KEV entry: Microsoft Internet Explorer Use-After-Free Vulnerability | Affected: Microsoft / Internet Explorer | Description: A use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-3897


KEV entry: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | Affected: Cisco / IOS and IOS XE Software | Description: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-6739

CISA Known Exploited Vulnerabilities Catalog


KEV entry: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | Affected: Cisco / Small Business RV160, RV260, RV340, and RV345 Series Routers | Description: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-20703


KEV entry: Cisco IOS, XR, and XE Software Buffer Overflow Vulnerability | Affected: Cisco / IOS, XR, and XE Software | Description: Format string vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-0175


KEV entry: Adobe Reader and Acrobat Use-After-Free Vulnerability | Affected: Adobe / Reader and Acrobat | Description: Adobe Reader and Acrobat contain a use-after-free vulnerability which can allow for code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-0496


KEV entry: Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability | Affected: Cisco / IOS software | Description: There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-12234


KEV entry: Microsoft Office Use-After-Free Vulnerability | Affected: Microsoft / Office | Description: Microsoft Office contains a use-after-free vulnerability which can allow for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0261


KEV entry: Adobe Flash Player Type Confusion Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player contains a type confusion vulnerability which can allow for remote code execution. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-11292


KEV entry: Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability | Affected: Oracle / Java SE | Description: An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-2590


KEV entry: Microsoft ATM Font Driver Privilege Escalation Vulnerability | Affected: Microsoft / ATM Font Driver | Description: ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-2387


KEV entry: Adobe Flash Player Remote Code Execution Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2011-0611


KEV entry: Adobe Flash Player Arbitrary Code Execution Vulnerability | Affected: Adobe / Flash Player | Description: Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2012-1535


KEV entry: Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service Vulnerability | Affected: Cisco / Catalyst 6800 Series Switches | Description: A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a denial of service. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-12238


KEV entry: Apache Tomcat Improper Privilege Management Vulnerability | Affected: Apache / Tomcat | Description: Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-1938


KEV entry: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | Affected: Cisco / Small Business RV160, RV260, RV340, and RV345 Series Routers | Description: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-20708


KEV entry: Adobe Flash Player Arbitrary Code Execution Vulnerability | Affected: Adobe / Flash Player | Description: An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-4117


KEV entry: Microsoft Office Security Feature Bypass Vulnerability | Affected: Microsoft / Excel | Description: A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-7262


KEV entry: Mozilla Firefox Information Disclosure Vulnerability | Affected: Mozilla / Firefox | Description: Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-1675


KEV entry: Oracle Java SE Integrity Check Vulnerability | Affected: Oracle / Java SE | Description: Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-4902


KEV entry: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | Affected: Cisco / Small Business RV160, RV260, RV340, and RV345 Series Routers | Description: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-20701


KEV entry: Adobe Reader and Acrobat Memory Corruption Vulnerability | Affected: Adobe / Reader and Acrobat | Description: An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-0640


KEV entry: Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service Vulnerability | Affected: Cisco / IOS Software and Cisco IOS XE Software | Description: A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial-of-service (DoS) condition. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-0159


KEV entry: Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability | Affected: Microsoft / Malware Protection Engine | Description: The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability". | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-8540


KEV entry: Microsoft Windows Installer Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-41379


KEV entry: Adobe Flash Player Arbitrary Code Execution Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-1019


KEV entry: Microsoft Office Memory Corruption Vulnerability | Affected: Microsoft / Office | Description: Microsoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-1642


KEV entry: Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service Vulnerability | Affected: Cisco / IOS Software and Cisco IOS XE Software | Description: A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service (DoS) condition. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-0156


KEV entry: Adobe Reader and Acrobat Input Validation Vulnerability | Affected: Adobe / Acrobat and Reader | Description: Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2008-2992


KEV entry: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | Affected: Cisco / IOS and IOS XE Software | Description: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-6736


KEV entry: Cisco Catalyst Bidirectional Forwarding Detection Denial-of-Service Vulnerability | Affected: Cisco / Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches | Description: A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial-of-service (DoS) condition. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-0155


KEV entry: Cisco IOS and IOS XE Software Improper Input Validation Vulnerability | Affected: Cisco / IOS and IOS XE Software | Description: A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-0172


KEV entry: Adobe ColdFusion Authentication Bypass Vulnerability | Affected: Adobe / ColdFusion | Description: An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-0632


