KEV entry: Linux Kernel Privilege Escalation Vulnerability | Affected: Linux / Kernel | Description: The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52; https://nvd.nist.gov/vuln/detail/CVE-2021-3493


KEV entry: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | Affected: Synacor / Zimbra Collaboration Suite (ZCS) | Description: Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-10 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://wiki.zimbra.com/wiki/Security_Center;  https://nvd.nist.gov/vuln/detail/CVE-2022-41352

CISA Known Exploited Vulnerabilities Catalog


KEV entry: Fortinet Multiple Products Authentication Bypass Vulnerability | Affected: Fortinet / Multiple Products | Description: Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-01 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.fortiguard.com/psirt/FG-IR-22-377;  https://nvd.nist.gov/vuln/detail/CVE-2022-40684


KEV entry: Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability | Affected: Microsoft / Windows COM+ Event System Service | Description: Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-11-01 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41033;  https://nvd.nist.gov/vuln/detail/CVE-2022-41033


KEV entry: Microsoft Exchange Server Server-Side Request Forgery Vulnerability | Affected: Microsoft / Exchange Server | Description: Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-21 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/;  https://nvd.nist.gov/vuln/detail/CVE-2022-41040


KEV entry: Atlassian Bitbucket Server and Data Center Command Injection Vulnerability | Affected: Atlassian / Bitbucket Server and Data Center | Description: Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-21 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://jira.atlassian.com/browse/BSERV-13438;  https://nvd.nist.gov/vuln/detail/CVE-2022-36804


KEV entry: Microsoft Exchange Server Remote Code Execution Vulnerability | Affected: Microsoft / Exchange Server | Description: Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-21 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/;  https://nvd.nist.gov/vuln/detail/CVE-2022-41082


KEV entry: Sophos Firewall Code Injection Vulnerability | Affected: Sophos / Firewall | Description: A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce;  https://nvd.nist.gov/vuln/detail/CVE-2022-3236


KEV entry: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | Affected: Zoho / ManageEngine | Description: Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-35405


KEV entry: Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability | Affected: Trend Micro / Apex One and Apex One as a Service | Description: Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-06 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://success.trendmicro.com/dcx/s/solution/000291528?language=en_US;  https://nvd.nist.gov/vuln/detail/CVE-2022-40139


KEV entry: Linux Kernel Improper Input Validation Vulnerability | Affected: Linux / Kernel | Description: The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-06 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8404663f81d212918ff85f493649a7991209fa04; https://nvd.nist.gov/vuln/detail/CVE-2013-6282


KEV entry: Linux Kernel Integer Overflow Vulnerability | Affected: Linux / Kernel | Description: Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-06 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fc9bbca8f650e5f738af8806317c0a041a48ae4a; https://nvd.nist.gov/vuln/detail/CVE-2013-2596


KEV entry: Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability | Affected: Code Aurora / ACDB Audio Driver | Description: The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability that allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-06 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://web.archive.org/web/20161226013354/https:/www.codeaurora.org/news/security-advisories/stack-based-buffer-overflow-acdb-audio-driver-cve-2013-2597; https://nvd.nist.gov/vuln/detail/CVE-2013-2597


KEV entry: Linux Kernel Privilege Escalation Vulnerability | Affected: Linux / Kernel | Description: Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-06 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8176cced706b5e5d15887584150764894e94e02f; https://nvd.nist.gov/vuln/detail/CVE-2013-2094


KEV entry: Microsoft Windows Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-06 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046; https://nvd.nist.gov/vuln/detail/CVE-2010-2568


KEV entry: Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability | Affected: Apple / iOS, iPadOS, and macOS | Description: Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-05 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT213445, https://support.apple.com/en-us/HT213444;  https://nvd.nist.gov/vuln/detail/CVE-2022-32917


KEV entry: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-10-05 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-37969;  https://nvd.nist.gov/vuln/detail/CVE-2022-37969


KEV entry: D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability | Affected: D-Link / DIR-300 Router | Description: The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-09-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.dlink.com/uk/en/support/product/dir-300-wireless-g-router; https://nvd.nist.gov/vuln/detail/CVE-2011-4723


