KEV entry: Google Chromium WebP Heap-Based Buffer Overflow Vulnerability | Affected: Google / Chromium WebP | Description: Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-10-04 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html?m=1; https://nvd.nist.gov/vuln/detail/CVE-2023-4863


KEV entry: Android Framework Privilege Escalation Vulnerability | Affected: Android / Framework | Description: Android Framework contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-10-04 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://source.android.com/docs/security/bulletin/2023-09-01;  https://nvd.nist.gov/vuln/detail/CVE-2023-35674

CISA Known Exploited Vulnerabilities Catalog


KEV entry: Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability | Affected: Cisco / Adaptive Security Appliance and Firepower Threat Defense | Description: Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user. | Required action: Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices. | Due date: 2023-10-04 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC;  https://nvd.nist.gov/vuln/detail/CVE-2023-20269


KEV entry: Microsoft Word Information Disclosure Vulnerability | Affected: Microsoft / Word | Description: Microsoft Word contains an unspecified vulnerability that allows for information disclosure. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-10-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36761;  https://nvd.nist.gov/vuln/detail/CVE-2023-36761


KEV entry: Microsoft Streaming Service Proxy Privilege Escalation Vulnerability | Affected: Microsoft / Streaming Service Proxy | Description: Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-10-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802;   https://nvd.nist.gov/vuln/detail/CVE-2023-36802


KEV entry: Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability | Affected: Apple / iOS, iPadOS, and macOS | Description: Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-10-02 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213905, https://support.apple.com/en-us/HT213906; https://nvd.nist.gov/vuln/detail/CVE-2023-41064


KEV entry: Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability | Affected: Apple / iOS, iPadOS, and watchOS | Description: Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-10-02 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213905, https://support.apple.com/kb/HT213907; https://nvd.nist.gov/vuln/detail/CVE-2023-41061


KEV entry: Apache RocketMQ Command Execution Vulnerability | Affected: Apache / RocketMQ | Description: Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-09-27 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp;  https://nvd.nist.gov/vuln/detail/CVE-2023-33246


KEV entry: Ignite Realtime Openfire Path Traversal Vulnerability | Affected: Ignite Realtime / Openfire | Description: Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-09-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.igniterealtime.org/downloads/#openfire;  https://nvd.nist.gov/vuln/detail/CVE-2023-32315


KEV entry: RARLAB WinRAR Code Execution Vulnerability | Affected: RARLAB / WinRAR | Description: RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-09-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): http://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa;  https://nvd.nist.gov/vuln/detail/CVE-2023-38831


KEV entry: Ivanti Sentry Authentication Bypass Vulnerability | Affected: Ivanti / Sentry | Description: Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-09-12 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US ;  https://nvd.nist.gov/vuln/detail/CVE-2023-38035


KEV entry: Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | Affected: Veeam / Backup & Replication | Description: Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-09-12 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.veeam.com/kb4424;  https://nvd.nist.gov/vuln/detail/CVE-2023-27532


KEV entry: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Affected: Adobe / ColdFusion | Description: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-09-11 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-26359


KEV entry: Citrix Content Collaboration ShareFile Improper Access Control Vulnerability | Affected: Citrix / Content Collaboration | Description: Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-09-06 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.citrix.com/article/CTX559517/sharefile-storagezones-controller-security-update-for-cve202324489;  https://nvd.nist.gov/vuln/detail/CVE-2023-24489


KEV entry: Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability | Affected: Microsoft / .NET Core and Visual Studio | Description: Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS). | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-08-30 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-38180;  https://nvd.nist.gov/vuln/detail/CVE-2023-38180


KEV entry: Zyxel P660HN-T1A Routers Command Injection Vulnerability | Affected: Zyxel / P660HN-T1A Routers | Description: Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-08-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-a-new-variant-of-gafgyt-malware; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-p660hn-t1a-dsl-cpe; https://nvd.nist.gov/vuln/detail/CVE-2017-18368


KEV entry: Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability | Affected: Ivanti / Endpoint Manager Mobile (EPMM) | Description: Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable). | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-08-21 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US;  https://nvd.nist.gov/vuln/detail/CVE-2023-35081


KEV entry: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Affected: Synacor / Zimbra Collaboration Suite (ZCS) | Description: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-08-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://wiki.zimbra.com/wiki/Security_Center ;  https://nvd.nist.gov/vuln/detail/CVE-2023-37580


KEV entry: Apple Multiple Products Kernel Unspecified Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-08-16 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213841, https://support.apple.com/en-us/HT213842, https://support.apple.com/en-us/HT213843,https://support.apple.com/en-us/HT213844,https://support.apple.com/en-us/HT213845,https://support.apple.com/en-us/HT213846,https://support.apple.com/en-us/HT213848 ;  https://nvd.nist.gov/vuln/detail/CVE-2023-38606


KEV entry: Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability | Affected: Ivanti / Endpoint Manager Mobile (EPMM) | Description: Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-08-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US;  https://nvd.nist.gov/vuln/detail/CVE-2023-35078