KEV entry: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Affected: Oracle / Java SE | Description: An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2012-0507


KEV entry: Microsoft Exchange Server Privilege Escalation Vulnerability | Affected: Microsoft / Exchange Server | Description: A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-8581


KEV entry: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | Affected: Cisco / IOS and IOS XE Software | Description: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-6738


KEV entry: Adobe Flash Player Arbitrary Code Execution Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-7645


KEV entry: Adobe Reader and Acrobat Memory Corruption Vulnerability | Affected: Adobe / Reader and Acrobat | Description: Adobe Reader and Acrobat contain a memory corruption vulnerability which can allow attackers to execute arbitrary code or cause a denial of service. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-3346


KEV entry: Microsoft Windows Kernel Exception Handler Vulnerability | Affected: Microsoft / Windows | Description: The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2010-0232


KEV entry: Cisco IOS Software and Cisco IOS XE Software Improper Input Validation Vulnerability | Affected: Cisco / IOS XE Software | Description: A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow for denial-of-service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-0174


KEV entry: Cisco IOS Software Resource Management Errors Vulnerability | Affected: Cisco / IOS Software | Description: A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial-of-service (DoS) condition. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-0161


KEV entry: Cisco IOS Software Network Address Translation Denial-of-Service Vulnerability | Affected: Cisco / IOS software | Description: A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS could allow an unauthenticated, remote attacker to cause a denial of service. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-12231


KEV entry: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability | Affected: Cisco / IOS and IOS XE Software | Description: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-6737


KEV entry: Microsoft Windows Kernel Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-5065


KEV entry: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability | Affected: Oracle / Java SE | Description: The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2012-4681


KEV entry: Cisco IOS Software Common Industrial Protocol Request Denial-of-Service Vulnerability | Affected: Cisco / IOS software | Description: There is a vulnerability in the implementation of the Common Industrial Protocol (CIP) feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-12233


KEV entry: Microsoft Forefront TMG Remote Code Execution Vulnerability | Affected: Microsoft / Forefront Threat Management Gateway (TMG) | Description: A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2011-1889


KEV entry: Microsoft Windows Improper Input Validation Vulnerability | Affected: Microsoft / Windows | Description: The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2009-1123


KEV entry: Microsoft Office Memory Corruption Vulnerability | Affected: Microsoft / Office | Description: Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-7193


KEV entry: Microsoft Windows Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2004-0210


KEV entry: Linux Kernel Race Condition Vulnerability | Affected: Linux / Kernel | Description: Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-5195


KEV entry: Microsoft Excel Featheader Record Memory Corruption Vulnerability | Affected: Microsoft / Excel | Description: Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2009-3129


KEV entry: ChakraCore Scripting Engine Type Confusion Vulnerability | Affected: ChakraCore / ChakraCore scripting engine | Description: The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-8298


KEV entry: Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service Vulnerability | Affected: Cisco / IOS XE Software | Description: A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-12319


KEV entry: Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability | Affected: Siemens / SIMATIC CP | Description: An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-8562


KEV entry: Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-4114


KEV entry: Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | Affected: Cisco / Small Business RV160, RV260, RV340, and RV345 Series Routers | Description: A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or cause a denial of service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-20699


KEV entry: Adobe Flash Player Use-After-Free Vulnerability | Affected: Adobe / Flash Player | Description: A use-after-free vulnerability exists within the ActionScript 3 ByteArray class in Adobe Flash Player that allows an attacker to perform remote code execution. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-5119


KEV entry: Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability | Affected: Microsoft / Graphics Device Interface (GDI) | Description: The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges | Required action: Apply updates per vendor instructions. | Due date: 2022-03-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0001


KEV entry: Cisco IOS Software Integrated Services Module for VPN Denial-of-Service Vulnerability | Affected: Cisco / IOS Software | Description: A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) condition. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-0154


KEV entry: Microsoft Internet Explorer Remote Code Execution Vulnerability | Affected: Microsoft / Internet Explorer | Description: A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-25 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0222


KEV entry: Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability | Affected: Synacor / Zimbra Collaborate Suite (ZCS) | Description: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-11 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-24682


KEV entry: Microsoft Windows Code Injection Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-25 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-6352


KEV entry: Microsoft Office Remote Code Execution Vulnerability | Affected: Microsoft / Office | Description: A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-25 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-8570