KEV entry: Fortinet FortiOS and FortiADC Improper Access Control Vulnerability | Affected: Fortinet / FortiOS and FortiADC | Description: Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-29 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.fortiguard.com/psirt/FG-IR-18-157; https://nvd.nist.gov/vuln/detail/CVE-2018-13374


KEV entry: D-Link Multiple Routers OS Command Injection Vulnerability | Affected: D-Link / Multiple Routers | Description: Multiple D-Link routers contain an unspecified vulnerability that allows for execution of OS commands. | Required action: The vendor D-Link published an advisory stating the fix under CVE-2018-20114 properly patches KEV entry CVE-2018-6530. If the device is still supported, apply updates per vendor instructions. If the affected device has since entered its end-of-life, it should be disconnected if still in use. | Due date: 2022-09-29 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10105; https://nvd.nist.gov/vuln/detail/CVE-2018-6530


KEV entry: Google Chromium Mojo Insufficient Data Validation Vulnerability | Affected: Google / Chromium Mojo | Description: Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-3075;  https://nvd.nist.gov/vuln/detail/CVE-2022-3075


KEV entry: D-Link DIR-820L Remote Code Execution Vulnerability | Affected: D-Link / DIR-820L | Description: D-Link DIR-820L contains an unspecified vulnerability in Device Name parameter in /lan.asp which allows for remote code execution. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-09-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10295;  https://nvd.nist.gov/vuln/detail/CVE-2022-26258


KEV entry: Apple iOS, iPadOS, and macOS Input Validation Vulnerability | Affected: Apple / iOS, iPadOS, and macOS | Description: Apple iOS, iPadOS, and macOS contain an unspecified vulnerability involving input validation which can allow a local attacker to view sensitive user information. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT211288, https://support.apple.com/en-us/HT211289; https://nvd.nist.gov/vuln/detail/CVE-2020-9934


KEV entry: Oracle WebLogic Server Unspecified Vulnerability | Affected: Oracle / WebLogic Server | Description: Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.oracle.com/security-alerts/cpuapr2018.html; https://nvd.nist.gov/vuln/detail/CVE-2018-2628


KEV entry: Android OS Privilege Escalation Vulnerability | Affected: Android / Android OS | Description: The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://android.googlesource.com/platform/system/vold/+/c51920c82463b240e2be0430849837d6fdc5352e; https://nvd.nist.gov/vuln/detail/CVE-2011-1823


KEV entry: MikroTik RouterOS Stack-Based Buffer Overflow Vulnerability | Affected: MikroTik / RouterOS | Description: In MikroTik RouterOS, a stack-based buffer overflow occurs when processing NetBIOS session request messages. Remote attackers with access to the service can exploit this vulnerability and gain code execution on the system. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.coresecurity.com/core-labs/advisories/mikrotik-routeros-smb-buffer-overflow#vendor_update, https://mikrotik.com/download; https://nvd.nist.gov/vuln/detail/CVE-2018-7445


KEV entry: NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability | Affected: NETGEAR / Multiple Devices | Description: Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server. | Required action: Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use. | Due date: 2022-09-29 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability; https://nvd.nist.gov/vuln/detail/CVE-2017-5521


KEV entry: QNAP Photo Station Externally Controlled Reference Vulnerability | Affected: QNAP / Photo Station | Description: Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-29 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.qnap.com/en/security-advisory/qsa-22-24;  https://nvd.nist.gov/vuln/detail/CVE-2022-27593


KEV entry: Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability | Affected: Apple / iOS, macOS, watchOS | Description: In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-us/HT212804, https://support.apple.com/en-us/HT212805, https://support.apple.com/en-us/HT212806, https://support.apple.com/en-us/HT212807, https://support.apple.com/en-us/HT212824; https://nvd.nist.gov/vuln/detail/CVE-2021-31010


KEV entry: WebRTC Heap Buffer Overflow Vulnerability | Affected: WebRTC / WebRTC | Description: WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://groups.google.com/g/discuss-webrtc/c/5KBtZx2gvcQ;  https://nvd.nist.gov/vuln/detail/CVE-2022-2294