KEV entry: Adobe ColdFusion Improper Access Control Vulnerability | Affected: Adobe / ColdFusion | Description: Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html ;  https://nvd.nist.gov/vuln/detail/CVE-2023-38205


KEV entry: Adobe ColdFusion Improper Access Control Vulnerability | Affected: Adobe / ColdFusion | Description: Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html; https://nvd.nist.gov/vuln/detail/CVE-2023-29298


KEV entry: Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability | Affected: Citrix / NetScaler ADC and NetScaler Gateway | Description: Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-08-09 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467;  https://nvd.nist.gov/vuln/detail/CVE-2023-3519


KEV entry: Microsoft Windows Search Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2023-08-29 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884;  https://nvd.nist.gov/vuln/detail/CVE-2023-36884


KEV entry: SolarView Compact Command Injection Vulnerability | Affected: SolarView / Compact | Description: SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. | Due date: 2023-08-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://jvn.jp/en/vu/JVNVU92327282/;  https://nvd.nist.gov/vuln/detail/CVE-2022-29303


KEV entry: Apple Multiple Products WebKit Code Execution Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. | Due date: 2023-08-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213826, https://support.apple.com/en-us/HT213841, https://support.apple.com/en-us/HT213843, https://support.apple.com/en-us/HT213846, https://support.apple.com/en-us/HT213848;  https://nvd.nist.gov/vuln/detail/CVE-2023-37450


KEV entry: Microsoft Outlook Security Feature Bypass Vulnerability | Affected: Microsoft / Outlook | Description: Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. | Due date: 2023-08-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-35311;  https://nvd.nist.gov/vuln/detail/CVE-2023-35311


KEV entry: Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. | Due date: 2023-08-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36874;  https://nvd.nist.gov/vuln/detail/CVE-2023-36874


KEV entry: Netwrix Auditor Insecure Object Deserialization Vulnerability | Affected: Netwrix / Auditor | Description: Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. | Due date: 2023-08-01 | Known ransomware campaign use (KEV): Known | Notes (KEV): Patch application requires login to customer portal: https://security.netwrix.com/Account/SignIn?ReturnUrl=%2FAdvisories%2FADV-2022-003;  https://nvd.nist.gov/vuln/detail/CVE-2022-31199


KEV entry: Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. | Due date: 2023-08-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32046;  https://nvd.nist.gov/vuln/detail/CVE-2023-32046


KEV entry: Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. | Due date: 2023-08-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32049; https://nvd.nist.gov/vuln/detail/CVE-2023-32049


KEV entry: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | Affected: Arm / Mali Graphics Processing Unit (GPU) | Description: Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. | Due date: 2023-07-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://nvd.nist.gov/vuln/detail/CVE-2021-29256


KEV entry: Samsung Mobile Devices Race Condition Vulnerability | Affected: Samsung / Mobile Devices | Description: Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable | Due date: 2023-07-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://nvd.nist.gov/vuln/detail/CVE-2021-25394


KEV entry: D-Link DIR-859 Router Command Execution Vulnerability | Affected: D-Link / DIR-859 Router | Description: D-Link DIR-859 router contains a command execution vulnerability in the UPnP endpoint URL, /gena.cgi. Exploitation allows an unauthenticated remote attacker to execute system commands as root by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. | Due date: 2023-07-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10147; https://nvd.nist.gov/vuln/detail/CVE-2019-17621


KEV entry: Samsung Mobile Devices Race Condition Vulnerability | Affected: Samsung / Mobile Devices | Description: Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable | Due date: 2023-07-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5; https://nvd.nist.gov/vuln/detail/CVE-2021-25395


KEV entry: Samsung Mobile Devices Out-of-Bounds Read Vulnerability | Affected: Samsung / Mobile Devices | Description: Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable | Due date: 2023-07-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10; https://nvd.nist.gov/vuln/detail/CVE-2021-25487


KEV entry: Samsung Mobile Devices Improper Boundary Check Vulnerability | Affected: Samsung / Mobile Devices | Description: Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable | Due date: 2023-07-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=3; https://nvd.nist.gov/vuln/detail/CVE-2021-25372


KEV entry: D-Link DWL-2600AP Access Point Command Injection Vulnerability | Affected: D-Link / DWL-2600AP Access Point | Description: D-Link DWL-2600AP access point contains an authenticated command injection vulnerability via the Save Configuration functionality in the Web interface, using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable. | Due date: 2023-07-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10113; https://nvd.nist.gov/vuln/detail/CVE-2019-20500


KEV entry: Samsung Mobile Devices Improper Input Validation Vulnerability | Affected: Samsung / Mobile Devices | Description: Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable | Due date: 2023-07-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10; https://nvd.nist.gov/vuln/detail/CVE-2021-25489


KEV entry: Samsung Mobile Devices Unspecified Vulnerability | Affected: Samsung / Mobile Devices | Description: Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP. | Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable | Due date: 2023-07-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=3; https://nvd.nist.gov/vuln/detail/CVE-2021-25371