KEV entry: Zabbix Frontend Authentication Bypass Vulnerability | Affected: Zabbix / Frontend | Description: Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-08 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-23131


KEV entry: Zabbix Frontend Improper Access Control Vulnerability | Affected: Zabbix / Frontend | Description: Malicious actors can pass step checks and potentially change the configuration of Zabbix Frontend. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-08 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-23134


KEV entry: Microsoft Internet Explorer Type Confusion Vulnerability | Affected: Microsoft / Internet Explorer | Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer | Required action: Apply updates per vendor instructions. | Due date: 2022-08-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-0752


KEV entry: PHPUnit Command Injection Vulnerability | Affected: PHPUnit / PHPUnit | Description: PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-9841


KEV entry: Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability | Affected: Microsoft / Windows | Description: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution" | Required action: Apply updates per vendor instructions. | Due date: 2022-08-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-8174


KEV entry: Microsoft Word Memory Corruption Vulnerability | Affected: Microsoft / Word | Description: Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-1761


KEV entry: Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability | Affected: Adobe / Commerce and Magento Open Source | Description: Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-24086


KEV entry: WinRAR Absolute Path Traversal Vulnerability | Affected: RARLAB / WinRAR | Description: WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution | Required action: Apply updates per vendor instructions. | Due date: 2022-08-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-20250


KEV entry: Adobe Flash Player Use-After-Free Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-08-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-15982


KEV entry: Microsoft Graphics Component Memory Corruption Vulnerability | Affected: Microsoft / Graphics Component | Description: Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-3906


KEV entry: Google Chromium Animation Use-After-Free Vulnerability | Affected: Google / Chromium Animation | Description: Google Chromium Animation contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-03-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-0609


KEV entry: Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability | Affected: Apple / iOS, iPadOS, and macOS | Description: Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-25 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-22620


KEV entry: Microsoft Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0263


KEV entry: Microsoft SMBv1 Remote Code Execution Vulnerability | Affected: Microsoft / SMBv1 | Description: The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0144


KEV entry: Oracle Corporation WebLogic Server Remote Code Execution Vulnerability | Affected: Oracle / WebLogic Server | Description: Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-10271


KEV entry: D-Link DIR-645 Router Remote Code Execution Vulnerability | Affected: D-Link / DIR-645 Router | Description: D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-2051


KEV entry: Microsoft HTTP.sys Remote Code Execution Vulnerability | Affected: Microsoft / HTTP.sys | Description: Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-1635


KEV entry: Apple OS X Heap-Based Buffer Overflow Vulnerability | Affected: Apple / OS X | Description: Heap-based buffer overflow in IOHIDFamily in Apple OS X, which affects, iOS before 8 and Apple TV before 7, allows attackers to execute arbitrary code in a privileged context. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-4404


KEV entry: Apache ActiveMQ Improper Input Validation Vulnerability | Affected: Apache / ActiveMQ | Description: The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-3088


KEV entry: Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-8464


KEV entry: Apache Struts 1 Improper Input Validation Vulnerability | Affected: Apache / Struts 1 | Description: The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-9791


KEV entry: Microsoft SMBv1 Remote Code Execution Vulnerability | Affected: Microsoft / SMBv1 | Description: The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0145


KEV entry: Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability | Affected: Jenkins / Jenkins Stapler Web Framework | Description: A code execution vulnerability exists in the Stapler web framework used by Jenkins | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-1000861


KEV entry: Apple OS X Authentication Bypass Vulnerability | Affected: Apple / OS X | Description: The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-1130


KEV entry: Microsoft Office Remote Code Execution Vulnerability | Affected: Microsoft / Office | Description: A remote code execution vulnerability exists in Microsoft Office. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0262


KEV entry: Microsoft Windows SAM Local Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-36934


KEV entry: Microsoft SMBv3 Remote Code Execution Vulnerability | Affected: Microsoft / SMBv3 | Description: A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-10 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-0796


KEV entry: Microsoft Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-21882


KEV entry: Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability | Affected: Intel / Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability | Description: Intel products contain a vulnerability which can allow attackers to perform privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-5689


KEV entry: Grandstream Networks UCM6200 Series SQL Injection Vulnerability | Affected: Grandstream / UCM6200 | Description: Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-5722


