The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
8 Oct 2026 Apache Struts Command injection
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apache struts 2.3.28.1, apache struts 2.3.24.3, apache struts 2.3.20.3
- CISA due date
- 11 Oct 2026
- Weakness
- CWE-77
4 Aug 2026 Apache Tomcat Weak cryptography
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 7 Aug 2026
- Weakness
- CWE-311
16 Apr 2026 Apache ActiveMQ Remote code execution
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ All: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: before 5.19.4, from 6.0.0 before 6.2.3. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apache activemq 6.2.3, apache activemq broker 6.2.3, apache activemq 5.19.4, apache activemq broker 5.19.4
- CISA due date
- 30 Apr 2026
- Weakness
- CWE-20, CWE-94
1 May 2025 Apache HTTP Server Input validation flaw
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- sonicwall sma 500v firmware 10.2.1.14-75sv, sonicwall sma 410 firmware 10.2.1.14-75sv, sonicwall sma 400 firmware 10.2.1.14-75sv, sonicwall sma 210 firmware 10.2.1.14-75sv, sonicwall sma 200 firmware 10.2.1.14-75sv and 1 older
- CISA due date
- 22 May 2025
- Weakness
- CWE-116
1 Apr 2025 Apache Tomcat Remote code execution
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- apache tomcat 11.0.3, apache tomcat 10.1.35, apache tomcat 9.0.99
- CISA due date
- 22 Apr 2025
- Weakness
- CWE-44, CWE-502
4 Feb 2025 Apache OFBiz Access control flaw
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache ofbiz 18.12.16
- CISA due date
- 25 Feb 2025
- Weakness
- CWE-425
18 Sep 2024 Apache HugeGraph-Server Access control flaw
RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache hugegraph 1.3.0
- CISA due date
- 9 Oct 2024
- Weakness
- CWE-284
27 Aug 2024 Apache OFBiz Access control flaw
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache ofbiz 18.12.15
- CISA due date
- 17 Sep 2024
- Weakness
- CWE-863
On Hacker News
Apache OFBiz RCE Scanner and Exploit (CVE-2024-38856)7 Aug 2024 Apache OFBiz Path traversal
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache ofbiz 18.12.13
- CISA due date
- 28 Aug 2024
- Weakness
- CWE-22
23 May 2024 Apache Flink Access control flaw
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache flink 1.11.3
- CISA due date
- 13 Jun 2024
- Weakness
- CWE-552
8 Jan 2024 Apache Superset Security flaw
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA due date
- 29 Jan 2024
- Weakness
- CWE-1188
2 Nov 2023 Apache ActiveMQ Remote code execution
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache activemq 5.18.3, apache activemq legacy openwire module 5.18.3, apache activemq 5.17.6, apache activemq legacy openwire module 5.17.6, apache activemq 5.16.7 and 3 older
- CISA due date
- 23 Nov 2023
- Weakness
- CWE-502
6 Sep 2023 Apache RocketMQ Remote code execution
For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as. Additionally, an attacker can achieve the same effect by forging the RocketMQ protocol content. To prevent these attacks, users are recommended to upgrade to version 5.1.1 or above for using RocketMQ 5.x or 4.9.6 or above for using RocketMQ 4.x .
- What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Fixed in (NVD)
- apache rocketmq 5.1.1, apache rocketmq 4.9.6
- CISA due date
- 27 Sep 2023
- Weakness
- CWE-94
12 May 2023 Apache Tomcat Access control flaw
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache tomcat 8.5.7, apache tomcat 8.0.39, apache tomcat 7.0.73, apache tomcat 6.0.48
- CISA due date
- 2 Jun 2023
- Weakness
- CWE-284
1 May 2023 Apache Log4j2 Remote code execution
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens e-car operation center 2021-12-13, siemens industrial edge management hub 2021-12-13, siemens navigator 2021-12-13, siemens mindsphere 2021-12-11, siemens solid edge harness design 2020 and 7 older
- CISA due date
- 22 May 2023
- Weakness
- CWE-917
7 Mar 2023 Apache Spark Command injection
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 28 Mar 2023
- Weakness
- CWE-78
25 Aug 2022 Apache CouchDB Security flaw
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache couchdb 3.2.2
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-1188
25 Aug 2022 Apache APISIX Authentication bypass
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache apisix 2.12.1, apache apisix 2.10.4
- CISA due date
- 15 Sep 2022
- Weakness
- CWE-290
25 Mar 2022 Apache Kylin Command injection
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-78
25 Mar 2022 VMware Tanzu Spring Data Commons Remote code execution
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-94
25 Mar 2022 Apache Tomcat Malicious file upload
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache tomcat 9.0.1, apache tomcat 8.5.23, apache tomcat 8.0.47, apache tomcat 7.0.82
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-434