KEV entry: VMware Tools Authentication Bypass Vulnerability | Affected: VMware / Tools | Description: VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.vmware.com/security/advisories/VMSA-2023-0013.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-20867


KEV entry: Zyxel Multiple NAS Devices Command Injection Vulnerability | Affected: Zyxel / Multiple Network-Attached Storage (NAS) Devices | Description: Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products;  https://nvd.nist.gov/vuln/detail/CVE-2023-27992


KEV entry: Apple Multiple Products Integer Overflow Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213808, https://support.apple.com/en-us/HT213812, https://support.apple.com/en-us/HT213809, https://support.apple.com/en-us/HT213810, https://support.apple.com/en-us/HT213813, https://support.apple.com/en-us/HT213811, https://support.apple.com/en-us/HT213814;  https://nvd.nist.gov/vuln/detail/CVE-2023-32434


KEV entry: Apple Multiple Products WebKit Type Confusion Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213813, https://support.apple.com/en-us/HT213811, https://support.apple.com/en-us/HT213814, https://support.apple.com/en-us/HT213816;  https://nvd.nist.gov/vuln/detail/CVE-2023-32439


KEV entry: Apple Multiple Products WebKit Memory Corruption Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213670, https://support.apple.com/en-us/HT213671, https://support.apple.com/en-us/HT213676, https://support.apple.com/en-us/HT213811;  https://nvd.nist.gov/vuln/detail/CVE-2023-32435


KEV entry: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability | Affected: Roundcube / Roundcube Webmail | Description: Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13; https://nvd.nist.gov/vuln/detail/CVE-2020-35730


KEV entry: Roundcube Webmail Remote Code Execution Vulnerability | Affected: Roundcube / Roundcube Webmail | Description: Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10; https://nvd.nist.gov/vuln/detail/CVE-2020-12641


KEV entry: Microsoft Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039; https://nvd.nist.gov/vuln/detail/CVE-2016-0165


KEV entry: Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability | Affected: Mozilla / Firefox, Firefox ESR, and Thunderbird | Description: Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079; https://nvd.nist.gov/vuln/detail/CVE-2016-9079


KEV entry: Vmware Aria Operations for Networks Command Injection Vulnerability | Affected: VMware / Aria Operations for Networks | Description: VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.vmware.com/security/advisories/VMSA-2023-0012.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-20887


KEV entry: Roundcube Webmail SQL Injection Vulnerability | Affected: Roundcube / Roundcube Webmail | Description: Roundcube Webmail is vulnerable to SQL injection via search or search_params. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released; https://nvd.nist.gov/vuln/detail/CVE-2021-44026


KEV entry: Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability | Affected: Fortinet / FortiOS and FortiProxy SSL-VPN | Description: Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests. | Required action: Apply updates per vendor instructions. | Due date: 2023-07-04 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.fortiguard.com/psirt/FG-IR-23-097;  https://nvd.nist.gov/vuln/detail/CVE-2023-27997


KEV entry: Google Chromium V8 Type Confusion Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html; https://nvd.nist.gov/vuln/detail/CVE-2023-3079


KEV entry: Zyxel Multiple Firewalls Buffer Overflow Vulnerability | Affected: Zyxel / Multiple Firewalls | Description: Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the ID processing function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-26 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls;  https://nvd.nist.gov/vuln/detail/CVE-2023-33010


KEV entry: Zyxel Multiple Firewalls Buffer Overflow Vulnerability | Affected: Zyxel / Multiple Firewalls | Description: Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-26 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls;  https://nvd.nist.gov/vuln/detail/CVE-2023-33009


KEV entry: Progress MOVEit Transfer SQL Injection Vulnerability | Affected: Progress / MOVEit Transfer | Description: Progress MOVEit Transfer contains a SQL injection vulnerability that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-23 | Known ransomware campaign use (KEV): Known | Notes (KEV): This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023.;  https://nvd.nist.gov/vuln/detail/CVE-2023-34362


KEV entry: Zyxel Multiple Firewalls OS Command Injection Vulnerability | Affected: Zyxel / Multiple Firewalls | Description: Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-21 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls;   https://nvd.nist.gov/vuln/detail/CVE-2023-28771


KEV entry: Barracuda Networks ESG Appliance Improper Input Validation Vulnerability | Affected: Barracuda Networks / Email Security Gateway (ESG) Appliance | Description: Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-16 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://status.barracuda.com/incidents/34kx82j5n4q9;  https://nvd.nist.gov/vuln/detail/CVE-2023-2868


KEV entry: Apple Multiple Products WebKit Sandbox Escape Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-12 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/HT213757, https://support.apple.com/HT213758, https://support.apple.com/HT213761, https://support.apple.com/HT213762, https://support.apple.com/HT213764, https://support.apple.com/HT213765; https://nvd.nist.gov/vuln/detail/CVE-2023-32409