KEV entry: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | Affected: GNU / Bourne-Again Shell (Bash) | Description: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-7169


KEV entry: Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-28 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-0787


KEV entry: SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability | Affected: SonicWall / SMA 100 Appliances | Description: SonicWall SMA 100 devies are vulnerable to an unauthenticated stack-based buffer overflow vulnerability where exploitation can result in code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-11 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-20038


KEV entry: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability | Affected: GNU / Bourne-Again Shell (Bash) | Description: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-6271


KEV entry: Apple Memory Corruption Vulnerability | Affected: Apple / iOS and macOS | Description: Apple IOMobileFrameBuffer contains a memory corruption vulnerability which can allow a malicious application to execute arbitrary code with kernel privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-11 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-22587


KEV entry: Microsoft Internet Explorer Memory Corruption Vulnerability | Affected: Microsoft / Internet Explorer | Description: Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2014/ms14-021?redirectedfrom=MSDN; https://nvd.nist.gov/vuln/detail/CVE-2014-1776


KEV entry: Apache Struts 2 Improper Input Validation Vulnerability | Affected: Apache / Struts 2 | Description: The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-21 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2012-0391


KEV entry: SolarWinds Serv-U Improper Input Validation Vulnerability | Affected: SolarWinds / Serv-U | Description: SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-04 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-35247


KEV entry: Microsoft Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-21 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-8453


KEV entry: Apache Struts 1 ActionForm Denial-of-Service Vulnerability | Affected: Apache / Struts 1 | Description: ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2022-07-21 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2006-1547


KEV entry: VMware Server Side Request Forgery in vRealize Operations Manager API | Affected: VMware / vRealize Operations Manager API | Description: Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-01 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-21975


KEV entry: Aviatrix Controller Unrestricted Upload of File | Affected: Aviatrix / Aviatrix Controller | Description: Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-40870


KEV entry: System Information Library for Node.JS Command Injection | Affected: Npm package / System Information Library for Node.JS | Description: In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-21315


KEV entry: Drupal core Un-restricted Upload of File | Affected: Drupal / Drupal core | Description: Improper sanitization in the extension file names is present in Drupal core. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-13671


KEV entry: Apache Airflow's Experimental API Authentication Bypass | Affected: Apache / Airflow's Experimental API | Description: The previous default setting for Airflow's Experimental API was to allow all API requests without authentication. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-13927


KEV entry: Nagios XI OS Command Injection | Affected: Nagios / Nagios XI | Description: Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-25298


KEV entry: Microsoft Exchange Server Information Disclosure | Affected: Microsoft / Exchange Server | Description: Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-33766


KEV entry: Apache Airflow Command Injection | Affected: Apache / Airflow | Description: A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-11978


KEV entry: F5 BIG-IP Traffic Management Microkernel Buffer Overflow | Affected: F5 / BIG-IP Traffic Management Microkernel | Description: The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-22991


KEV entry: Nagios XI OS Command Injection | Affected: Nagios / Nagios XI | Description: Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-25296


KEV entry: Oracle Business Intelligence Enterprise Edition Path Transversal | Affected: Oracle / Intelligence Enterprise Edition | Description: Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-14864


KEV entry: Nagios XI OS Command Injection | Affected: Nagios / Nagios XI | Description: Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-25297


KEV entry: October CMS Improper Authentication | Affected: October CMS / October CMS | Description: In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. | Required action: Apply updates per vendor instructions. | Due date: 2022-02-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-32648


KEV entry: Fortinet FortiOS and FortiProxy Out-of-bounds Write | Affected: Fortinet / FortiOS and FortiProxy | Description: A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-10 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-13383


KEV entry: Microsoft WinVerifyTrust function Remote Code Execution | Affected: Microsoft / WinVerifyTrust function | Description: A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-3900


KEV entry: Google Chrome Media Use-After-Free Vulnerability | Affected: Google / Chrome Media | Description: Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-6572


KEV entry: Exim Mail Transfer Agent (MTA) Improper Input Validation | Affected: Exim / Mail Transfer Agent (MTA) | Description: Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-10149


KEV entry: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability | Affected: Palo Alto Networks / PAN-OS | Description: Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-10 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-1579


KEV entry: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference | Affected: Synacor / Zimbra Collaboration Suite (ZCS) | Description: Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-9670


