The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
24 May 2022 Microsoft XML Core Services Memory corruption
Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka "Microsoft XML Information Disclosure Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-200
24 May 2022 Microsoft Windows Memory corruption
The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka "Windows GDI Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0001, CVE-2017-0025, and CVE-2017-0047.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-119
24 May 2022 Microsoft Internet Explorer and Edge Information disclosure
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-200
On Hacker News
Microsoft Patches CVE-2016-3351 Zero-Day, Exploited24 May 2022 Microsoft Internet Explorer Information disclosure
Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-200
24 May 2022 Microsoft Internet Explorer Information disclosure
Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 14 Jun 2022
- Weakness
- CWE-200
23 May 2022 Microsoft Windows Memory corruption
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0913, CVE-2020-1000, CVE-2020-1003.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-787
23 May 2022 Microsoft Update Notification Manager Path traversal
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Update Notification Manager Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-59
23 May 2022 Microsoft Windows Path traversal
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.To exploit this vulnerability, an authenticated attacker would need to run a specially crafted application to elevate privileges.The security update addresses the vulnerability by correcting how AppX Deployment Extensions manages privileges., aka 'Windows AppX Deployment Extensions Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-59
23 May 2022 Microsoft Windows Path traversal
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1129.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
- Weakness
- CWE-59
23 May 2022 Microsoft Windows Security flaw
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
23 May 2022 Microsoft Windows Security flaw
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0704, CVE-2019-0821.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
23 May 2022 Microsoft Internet Explorer Security flaw
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of files on disk, aka 'Internet Explorer Information Disclosure Vulnerability'.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
23 May 2022 Microsoft Win32k Security flaw
An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 13 Jun 2022
4 May 2022 Microsoft Win32k Security flaw
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, as exploited in the wild in October 2014, aka "Win32k.sys Elevation of Privilege Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 25 May 2022
- Weakness
- CWE-264
4 May 2022 Microsoft Internet Explorer Memory corruption
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 25 May 2022
- Weakness
- CWE-416
On Hacker News
Dissecting the newest IE10 0-day exploit (CVE-2014-0322)25 Apr 2022 Microsoft Windows Race condition
Windows User Profile Service Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.643, microsoft windows server 2019 10.0.17763.2803, microsoft windows server 2016 10.0.14393.5066, microsoft windows server 20h2 10.0.19042.1645, microsoft windows 11 21h2 10.0.22000.613 and 7 older
- CISA due date
- 16 May 2022
- Weakness
- CWE-362
25 Apr 2022 Microsoft Windows Path traversal
Windows User Profile Service Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.469, microsoft windows server 2019 10.0.17763.2452, microsoft windows server 2016 10.0.14393.4886, microsoft windows server 20h2 10.0.19042.1466, microsoft windows 11 21h2 10.0.22000.434 and 7 older
- CISA due date
- 16 May 2022
- Weakness
- CWE-1386
25 Apr 2022 Microsoft Win32k Security flaw
Win32k Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.288, microsoft windows server 2004 10.0.19041.1288, microsoft windows server 20h2 10.0.19042.1288, microsoft windows 11 21h2 10.0.22000.258, microsoft windows 10 2004 10.0.19041.1288 and 2 older
- CISA due date
- 16 May 2022
25 Apr 2022 Microsoft Win32k Security flaw
Win32k Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.288, microsoft windows server 2019 10.0.17763.2237, microsoft windows server 2004 10.0.19041.1288, microsoft windows server 20h2 10.0.19042.1288, microsoft windows 11 21h2 10.0.22000.258 and 5 older
- CISA due date
- 16 May 2022
19 Apr 2022 Microsoft Windows Security flaw
Windows Print Spooler Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.524, microsoft windows server 2019 10.0.17763.2565, microsoft windows server 2016 10.0.14393.4946, microsoft windows server 20h2 10.0.19042.1526, microsoft windows 11 21h2 10.0.22000.493 and 6 older
- CISA due date
- 10 May 2022
13 Apr 2022 Microsoft Windows Memory corruption
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.643, microsoft windows server 2019 10.0.17763.2803, microsoft windows server 2016 10.0.14393.5066, microsoft windows server 20h2 10.0.19042.1645, microsoft windows 11 21h2 10.0.22000.613 and 6 older
- CISA due date
- 4 May 2022
- Weakness
- CWE-787, CWE-1285
13 Apr 2022 Microsoft Internet Explorer Memory corruption
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 4 May 2022
- Weakness
- CWE-119
13 Apr 2022 Adobe Flash Player Memory corruption
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 16.0.0.305, adobe flash player 13.0.0.269, adobe flash player 11.2.202.442
- CISA due date
- 4 May 2022
- Weakness
- CWE-416
13 Apr 2022 Adobe Flash Player Security flaw
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
- What to do
- The impacted product is end-of-life and should be disconnected if still in use.