KEV entry: Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-12 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/HT213757, https://support.apple.com/HT213758, https://support.apple.com/HT213761, https://support.apple.com/HT213762, https://support.apple.com/HT213764, https://support.apple.com/HT213765;  https://nvd.nist.gov/vuln/detail/CVE-2023-28204


KEV entry: Apple Multiple Products WebKit Use-After-Free Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-12 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/HT213757, https://support.apple.com/HT213758, https://support.apple.com/HT213761, https://support.apple.com/HT213762, https://support.apple.com/HT213764, https://support.apple.com/HT213765; https://nvd.nist.gov/vuln/detail/CVE-2023-32373


KEV entry: Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure Vulnerability | Affected: Cisco / IOS, IOS XR, and IOS XE | Description: Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information disclosure vulnerability in the Internet Key Exchange version 1 (IKEv1) that could allow an attacker to retrieve memory contents. Successful exploitation could allow the attacker to retrieve memory contents, which can lead to information disclosure. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-09 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1; https://nvd.nist.gov/vuln/detail/CVE-2016-6415


KEV entry: Cisco IOS Denial-of-Service Vulnerability | Affected: Cisco / IOS | Description: Cisco IOS contains an unspecified vulnerability that may block further telnet, reverse telnet, Remote Shell (RSH), Secure Shell (SSH), and in some cases, Hypertext Transport Protocol (HTTP) access to the Cisco device. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-09 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20040827-telnet; https://nvd.nist.gov/vuln/detail/CVE-2004-1464


KEV entry: Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability | Affected: Samsung / Mobile Devices | Description: Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-09 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.samsungmobile.com/securityUpdate.smsb;  https://nvd.nist.gov/vuln/detail/CVE-2023-21492


KEV entry: Multiple Ruckus Wireless Products CSRF and RCE Vulnerability | Affected: Ruckus Wireless / Multiple Products | Description: Ruckus Wireless Access Point (AP) software contains an unspecified vulnerability in the web services component. If the web services component is enabled on the AP, an attacker can perform cross-site request forgery (CSRF) or remote code execution (RCE). This vulnerability impacts Ruckus ZoneDirector, SmartZone, and Solo APs. | Required action: Apply updates per vendor instructions or disconnect product if it is end-of-life. | Due date: 2023-06-02 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.ruckuswireless.com/security_bulletins/315;  https://nvd.nist.gov/vuln/detail/CVE-2023-25717


KEV entry: Oracle Java SE and JRockit Unspecified Vulnerability | Affected: Oracle / Java SE and JRockit | Description: Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-02 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.oracle.com/security-alerts/cpuapr2016v3.html; https://nvd.nist.gov/vuln/detail/CVE-2016-3427


KEV entry: Apache Tomcat Remote Code Execution Vulnerability | Affected: Apache / Tomcat | Description: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-02 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735


KEV entry: Red Hat Polkit Incorrect Authorization Vulnerability | Affected: Red Hat / Polkit | Description: Red Hat Polkit contains an incorrect authorization vulnerability through the bypassing of credential checks for D-Bus requests, allowing for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-02 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://bugzilla.redhat.com/show_bug.cgi?id=1961710; https://nvd.nist.gov/vuln/detail/CVE-2021-3560


KEV entry: Linux Kernel Race Condition Vulnerability | Affected: Linux / Kernel | Description: Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2023-06-02 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://lkml.iu.edu/hypermail/linux/kernel/1609.1/02103.html; https://nvd.nist.gov/vuln/detail/CVE-2014-0196


KEV entry: Jenkins User Interface (UI) Information Disclosure Vulnerability | Affected: Jenkins / Jenkins User Interface (UI) | Description: Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages. | Required action: Apply updates per vendor instructions. | Due date: 2023-06-02 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.jenkins.io/security/advisory/2015-11-11/; https://nvd.nist.gov/vuln/detail/CVE-2015-5317


KEV entry: Linux Kernel Improper Input Validation Vulnerability | Affected: Linux / Kernel | Description: Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2023-06-02 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://lkml.iu.edu/hypermail/linux/kernel/1601.3/06474.html; https://nvd.nist.gov/vuln/detail/CVE-2010-3904


KEV entry: Microsoft Win32K Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-30 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-29336; https://nvd.nist.gov/vuln/detail/CVE-2023-29336


KEV entry: Apache Log4j2 Deserialization of Untrusted Data Vulnerability | Affected: Apache / Log4j2 | Description: Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-22 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://logging.apache.org/log4j/2.x/security.html; https://nvd.nist.gov/vuln/detail/CVE-2021-45046


KEV entry: Oracle WebLogic Server Unspecified Vulnerability | Affected: Oracle / WebLogic Server | Description: Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.oracle.com/security-alerts/cpujan2023.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-21839


KEV entry: TP-Link Archer AX-21 Command Injection Vulnerability | Affected: TP-Link / Archer AX21 | Description: TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.tp-link.com/us/support/download/archer-ax21/v3/#Firmware;  https://nvd.nist.gov/vuln/detail/CVE-2023-1389