KEV entry: Oracle WebLogic Server, Injection | Affected: Oracle / WebLogic Server | Description: Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). | Required action: Apply updates per vendor instructions. | Due date: 2022-07-10 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-2725


KEV entry: FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploit | Affected: FatPipe / WARP, IPVPN, and MPVPN software | Description: A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software allows a remote, unauthenticated attacker to upload a file to any location on the filesystem. | Required action: Apply updates per vendor instructions. | Due date: 2022-01-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-27860


KEV entry: VMware vCenter Server Improper Access Control | Affected: VMware / vCenter Server | Description: Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. | Required action: Apply updates per vendor instructions. | Due date: 2022-01-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-22017


KEV entry: Primetek Primefaces Remote Code Execution Vulnerability | Affected: Primetek / Primefaces Application | Description: Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution | Required action: Apply updates per vendor instructions. | Due date: 2022-07-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-1000486


KEV entry: Hikvision Improper Input Validation | Affected: Hikvision / Security cameras web server | Description: A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation. | Required action: Apply updates per vendor instructions. | Due date: 2022-01-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-36260


KEV entry: IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. | Affected: IBM / WebSphere Application Server and Server Hypervisor Edition | Description: Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands | Required action: Apply updates per vendor instructions. | Due date: 2022-07-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-7450


KEV entry: Fortinet FortiOS and FortiProxy Improper Authorization | Affected: Fortinet / FortiOS and FortiProxy | Description: An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-10 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-13382


KEV entry: Microsoft Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-10 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-1458


KEV entry: Kibana Arbitrary Code Execution | Affected: Elastic / Kibana | Description: Kibana contain an arbitrary code execution flaw in the Timelion visualizer. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-7609


KEV entry: Microsoft Windows AppX Installer Spoofing Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability. | Required action: Apply updates per vendor instructions. | Due date: 2021-12-29 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-43890


KEV entry: Google Chromium V8 Use-After-Free Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2021-12-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-4102


KEV entry: Red Hat JBoss Application Server Remote Code Execution Vulnerability | Affected: Red Hat / JBoss Application Server | Description: The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an attacker to execute arbitrary code via crafted serialized data. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-10 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-12149


KEV entry: Realtek Jungle SDK Remote Code Execution Vulnerability | Affected: Realtek / Jungle Software Development Kit (SDK) | Description: RealTek Jungle SDK contains multiple memory corruption vulnerabilities which can allow an attacker to perform remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2021-12-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-35394


KEV entry: Apache Solr DataImportHandler Code Injection Vulnerability | Affected: Apache / Solr | Description: The optional Apache Solr module DataImportHandler contains a code injection vulnerability. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-0193


KEV entry: Linux Kernel Improper Privilege Management Vulnerability | Affected: Linux / Kernel | Description: Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-13272


KEV entry: MongoDB mongo-express Remote Code Execution Vulnerability | Affected: MongoDB / mongo-express | Description: mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-10758


KEV entry: Fuel CMS SQL Injection Vulnerability | Affected: Fuel CMS / Fuel CMS | Description: FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-17463


KEV entry: Zoho Desktop Central Authentication Bypass Vulnerability | Affected: Zoho / Desktop Central | Description: Zoho Desktop Central contains an authentication bypass vulnerability that could allow an attacker to execute arbitrary code in the Desktop Central MSP server. | Required action: Apply updates per vendor instructions. | Due date: 2021-12-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-44515


KEV entry: Embedthis GoAhead Remote Code Execution Vulnerability | Affected: Embedthis / GoAhead | Description: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-17562


KEV entry: Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability | Affected: Sonatype / Nexus Repository Manager | Description: Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-7238


KEV entry: Pi-Hole AdminLTE Remote Code Execution Vulnerability | Affected: Pi-hole / AdminLTE | Description: Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-8816


KEV entry: Fortinet FortiOS Arbitrary File Download | Affected: Fortinet / FortiOS | Description: Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files. | Required action: Apply updates per vendor instructions. | Due date: 2021-12-24 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-44168


KEV entry: Apache Log4j2 Remote Code Execution Vulnerability | Affected: Apache / Log4j2 | Description: Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution. | Required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available. | Due date: 2021-12-24 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-44228


KEV entry: Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability | Affected: Red Hat / JBoss Seam 2 | Description: JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2010-1871


KEV entry: MikroTik Router OS Directory Traversal Vulnerability | Affected: MikroTik / RouterOS | Description: MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-14847