KEV entry: PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability | Affected: PEAR / Archive_Tar | Description: PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://pear.php.net/bugs/bug.php?id=27002, https://www.drupal.org/sa-core-2020-013, https://access.redhat.com/security/cve/cve-2020-28949; https://nvd.nist.gov/vuln/detail/CVE-2020-28949


KEV entry: Apache APISIX Authentication Bypass Vulnerability | Affected: Apache / APISIX | Description: Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94;  https://nvd.nist.gov/vuln/detail/CVE-2022-24112


KEV entry: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability | Affected: VMware Tanzu / Spring Cloud | Description: When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://tanzu.vmware.com/security/cve-2022-22963;  https://nvd.nist.gov/vuln/detail/CVE-2022-22963


KEV entry: Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability | Affected: Delta Electronics / DOPSoft 2 | Description: Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-09-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.cisa.gov/uscert/ics/advisories/icsa-21-252-02; https://nvd.nist.gov/vuln/detail/CVE-2021-38406


KEV entry: Apache CouchDB Insecure Default Initialization of Resource Vulnerability | Affected: Apache / CouchDB | Description: Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00;  https://nvd.nist.gov/vuln/detail/CVE-2022-24706


KEV entry: Grafana Authentication Bypass Vulnerability | Affected: Grafana Labs / Grafana | Description: Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/; https://nvd.nist.gov/vuln/detail/CVE-2021-39226


KEV entry: dotCMS Unrestricted Upload of File Vulnerability | Affected: dotCMS / dotCMS | Description: dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://www.dotcms.com/security/SI-62;  https://nvd.nist.gov/vuln/detail/CVE-2022-26352


KEV entry: PEAR Archive_Tar Improper Link Resolution Vulnerability | Affected: PEAR / Archive_Tar | Description: PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916, https://www.drupal.org/sa-core-2021-001, https://access.redhat.com/security/cve/cve-2020-36193; https://nvd.nist.gov/vuln/detail/CVE-2020-36193


KEV entry: Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability | Affected: Palo Alto Networks / PAN-OS | Description: A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-12 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.paloaltonetworks.com/CVE-2022-0028; https://nvd.nist.gov/vuln/detail/CVE-2022-0028


KEV entry: Apple iOS and macOS Out-of-Bounds Write Vulnerability | Affected: Apple / iOS and macOS | Description: Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-08 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-gb/HT213412, https://support.apple.com/en-gb/HT213413;  https://nvd.nist.gov/vuln/detail/CVE-2022-32893


KEV entry: Microsoft Windows Runtime Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-08 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21971;  https://nvd.nist.gov/vuln/detail/CVE-2022-21971


KEV entry: SAP Multiple Products HTTP Request Smuggling Vulnerability | Affected: SAP / Multiple Products | Description: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-08 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): SAP users must have an account in order to login and access the patch. https://accounts.sap.com/saml2/idp/sso;  https://nvd.nist.gov/vuln/detail/CVE-2022-22536


KEV entry: Google Chromium Intents Insufficient Input Validation Vulnerability | Affected: Google / Chromium Intents | Description: Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-08 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-2856


KEV entry: Apple iOS and macOS Out-of-Bounds Write Vulnerability | Affected: Apple / iOS and macOS | Description: Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-08 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://support.apple.com/en-gb/HT213412, https://support.apple.com/en-gb/HT213413;  https://nvd.nist.gov/vuln/detail/CVE-2022-32894


KEV entry: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability | Affected: Palo Alto Networks / PAN-OS | Description: Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-08 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://security.paloaltonetworks.com/CVE-2017-15944; https://nvd.nist.gov/vuln/detail/CVE-2017-15944


KEV entry: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | Affected: Microsoft / Active Directory | Description: An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-08 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-26923;  https://nvd.nist.gov/vuln/detail/CVE-2022-26923


KEV entry: Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability | Affected: Synacor / Zimbra Collaboration Suite (ZCS) | Description: Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-01 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/;  https://nvd.nist.gov/vuln/detail/CVE-2022-37042


KEV entry: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | Affected: Synacor / Zimbra Collaboration Suite (ZCS) | Description: Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-09-01 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/;  https://nvd.nist.gov/vuln/detail/CVE-2022-27925