KEV entry: PaperCut MF/NG Improper Access Control Vulnerability | Affected: PaperCut / MF/NG | Description: PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-12 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.papercut.com/kb/Main/PO-1216-and-PO-1219;  https://nvd.nist.gov/vuln/detail/CVE-2023-27350


KEV entry: MinIO Information Disclosure Vulnerability | Affected: MinIO / MinIO | Description: MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-12 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q; https://nvd.nist.gov/vuln/detail/CVE-2023-28432


KEV entry: Google Chrome Skia Integer Overflow Vulnerability | Affected: Google / Chromium Skia | Description: Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-12 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-2136


KEV entry: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | Affected: Cisco / IOS and IOS XE Software | Description: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp; https://nvd.nist.gov/vuln/detail/CVE-2017-6742


KEV entry: Google Chromium V8 Type Confusion Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-08 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-2033


KEV entry: Apple macOS Use-After-Free Vulnerability | Affected: Apple / macOS | Description: Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-08 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT209600; https://nvd.nist.gov/vuln/detail/CVE-2019-8526


KEV entry: Novi Survey Insecure Deserialization Vulnerability | Affected: Novi Survey / Novi Survey | Description: Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-04 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx; https://nvd.nist.gov/vuln/detail/CVE-2023-29492


KEV entry: Android Framework Privilege Escalation Vulnerability | Affected: Android / Framework | Description: Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-04 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://source.android.com/docs/security/bulletin/2023-03-01;  https://nvd.nist.gov/vuln/detail/CVE-2023-20963


KEV entry: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-02 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28252;  https://nvd.nist.gov/vuln/detail/CVE-2023-28252


KEV entry: Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability | Affected: Apple / iOS, iPadOS, and macOS | Description: Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213720, https://support.apple.com/en-us/HT213721; https://nvd.nist.gov/vuln/detail/CVE-2023-28206


KEV entry: Apple Multiple Products WebKit Use-After-Free Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Required action: Apply updates per vendor instructions. | Due date: 2023-05-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213720,https://support.apple.com/en-us/HT213721,https://support.apple.com/en-us/HT213722,https://support.apple.com/en-us/HT213723;  https://nvd.nist.gov/vuln/detail/CVE-2023-28205


KEV entry: Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-28 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388; https://nvd.nist.gov/vuln/detail/CVE-2019-1388


KEV entry: Veritas Backup Exec Agent File Access Vulnerability | Affected: Veritas / Backup Exec Agent | Description: Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-28 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.veritas.com/support/en_US/security/VTS21-001; https://nvd.nist.gov/vuln/detail/CVE-2021-27876


KEV entry: Veritas Backup Exec Agent Improper Authentication Vulnerability | Affected: Veritas / Backup Exec Agent | Description: Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-28 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.veritas.com/support/en_US/security/VTS21-001; https://nvd.nist.gov/vuln/detail/CVE-2021-27877


KEV entry: Arm Mali GPU Kernel Driver Information Disclosure Vulnerability | Affected: Arm / Mali Graphics Processing Unit (GPU) | Description: Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities;  https://nvd.nist.gov/vuln/detail/CVE-2023-26083


KEV entry: Veritas Backup Exec Agent Command Execution Vulnerability | Affected: Veritas / Backup Exec Agent | Description: Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-28 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.veritas.com/support/en_US/security/VTS21-001; https://nvd.nist.gov/vuln/detail/CVE-2021-27878


KEV entry: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | Affected: Synacor / Zimbra Collaboration Suite (ZCS) | Description: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://wiki.zimbra.com/wiki/Security_Center;  https://nvd.nist.gov/vuln/detail/CVE-2022-27926


KEV entry: Arm Mali GPU Kernel Driver Unspecified Vulnerability | Affected: Arm / Mali Graphics Processing Unit (GPU) | Description: Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities;  https://nvd.nist.gov/vuln/detail/CVE-2022-22706


KEV entry: Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability | Affected: Fortra / Cobalt Strike | Description: Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-2/;  https://nvd.nist.gov/vuln/detail/CVE-2022-42948


KEV entry: Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability | Affected: Fortra / Cobalt Strike | Description: Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-1/;  https://nvd.nist.gov/vuln/detail/CVE-2022-39197


KEV entry: Samba Remote Code Execution Vulnerability | Affected: Samba / Samba | Description: Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-20 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.samba.org/samba/security/CVE-2017-7494.html; https://nvd.nist.gov/vuln/detail/CVE-2017-7494


KEV entry: Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability | Affected: Apple / iOS, iPadOS, and macOS | Description: Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT21286, https://support.apple.com/en-us/HT212868, https://support.apple.com/kb/HT212872; https://nvd.nist.gov/vuln/detail/CVE-2021-30900


KEV entry: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | Affected: Arm / Mali Graphics Processing Unit (GPU) | Description: Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities;  https://nvd.nist.gov/vuln/detail/CVE-2022-38181