KEV entry: Apache HTTP Server-Side Request Forgery (SSRF) | Affected: Apache / Apache | Description: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. | Required action: Apply updates per vendor instructions. | Due date: 2021-12-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-40438


KEV entry: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability | Affected: Zoho / ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Description: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution | Required action: Apply updates per vendor instructions. | Due date: 2021-12-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-44077


KEV entry: Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability | Affected: Zoho / ManageEngine ServiceDesk Plus (SDP) | Description: Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication | Required action: Apply updates per vendor instructions. | Due date: 2021-12-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-37415


KEV entry: Qualcomm Multiple Chipsets Improper Input Validation Vulnerability | Affected: Qualcomm / Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | Description: Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | Required action: Apply updates per vendor instructions. | Due date: 2022-06-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-11261


KEV entry: ExifTool Remote Code Execution Vulnerability | Affected: Perl / Exiftool | Description: Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image | Required action: Apply updates per vendor instructions. | Due date: 2021-12-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-22204


KEV entry: Microsoft Windows Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Unspecified vulnerability allows for an authenticated user to escalate privileges. | Required action: Apply updates per vendor instructions. | Due date: 2021-12-01 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-40449


KEV entry: Microsoft Excel Security Feature Bypass | Affected: Microsoft / Office | Description: A security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution. | Required action: Apply updates per vendor instructions. | Due date: 2021-12-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-42292


KEV entry: Microsoft Exchange Server Remote Code Execution Vulnerability | Affected: Microsoft / Exchange | Description: An authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2021-12-01 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-42321


KEV entry: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | Affected: Microsoft / Open Management Infrastructure (OMI) | Description: Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-38649


KEV entry: Mozilla Firefox And Thunderbird Type Confusion Vulnerability | Affected: Mozilla / Firefox and Thunderbird | Description: Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-17026


KEV entry: Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability | Affected: Atlassian / Confluence Server and Data Server | Description: Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-3396


KEV entry: Google Chromium V8 Out-of-Bounds Write Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-30632


KEV entry: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability | Affected: Citrix / Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Description: Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an authorization bypass vulnerability that may allow unauthenticated access to certain URL endpoints. The attacker must have access to the NetScaler IP (NSIP) in order to perform exploitation. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-8193


KEV entry: Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-33739


KEV entry: Microsoft Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: Microsoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-0803


KEV entry: Microsoft Exchange Server Remote Code Execution Vulnerability | Affected: Microsoft / Exchange Server | Description: Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-34473


KEV entry: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability | Affected: Citrix / Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | Description: Citrix ADC, Citrix Gateway, and multiple Citrix SD-WAN WANOP appliance models contain an unspecified vulnerability that could allow an unauthenticated attacker to perform code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-19781


KEV entry: Realtek AP-Router SDK Buffer Overflow Vulnerability | Affected: Realtek / AP-Router SDK | Description: Realtek AP-Router SDK HTTP web server boa contains a buffer overflow vulnerability due to unsafe copies of some overly long parameters submitted in the form that lead to denial-of-service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-35395


KEV entry: Accellion FTA SQL Injection Vulnerability | Affected: Accellion / FTA | Description: Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html. | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-27101


KEV entry: Roundcube Webmail File Disclosure Vulnerability | Affected: Roundcube / Roundcube Webmail | Description: Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-16651


KEV entry: Trend Micro OfficeScan Directory Traversal Vulnerability | Affected: Trend Micro / OfficeScan | Description: Trend Micro OfficeScan contains a directory traversal vulnerability by extracting files from a zip file to a specific folder on the OfficeScan server, leading to remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-18187


KEV entry: SolarWinds Virtualization Manager Privilege Escalation Vulnerability | Affected: SolarWinds / Virtualization Manager | Description: SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-3643


KEV entry: Microsoft Windows Kernel Information Disclosure Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process. | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-31955


KEV entry: SaltStack Salt Authentication Bypass Vulnerability | Affected: SaltStack / Salt | Description: SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/or run commands on salt minions. Salt users who follow fundamental internet security guidelines and best practices are not affected by this vulnerability. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-11651


KEV entry: Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability | Affected: Apache / Solr | Description: The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-17558


KEV entry: Microsoft Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-7255


KEV entry: Google Chromium V8 Incorrect Implementation Vulnerabililty | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-16013


