC10). A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted goform/setUsbUnload request. This occurs because the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-78
3 Nov 2021 Fortinet FortiOS Path traversal
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- fortinet fortios 6.0.5, fortinet fortios 5.6.8, fortinet fortios 5.4.13, fortinet fortiproxy 1.2.9
- CISA due date
- 3 May 2022
- Weakness
- CWE-22
On Hacker News
CVE-2018-13379 exploited in the wild3 Nov 2021 Apache Struts Input validation flaw
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- oracle communications policy management 12.5.0, apache struts 2.5.17, apache struts 2.3.35
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 Microsoft Office Memory corruption
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Microsoft Office Memory corruption
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-787
3 Nov 2021 Cisco Adaptive Security Appliance (ASA) Path traversal
A vulnerability in the web interface of the Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. It is also possible on certain software releases that the ASA will not reload, but an attacker could view sensitive system information without authentication by using directory traversal techniques. The vulnerability is due to lack of proper input validation of the HTTP URL. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition or unauthenticated disclosure of information. This vulnerability applies to IPv4 and IPv6 HTTP traffic. This vulnerability affects Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 1000V Cloud Firewall, ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4100 Series Security Appliance, Firepower 9300 ASA Security Module, FTD Virtual (FTDv). Cisco Bug IDs: CSCvi16029.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- cisco adaptive security appliance software 9.9.2.1, cisco adaptive security appliance software 9.8.2.28, cisco adaptive security appliance software 9.7.1.24, cisco adaptive security appliance software 9.6.4.8, cisco adaptive security appliance software 9.4.4.18 and 4 older
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.