KEV entry: Google Chromium Network Service Use-After-Free Vulnerability | Affected: Google / Chromium Network Service | Description: Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-3038


KEV entry: Microsoft Internet Explorer Memory Corruption Vulnerability | Affected: Microsoft / Internet Explorer | Description: Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2023-04-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://nvd.nist.gov/vuln/detail/CVE-2013-3163


KEV entry: Linux Kernel Use-After-Free Vulnerability | Affected: Linux / Kernel | Description: Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-20 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4;  https://nvd.nist.gov/vuln/detail/CVE-2023-0266


KEV entry: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | Affected: Adobe / ColdFusion | Description: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-05 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html;  https://nvd.nist.gov/vuln/detail/CVE-2023-26360


KEV entry: Fortinet FortiOS Path Traversal Vulnerability | Affected: Fortinet / FortiOS | Description: Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-04 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.fortiguard.com/psirt/FG-IR-22-369;  https://nvd.nist.gov/vuln/detail/CVE-2022-41328


KEV entry: Microsoft Office Outlook Privilege Escalation Vulnerability | Affected: Microsoft / Office | Description: Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-04 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23397, https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/, ;  https://nvd.nist.gov/vuln/detail/CVE-2023-23397


KEV entry: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file. | Required action: Apply updates per vendor instructions. | Due date: 2023-04-04 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-24880;  https://nvd.nist.gov/vuln/detail/CVE-2023-24880


KEV entry: XStream Remote Code Execution Vulnerability | Affected: XStream / XStream | Description: XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-31 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.vmware.com/security/advisories/VMSA-2022-0027.html, https://x-stream.github.io/CVE-2021-39144.html; https://nvd.nist.gov/vuln/detail/CVE-2021-39144


KEV entry: Plex Media Server Remote Code Execution Vulnerability | Affected: Plex / Media Server | Description: Plex Media Server contains a remote code execution vulnerability that allows an attacker with access to the server administrator's Plex account to upload a malicious file via the Camera Upload feature and have the media server execute it. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-31 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://forums.plex.tv/t/security-regarding-cve-2020-5741/586819; https://nvd.nist.gov/vuln/detail/CVE-2020-5741


KEV entry: Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability | Affected: Zoho / ManageEngine | Description: Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.manageengine.com/products/self-service-password/advisory/CVE-2022-28810.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-28810


KEV entry: Apache Spark Command Injection Vulnerability | Affected: Apache / Spark | Description: Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc;  https://nvd.nist.gov/vuln/detail/CVE-2022-33891


KEV entry: Teclib GLPI Remote Code Execution Vulnerability | Affected: Teclib / GLPI | Description: Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://glpi-project.org/fr/glpi-10-0-3-disponible/, http://www.bioinformatics.org/phplabware/sourceer/sourceer.php?&Sfs=htmLawedTest.php&Sl=.%2Finternal_utilities%2FhtmLawed.;  https://nvd.nist.gov/vuln/detail/CVE-2022-35914


KEV entry: ZK Framework AuUploader Unspecified Vulnerability | Affected: ZK Framework / AuUploader | Description: ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-20 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://tracker.zkoss.org/browse/ZK-5150;  https://nvd.nist.gov/vuln/detail/CVE-2022-36537


KEV entry: Mitel MiVoice Connect Code Injection Vulnerability | Affected: Mitel / MiVoice Connect | Description: The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008;  https://nvd.nist.gov/vuln/detail/CVE-2022-41223


KEV entry: Mitel MiVoice Connect Command Injection Vulnerability | Affected: Mitel / MiVoice Connect | Description: The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0007;  https://nvd.nist.gov/vuln/detail/CVE-2022-40765


KEV entry: IBM Aspera Faspex Code Execution Vulnerability | Affected: IBM / Aspera Faspex | Description: IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://exchange.xforce.ibmcloud.com/vulnerabilities/243512?_ga=2.189195179.1800390251.1676559338-700333034.1676325890;  https://nvd.nist.gov/vuln/detail/CVE-2022-47986


KEV entry: Cacti Command Injection Vulnerability | Affected: Cacti / Cacti | Description: Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-09 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf;  https://nvd.nist.gov/vuln/detail/CVE-2022-46169


KEV entry: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-07 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23376;  https://nvd.nist.gov/vuln/detail/CVE-2023-23376


KEV entry: Microsoft Office Publisher Security Feature Bypass Vulnerability | Affected: Microsoft / Office | Description: Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-07 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21715;  https://nvd.nist.gov/vuln/detail/CVE-2023-21715


KEV entry: Apple Multiple Products WebKit Type Confusion Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-07 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213635, https://support.apple.com/en-us/HT213633, https://support.apple.com/en-us/HT213638;  https://nvd.nist.gov/vuln/detail/CVE-2023-23529


KEV entry: Microsoft Windows Graphic Component Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-07 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21823;  https://nvd.nist.gov/vuln/detail/CVE-2023-21823