KEV entry: Oracle WebLogic Server Remote Code Execution Vulnerability | Affected: Oracle / WebLogic Server | Description: Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-14882


KEV entry: Apple Multiple Products Type Confusion Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-27932


KEV entry: Adobe ColdFusion Unrestricted File Upload Vulnerability | Affected: Adobe / ColdFusion | Description: Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-15961


KEV entry: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Affected: Microsoft / Internet Explorer | Description: Microsoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-1367


KEV entry: SonicWall SSLVPN SMA100 SQL Injection Vulnerability | Affected: SonicWall / SSLVPN SMA100 | Description: SonicWall SSLVPN SMA100 contains a SQL injection vulnerability that allows remote exploitation for credential access by an unauthenticated attacker. | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-20016


KEV entry: Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability | Affected: Cisco / Small Business RV320 and RV325 Routers | Description: Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers contain improper access controls for URLs. Exploitation could allow an attacker to download the router configuration or detailed diagnostic information. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-1653


KEV entry: Cisco IOS XR Software DVMRP Memory Exhaustion Vulnerability | Affected: Cisco / IOS XR | Description: Cisco IOS XR Distance Vector Multicast Routing Protocol (DVMRP) incorrectly handles Internet Group Management Protocol (IGMP) packets. Exploitation could allow an unauthenticated, remote attacker to immediately crash the IGMP process or make it consume available memory and eventually crash. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-3569


KEV entry: Netis WF2419 Devices Remote Code Execution Vulnerability | Affected: Netis / WF2419 Devices | Description: Netis WF2419 devices contains an unspecified vulnerability that allows an attacker to perform remote code execution as root through the router's web management page. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-19356


KEV entry: Apple Multiple Products WebKit Integer Overflow Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain an integer overflow vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-30663


KEV entry: Microsoft Office Memory Corruption Vulnerability | Affected: Microsoft / Office | Description: Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-0798


KEV entry: IBM Data Risk Manager Directory Traversal Vulnerability | Affected: IBM / Data Risk Manager | Description: IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker to traverse directories and send a specially crafted URL request to download arbitrary files from the system. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-4430


KEV entry: Arcadyan Buffalo Firmware Path Traversal Vulnerability | Affected: Arcadyan / Buffalo Firmware | Description: Arcadyan Buffalo firmware contains a path traversal vulnerability that could allow unauthenticated, remote attackers to bypass authentication and access sensitive information. This vulnerability affects multiple routers across several different vendors. | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-20090


KEV entry: Microsoft Office Memory Corruption Vulnerability | Affected: Microsoft / Office | Description: Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-1641


KEV entry: Microsoft Windows CryptoAPI Spoofing Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): Reference CISA's ED 20-02 (https://www.cisa.gov/news-events/directives/ed-20-02-mitigate-windows-vulnerabilities-january-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-02. https://nvd.nist.gov/vuln/detail/CVE-2020-0601


KEV entry: Microsoft Windows Print Spooler Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-1675


KEV entry: Ivanti Pulse Connect Secure Code Execution Vulnerability | Affected: Ivanti / Pulse Connect Secure | Description: Pulse Connect Secure contains an unspecified vulnerability that allows an authenticated attacker to perform code execution using uncontrolled gzip extraction. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2020-8260


KEV entry: Apache Struts Remote Code Execution Vulnerability | Affected: Apache / Struts | Description: Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace.  Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-11776


KEV entry: Android Kernel Out-of-Bounds Write Vulnerability | Affected: Android / Android Kernel | Description: Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain "AbstractEmu." | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-0041


KEV entry: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Affected: Microsoft / Internet Explorer | Description: Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-1429


KEV entry: Ivanti Pulse Connect Secure Code Execution Vulnerability | Affected: Ivanti / Pulse Connect Secure | Description: Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2020-8243


KEV entry: vBulletin PHP Module Remote Code Execution Vulnerability | Affected: vBulletin / vBulletin | Description: The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-17496


KEV entry: Multiple VMware Products Command Injection Vulnerability | Affected: VMware / Multiple Products | Description: VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-4006


KEV entry: Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability | Affected: Microsoft / Open Management Infrastructure (OMI) | Description: Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-38647


KEV entry: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | Affected: Microsoft / Open Management Infrastructure (OMI) | Description: Microsoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2021-11-17 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-38648