KEV entry: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-30 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34713;  https://nvd.nist.gov/vuln/detail/CVE-2022-34713


KEV entry: RARLAB UnRAR Directory Traversal Vulnerability | Affected: RARLAB / UnRAR | Description: RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-30 | Known ransomware campaign use (KEV): Known | Notes (KEV): Vulnerability updated with version 6.12. Accessing link will download update information: https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz;  https://nvd.nist.gov/vuln/detail/CVE-2022-30333


KEV entry: Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability | Affected: Synacor / Zimbra Collaboration Suite (ZCS) | Description: Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-25 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24.1#Security_Fixes;  https://nvd.nist.gov/vuln/detail/CVE-2022-27924


KEV entry: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability | Affected: Atlassian / Confluence | Description: Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-19 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-26138


KEV entry: Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-08-02 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22047;  https://nvd.nist.gov/vuln/detail/CVE-2022-22047


KEV entry: Microsoft Windows LSA Spoofing Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM. | Required action: Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch]. | Due date: 2022-07-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): WARNING: This update is required on all Microsoft Windows endpoints but if deployed to domain controllers without additional configuration changes the update breaks PIV/CAC authentication. Read CISA implementation guidance carefully before deploying to domain controllers.;  https://nvd.nist.gov/vuln/detail/CVE-2022-26925


KEV entry: Apple iOS and iPadOS Buffer Overflow Vulnerability | Affected: Apple / iOS and iPadOS | Description: Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-30983


KEV entry: Mitel MiVoice Connect Data Validation Vulnerability | Affected: Mitel / MiVoice Connect | Description: The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-18 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-29499


KEV entry: Apple Multiple Products Memory Corruption Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-9907


KEV entry: Apple Multiple Products Memory Corruption Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-4344


KEV entry: Apple Multiple Products Use-After-Free Vulnerability | Affected: Apple / Multiple Products | Description: A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-8605


KEV entry: Apple Multiple Products Memory Corruption Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-3837


KEV entry: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability | Affected: Red Hat / Polkit | Description: The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-4034


KEV entry: Google Chromium PopupBlocker Security Bypass Vulnerability | Affected: Google / Chromium PopupBlocker | Description: Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-18 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-30533


KEV entry: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application. | Required action: Apply updates per vendor instructions. | Due date: 2022-07-05 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-30190


KEV entry: SAP NetWeaver Information Disclosure Vulnerability | Affected: SAP / NetWeaver | Description: The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-30 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-2388


KEV entry: SAP NetWeaver Unrestricted File Upload Vulnerability | Affected: SAP / NetWeaver | Description: SAP NetWeaver contains a vulnerability that allows unrestricted file upload. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-30 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-38163


KEV entry: SAP NetWeaver SQL Injection Vulnerability | Affected: SAP / NetWeaver | Description: SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-30 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-2386


KEV entry: Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability | Affected: Adobe / Acrobat and Reader | Description: Adobe Acrobat and Reader contain a stack-based buffer overflow vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2010-2883


KEV entry: Google Chromium V8 Out-of-Bounds Read Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-1646


KEV entry: Microsoft Word Malformed Object Pointer Vulnerability | Affected: Microsoft / Word | Description: Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2006-2492


KEV entry: QNAP QTS Improper Input Validation Vulnerability | Affected: QNAP / QTS | Description: QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-7193


KEV entry: QNAP Photo Station Improper Access Control Vulnerability | Affected: QNAP / Photo Station | Description: QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-7192


KEV entry: NETGEAR Multiple Devices Buffer Overflow Vulnerability | Affected: NETGEAR / Multiple Devices | Description: Multiple NETGEAR devices contain a buffer overflow vulnerability that allows for authentication bypass and remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-6862


KEV entry: Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2012-0767


KEV entry: Google Chromium V8 Out-of-Bounds Write Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-17480


KEV entry: Adobe Flash Player Integer Overflow Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player contains an integer overflow vulnerability that allows remote attackers to execute code via malformed arguments. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2012-5054


KEV entry: Microsoft PowerPoint Buffer Overflow Vulnerability | Affected: Microsoft / PowerPoint | Description: Microsoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2010-2572