KEV entry: Fortra GoAnywhere MFT Remote Code Execution Vulnerability | Affected: Fortra / GoAnywhere MFT | Description: Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-03 | Known ransomware campaign use (KEV): Known | Notes (KEV): This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://my.goanywhere.com/webclient/DownloadProductFiles.xhtml. Fortra users must have an account in order to login and access the patch.;  https://nvd.nist.gov/vuln/detail/CVE-2023-0669


KEV entry: Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability | Affected: Intel / Ethernet Diagnostics Driver for Windows | Description: Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2023-03-03 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00051.html; https://nvd.nist.gov/vuln/detail/CVE-2015-2291


KEV entry: TerraMaster OS Remote Command Execution Vulnerability | Affected: TerraMaster / TerraMaster OS | Description: TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint. | Required action: Apply updates per vendor instructions. | Due date: 2023-03-03 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://forum.terra-master.com/en/viewtopic.php?t=3030;  https://nvd.nist.gov/vuln/detail/CVE-2022-24990


KEV entry: Multiple SugarCRM Products Remote Code Execution Vulnerability | Affected: SugarCRM / Multiple Products | Description: Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates. | Required action: Apply updates per vendor instructions. | Due date: 2023-02-23 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/;  https://nvd.nist.gov/vuln/detail/CVE-2023-22952


KEV entry: Oracle E-Business Suite Unspecified Vulnerability | Affected: Oracle / E-Business Suite | Description: Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. | Required action: Apply updates per vendor instructions. | Due date: 2023-02-23 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.oracle.com/security-alerts/cpuoct2022.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-21587


KEV entry: Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability | Affected: Telerik / User Interface (UI) for ASP.NET AJAX | Description: Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2023-02-16 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/asyncupload-insecure-direct-object-reference; https://nvd.nist.gov/vuln/detail/CVE-2017-11357


KEV entry: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | Affected: Zoho / ManageEngine | Description: Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario. | Required action: Apply updates per vendor instructions. | Due date: 2023-02-13 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-47966


KEV entry: CWP Control Web Panel OS Command Injection Vulnerability | Affected: CWP / Control Web Panel | Description: CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter. | Required action: Apply updates per vendor instructions. | Due date: 2023-02-07 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://control-webpanel.com/changelog#1669855527714-450fb335-6194;  https://nvd.nist.gov/vuln/detail/CVE-2022-44877


KEV entry: Microsoft Exchange Server Privilege Escalation Vulnerability | Affected: Microsoft / Exchange Server | Description: Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2023-01-31 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41080;  https://nvd.nist.gov/vuln/detail/CVE-2022-41080


KEV entry: Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2023-01-31 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21674;  https://nvd.nist.gov/vuln/detail/CVE-2023-21674


KEV entry: TIBCO JasperReports Library Directory Traversal Vulnerability | Affected: TIBCO / JasperReports | Description: TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system. | Required action: Apply updates per vendor instructions. | Due date: 2023-01-19 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809; https://nvd.nist.gov/vuln/detail/CVE-2018-18809


KEV entry: TIBCO JasperReports Server Information Disclosure Vulnerability | Affected: TIBCO / JasperReports | Description: TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. | Required action: Apply updates per vendor instructions. | Due date: 2023-01-19 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430;https://nvd.nist.gov/vuln/detail/CVE-2018-5430


KEV entry: Apple iOS Type Confusion Vulnerability | Affected: Apple / iOS | Description: Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution. | Required action: Apply updates per vendor instructions. | Due date: 2023-01-04 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213516;  https://nvd.nist.gov/vuln/detail/CVE-2022-42856


KEV entry: Microsoft Defender SmartScreen Security Feature Bypass Vulnerability | Affected: Microsoft / Defender | Description: Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file. | Required action: Apply updates per vendor instructions. | Due date: 2023-01-03 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698;  https://nvd.nist.gov/vuln/detail/CVE-2022-44698


KEV entry: Veeam Backup & Replication Remote Code Execution Vulnerability | Affected: Veeam / Backup & Replication | Description: The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code. | Required action: Apply updates per vendor instructions. | Due date: 2023-01-03 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.veeam.com/kb4288;  https://nvd.nist.gov/vuln/detail/CVE-2022-26501


KEV entry: Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability | Affected: Fortinet / FortiOS | Description: Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests. | Required action: Apply updates per vendor instructions. | Due date: 2023-01-03 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.fortiguard.com/psirt/FG-IR-22-398;  https://nvd.nist.gov/vuln/detail/CVE-2022-42475


KEV entry: Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability | Affected: Citrix / Application Delivery Controller (ADC) and Gateway | Description: Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator. | Required action: Apply updates per vendor instructions. | Due date: 2023-01-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.citrix.com/blogs/2022/12/13/critical-security-update-now-available-for-citrix-adc-citrix-gateway/;  https://nvd.nist.gov/vuln/detail/CVE-2022-27518