25 Mar 2022 Apache Tomcat Malicious file upload
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-434
On Hacker News
Remote code execution in Apache Tomcat 7.0 11 comments25 Mar 2022 Apache Struts Input validation flaw
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache archiva 1.3.8
- CISA due date
- 15 Apr 2022
- Weakness
- CWE-20
3 Mar 2022 Apache Tomcat Security flaw
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache tomcat 9.0.31, apache tomcat 8.5.51, apache tomcat 7.0.100
- CISA due date
- 17 Mar 2022
10 Feb 2022 Apache Struts 1 Input validation flaw
The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-20
10 Feb 2022 Apache ActiveMQ Malicious file upload
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache activemq 5.14.0
- CISA due date
- 10 Aug 2022
- Weakness
- CWE-20
21 Jan 2022 Apache Struts 2 Remote code execution
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache struts 2.2.3.1
- CISA due date
- 21 Jul 2022
- Weakness
- CWE-20
21 Jan 2022 Apache Struts 1 Security flaw
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache struts 1.2.9
- CISA due date
- 21 Jul 2022
- Weakness
- CWE-749
18 Jan 2022 Npm package System Information Library for Node.JS Command injection
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- systeminformation 5.3.1
- CISA due date
- 1 Feb 2022
- Weakness
- CWE-78
18 Jan 2022 Apache Airflow's Experimental API Authentication bypass
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache airflow 1.10.11
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-1188, CWE-306
18 Jan 2022 Apache Airflow Command injection
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache airflow 1.10.11
- CISA due date
- 18 Jul 2022
- Weakness
- CWE-78
10 Dec 2021 Apache Log4j2 Remote code execution
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
- What to do
- For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
- Fixed in (NVD)
- siemens e-car operation center 2021-12-13, siemens capital 2019.1, siemens comos 10.4.2, siemens 6bk1602-0aa52-0tp0 firmware 2.7.0, siemens 6bk1602-0aa42-0tp0 firmware 2.7.0 and 7 older
- CISA due date
- 24 Dec 2021
- Weakness
- CWE-20, CWE-400, CWE-502
10 Dec 2021 Apache Solr Remote code execution
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache solr 8.1.2, apache solr 7.7.3
- CISA due date
- 10 Jun 2022
- Weakness
- CWE-94
1 Dec 2021 Apache Server-side request forgery
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- siemens sinema remote connect server 3.1, siemens sinec nms 1.0.3
- CISA due date
- 15 Dec 2021
- Weakness
- CWE-918
On Hacker News
Building a POC for CVE-2021-404383 Nov 2021 Apache HTTP Server Path traversal
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- oracle secure backup 18.1.0.1.0, oracle jd edwards enterpriseone tools 9.2.6.0
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-22
3 Nov 2021 Apache HTTP Server Path traversal
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 17 Nov 2021
- Weakness
- CWE-22
3 Nov 2021 Apache Struts Remote code execution
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache struts 2.5.30
- CISA due date
- 3 May 2022
- Weakness
- CWE-917
3 Nov 2021 Apache Solr Input validation flaw
Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache solr 8.4.0, apache solr 7.7.3
- CISA due date
- 3 May 2022
- Weakness
- CWE-74
3 Nov 2021 Docker Desktop Community Edition Access control flaw
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restart Docker, or run 'docker login' to force the command.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- docker 2.1.0.1
- CISA due date
- 3 May 2022
- Weakness
- CWE-732
3 Nov 2021 Apache HTTP Server Memory corruption
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
- What to do
- Apply updates per vendor instructions.
- CISA due date
- 3 May 2022
- Weakness
- CWE-416
3 Nov 2021 Apache Struts Input validation flaw
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- oracle communications policy management 12.5.0, apache struts 2.5.17, apache struts 2.3.35
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 Apache Struts Remote code execution
The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache struts 2.5.13, apache struts 2.3.34
- CISA due date
- 3 May 2022
- Weakness
- CWE-502
3 Nov 2021 Apache Struts Input validation flaw
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- arubanetworks clearpass policy manager 6.6.5, apache struts 2.5.10.1, apache struts 2.3.32
- CISA due date
- 3 May 2022
- Weakness
- CWE-20
3 Nov 2021 Apache Shiro Weak cryptography
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
- What to do
- Apply updates per vendor instructions.
- Fixed in (NVD)
- apache shiro 1.2.5, apache aurora 0.18.1
- CISA due date
- 3 May 2022
- Weakness
- CWE-284
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.