KEV entry: Google Chromium V8 Out-of-Bounds Write Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-5825


KEV entry: Adobe Acrobat and Reader Use-After-Free Vulnerability | Affected: Adobe / Acrobat and Reader | Description: Use-after-free vulnerability in Adobe Acrobat and Reader allows remote attackers to execute code via a crafted PDF file. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2009-4324


KEV entry: Microsoft Office Buffer Overflow Vulnerability | Affected: Microsoft / Office | Description: Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-1331


KEV entry: Adobe Flash Player Memory Corruption Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2010-1297


KEV entry: Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability | Affected: Cisco / RV Series Routers | Description: A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-15271


KEV entry: Microsoft Office Buffer Overflow Vulnerability | Affected: Microsoft / Office | Description: Microsoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2009-0563


KEV entry: Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability | Affected: Adobe / Reader and Acrobat | Description: The Universal 3D (U3D) component in Adobe Reader and Acrobat contains a memory corruption vulnerability which could allow remote attackers to execute code or cause denial-of-service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2011-2462


KEV entry: Microsoft XML Core Services Memory Corruption Vulnerability | Affected: Microsoft / XML Core Services | Description: Microsoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2012-1889


KEV entry: Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability | Affected: Adobe / Acrobat and Reader | Description: Adobe Acrobat and Reader contains an array boundary issue in Universal 3D (U3D) support that could lead to remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2009-3953


KEV entry: Microsoft Internet Explorer Use-After-Free Vulnerability | Affected: Microsoft / Internet Explorer | Description: Microsoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2012-4969


KEV entry: Google Chromium V8 Remote Code Execution Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-17463


KEV entry: Adobe Acrobat and Reader, Flash Player Unspecified Vulnerability | Affected: Adobe / Acrobat and Reader, Flash Player | Description: Adobe Acrobat and Reader and Adobe Flash Player allows remote attackers to execute code or cause denial-of-service (DoS). | Required action: For Adobe Acrobat and Reader, apply updates per vendor instructions. For Adobe Flash Player, the impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2009-1862


KEV entry: Adobe Acrobat and Reader Buffer Overflow Vulnerability | Affected: Adobe / Acrobat and Reader | Description: Adobe Acrobat and Reader contain a buffer overflow vulnerability that allows remote attackers to execute code via a PDF file with long arguments to unspecified JavaScript methods. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2007-5659


KEV entry: Adobe Acrobat and Reader Unspecified Vulnerability | Affected: Adobe / Acrobat and Reader | Description: Adobe Acrobat and Reader contains an unespecified vulnerability described as a design flaw which could allow a specially crafted file to be printed silently an arbitrary number of times. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2008-0655


KEV entry: Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2012-0151


KEV entry: Google Chromium V8 Type Confusion Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-5070


KEV entry: Google Chromium V8 Memory Corruption Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-5030


KEV entry: Adobe Flash Player Memory Corruption Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2012-0754


KEV entry: QNAP Photo Station Path Traversal Vulnerability | Affected: QNAP / Photo Station | Description: QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-7195


KEV entry: Adobe Acrobat and Reader Double Free Vulnerability | Affected: Adobe / Acrobat and Reader | Description: Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-4990


KEV entry: Microsoft Office Object Record Corruption Vulnerability | Affected: Microsoft / Office | Description: Microsoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2009-0557


KEV entry: Google Chromium V8 Integer Overflow Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-6065


KEV entry: Adobe Flash Player Unspecified Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2011-0609


KEV entry: Google Chromium V8 Out-of-Bounds Memory Vulnerability | Affected: Google / Chromium V8 | Description: Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-5198


KEV entry: QNAP Photo Station Path Traversal Vulnerability | Affected: QNAP / Photo Station | Description: QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-22 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-7194


KEV entry: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability | Affected: Atlassian / Confluence Server/Data Center | Description: Atlassian Confluence Server and Data Center contain a remote code execution vulnerability that allows for an unauthenticated attacker to perform remote code execution. | Required action: Immediately block all internet traffic to and from affected products AND apply the update per vendor instructions [https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html] OR remove the affected products by the due date on the right. Note: Once the update is successfully deployed, agencies can reassess the internet blocking rules. | Due date: 2022-06-06 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-26134