KEV entry: Veeam Backup & Replication Remote Code Execution Vulnerability | Affected: Veeam / Backup & Replication | Description: The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code. | Required action: Apply updates per vendor instructions. | Due date: 2023-01-03 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.veeam.com/kb4288;  https://nvd.nist.gov/vuln/detail/CVE-2022-26500


KEV entry: Google Chromium V8 Type Confusion Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-12-26 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-4262


KEV entry: Google Chromium GPU Heap Buffer Overflow Vulnerability | Affected: Google / Chromium GPU | Description: Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-12-19 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-4135


KEV entry: Oracle Fusion Middleware Unspecified Vulnerability | Affected: Oracle / Fusion Middleware | Description: Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product. | Required action: Apply updates per vendor instructions. | Due date: 2022-12-19 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.oracle.com/security-alerts/cpujan2022.html; https://nvd.nist.gov/vuln/detail/CVE-2021-35587


KEV entry: Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. | Required action: Apply updates per vendor instructions. | Due date: 2022-12-09 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41049;  https://nvd.nist.gov/vuln/detail/CVE-2022-41049


KEV entry: Samsung Mobile Devices Improper Access Control Vulnerability | Affected: Samsung / Mobile Devices | Description: Samsung mobile devices using Mali GPU contains an improper access control vulnerability in sec_log file. Exploitation of the vulnerability exposes sensitive kernel information to the userspace. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25370. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.samsungmobile.com/securityUpdate.smsb; https://nvd.nist.gov/vuln/detail/CVE-2021-25369


KEV entry: Microsoft Windows Scripting Languages Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-12-09 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41128;  https://nvd.nist.gov/vuln/detail/CVE-2022-41128


KEV entry: Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. | Required action: Apply updates per vendor instructions. | Due date: 2022-12-09 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41091;  https://nvd.nist.gov/vuln/detail/CVE-2022-41091


KEV entry: Samsung Mobile Devices Memory Corruption Vulnerability | Affected: Samsung / Mobile Devices | Description: Samsung mobile devices using Mali GPU contain an incorrect implementation handling file descriptor in dpu driver. This incorrect implementation results in memory corruption, leading to kernel panic. This vulnerability was chained with CVE-2021-25337 and CVE-2021-25369. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.samsungmobile.com/securityUpdate.smsb; https://nvd.nist.gov/vuln/detail/CVE-2021-25370


KEV entry: Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-12-09 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41125;  https://nvd.nist.gov/vuln/detail/CVE-2022-41125


KEV entry: Samsung Mobile Devices Improper Access Control Vulnerability | Affected: Samsung / Mobile Devices | Description: Samsung mobile devices contain an improper access control vulnerability in clipboard service which allows untrusted applications to read or write arbitrary files. This vulnerability was chained with CVE-2021-25369 and CVE-2021-25370. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.samsungmobile.com/securityUpdate.smsb; https://nvd.nist.gov/vuln/detail/CVE-2021-25337


KEV entry: Microsoft Windows Print Spooler Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-12-09 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41073;  https://nvd.nist.gov/vuln/detail/CVE-2022-41073


KEV entry: Google Chromium V8 Type Confusion Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_27.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-3723


KEV entry: Apple iOS and iPadOS Out-of-Bounds Write Vulnerability | Affected: Apple / iOS and iPadOS | Description: Apple iOS and iPadOS kernel contain an out-of-bounds write vulnerability which can allow an application to perform code execution with kernel privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213489;  https://nvd.nist.gov/vuln/detail/CVE-2022-42827


KEV entry: GIGABYTE Multiple Products Code Execution Vulnerability | Affected: GIGABYTE / Multiple Products | Description: The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19322


KEV entry: GIGABYTE Multiple Products Unspecified Vulnerability | Affected: GIGABYTE / Multiple Products | Description: The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19320


KEV entry: GIGABYTE Multiple Products Privilege Escalation Vulnerability | Affected: GIGABYTE / Multiple Products | Description: The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19321


KEV entry: Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability | Affected: Cisco / AnyConnect Secure | Description: Cisco AnyConnect Secure Mobility Client for Windows interprocess communication (IPC) channel allows for insufficient validation of resources that are loaded by the application at run time. An attacker with valid credentials on Windows could execute code on the affected machine with SYSTEM privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-F26WwJW; https://nvd.nist.gov/vuln/detail/CVE-2020-3433


KEV entry: GIGABYTE Multiple Products Privilege Escalation Vulnerability | Affected: GIGABYTE / Multiple Products | Description: The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.gigabyte.com/Support/Security/1801; https://nvd.nist.gov/vuln/detail/CVE-2018-19323


KEV entry: Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability | Affected: Cisco / AnyConnect Secure | Description: Cisco AnyConnect Secure Mobility Client for Windows allows for incorrect handling of directory paths. An attacker with valid credentials on Windows would be able to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ac-win-path-traverse-qO4HWBsj; https://nvd.nist.gov/vuln/detail/CVE-2020-3153