- Fixed in (NVD)
- adobe flash player 16.0.0.287
- CISA due date
- 4 May 2022
11 Apr 2022 Microsoft Active Directory Privilege escalation
Active Directory Domain Services Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.350, microsoft windows server 2019 10.0.17763.2300, microsoft windows server 2016 10.0.14393.4770, microsoft windows server 2004 10.0.19041.1348, microsoft windows server 20h2 10.0.19042.1348
- CISA due date
- 2 May 2022
- Weakness
- CWE-269
11 Apr 2022 Microsoft Active Directory Input validation flaw
Active Directory Domain Services Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.350, microsoft windows server 2019 10.0.17763.2300, microsoft windows server 2016 10.0.14393.4770, microsoft windows server 2004 10.0.19041.1348, microsoft windows server 20h2 10.0.19042.1348
- CISA due date
- 2 May 2022
- Weakness
- CWE-20
6 Apr 2022 Microsoft HTTP Protocol Stack Memory corruption
HTTP Protocol Stack Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2004 10.0.19041.982, microsoft windows server 20h2 10.0.19042.982, microsoft windows 10 2004 10.0.19041.982, microsoft windows 10 20h2 10.0.19042.982
- CISA due date
- 27 Apr 2022
- Weakness
- CWE-416
6 Apr 2022 Microsoft SMBv1 server Input validation flaw
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens acuson sc2000 firmware 4.0e
- CISA due date
- 27 Apr 2022
- Weakness
- CWE-20
31 Mar 2022 Microsoft Windows Privilege escalation
Windows User Profile Service Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.2114, microsoft windows server 2016 10.0.14393.4583, microsoft windows server 2004 10.0.19041.1165, microsoft windows server 20h2 10.0.19042.1165, microsoft windows 10 2004 10.0.19041.1165 and 6 older
- CISA due date
- 21 Apr 2022
- Weakness
- CWE-269
28 Mar 2022 Microsoft Office Security flaw
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
28 Mar 2022 Microsoft Windows Memory corruption
Windows Event Tracing Elevation of Privilege Vulnerability
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.2114, microsoft windows server 2004 10.0.19041.1165, microsoft windows server 20h2 10.0.19042.1165, microsoft windows 10 2004 10.0.19041.1165, microsoft windows 10 1909 10.0.18363.1734 and 3 older
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-416
28 Mar 2022 Microsoft Windows Security flaw
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
28 Mar 2022 Microsoft DirectX Graphics Kernel (DXGKRNL) Denial of service
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8405.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-404
28 Mar 2022 Microsoft DirectX Graphics Kernel (DXGKRNL) Denial of service
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-404
28 Mar 2022 Microsoft Windows Security flaw
Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
28 Mar 2022 Microsoft Internet Explorer Information disclosure
Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0008 and CVE-2017-0009.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-200
28 Mar 2022 Microsoft Edge and Internet Explorer Memory corruption
Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-704
28 Mar 2022 Microsoft Edge Memory corruption
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-119
28 Mar 2022 Microsoft Edge Memory corruption
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-119
28 Mar 2022 Microsoft Internet Explorer Memory corruption
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-119
28 Mar 2022 Microsoft Client-Server Run-time Subsystem (CSRSS) Privilege escalation
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-264
28 Mar 2022 Microsoft Windows Security flaw
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-264
On Hacker News
CVE-2016-0040 Story of uninitialized pointer28 Mar 2022 Microsoft Windows Memory corruption
Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-119
28 Mar 2022 Microsoft Internet Explorer Memory corruption
JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corruption Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-119
28 Mar 2022 Microsoft Office Memory corruption
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-19
28 Mar 2022 Microsoft Win32k Memory corruption
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 does not properly initialize a pointer for the next object in a certain list, which allows local users to obtain write access to the PATHRECORD chain, and consequently gain privileges, by triggering excessive consumption of paged memory and then making many FlattenPath function calls, aka "Win32k Read AV Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-119
28 Mar 2022 Microsoft Internet Explorer Memory corruption
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-416
28 Mar 2022 Microsoft Word Memory corruption
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "Word RTF 'listoverridecount' Remote Code Execution Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-399
28 Mar 2022 Microsoft Ancillary Function Driver (afd.sys) Security flaw
afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 18 Apr 2022
- Weakness
- CWE-264
28 Mar 2022 Microsoft Windows Memory corruption
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges, and bypass the User Account Control (UAC) feature, via a crafted REG_BINARY value for a SystemDefaultEUDCFont registry key, aka "Driver Improper Interaction with Windows Kernel Vulnerability."
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 21 Apr 2022
- Weakness
- CWE-119
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.