KEV entry: Adobe Flash Player Dereferenced Pointer Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-8439


KEV entry: Microsoft Windows TS WebProxy Directory Traversal Vulnerability | Affected: Microsoft / Windows | Description: Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-0016


KEV entry: Oracle Solaris Privilege Escalation Vulnerability | Affected: Oracle / Solaris | Description: Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-3010


KEV entry: Microsoft Silverlight Double Dereference Vulnerability | Affected: Microsoft / Silverlight | Description: Microsoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-0074


KEV entry: IBM InfoSphere BigInsights Invalid Input Vulnerability | Affected: IBM / InfoSphere BigInsights | Description: Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-3993


KEV entry: Adobe Flash Player and AIR Integer Overflow Vulnerability | Affected: Adobe / Flash Player and AIR | Description: Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code. | Required action: The impacted products are end-of-life and should be disconnected if still in use. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-1010


KEV entry: Microsoft Windows Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-4148


KEV entry: Adobe Flash Player and AIR Use-After-Free Vulnerability | Affected: Adobe / Flash Player and AIR | Description: Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code. | Required action: The impacted products are end-of-life and should be disconnected if still in use. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-0984


KEV entry: Microsoft Internet Explorer ASLR Bypass Vulnerability | Affected: Microsoft / Internet Explorer | Description: Microsoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-0071


KEV entry: Oracle JRE Unspecified Vulnerability | Affected: Oracle / Java Runtime Environment (JRE) | Description: Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2010-0840


KEV entry: Oracle JRE Sandbox Bypass Vulnerability | Affected: Oracle / Java Runtime Environment (JRE) | Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-0431


KEV entry: Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-3393


KEV entry: Red Hat JBoss Authentication Bypass Vulnerability | Affected: Red Hat / JBoss | Description: The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2010-0738


KEV entry: Microsoft Silverlight Runtime Remote Code Execution Vulnerability | Affected: Microsoft / Silverlight | Description: Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS). | Required action: The impacted products are end-of-life and should be disconnected if still in use. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-0034


KEV entry: Oracle JRE Remote Code Execution Vulnerability | Affected: Oracle / Java Runtime Environment (JRE) | Description: A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-0422


KEV entry: Microsoft Internet Explorer Memory Corruption Vulnerability | Affected: Microsoft / Internet Explorer | Description: Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-2425


KEV entry: Microsoft Internet Explorer Privilege Escalation Vulnerability | Affected: Microsoft / Internet Explorer | Description: Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-4123


KEV entry: Microsoft Windows Kernel Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: The kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-6175


KEV entry: Adobe Flash Player ASLR Bypass Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-0310


KEV entry: Microsoft Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: Win32k.sys in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges or cause denial-of-service (DoS). | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-2360


KEV entry: Oracle Fusion Middleware Unspecified Vulnerability | Affected: Oracle / Fusion Middleware | Description: Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2012-1710


KEV entry: Mozilla Firefox Security Feature Bypass Vulnerability | Affected: Mozilla / Firefox | Description: Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-4495


KEV entry: Microsoft IME Japanese Privilege Escalation Vulnerability | Affected: Microsoft / Input Method Editor (IME) Japanese | Description: Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-4077


KEV entry: Adobe Reader and Acrobat Sandbox Bypass Vulnerability | Affected: Adobe / Reader and Acrobat | Description: Adobe Reader and Acrobat on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-0546


KEV entry: Microsoft Windows Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-1671


KEV entry: Linux Kernel Privilege Escalation Vulnerability | Affected: Linux / Kernel | Description: The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-3153


KEV entry: Microsoft Internet Explorer Information Disclosure Vulnerability | Affected: Microsoft / Internet Explorer | Description: An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-7331


KEV entry: Microsoft Windows Mount Manager Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-1769


KEV entry: Red Hat JBoss Information Disclosure Vulnerability | Affected: Red Hat / JBoss | Description: Unauthenticated access to the JBoss Application Server Web Console (/web-console) is blocked by default. However, it was found that this block was incomplete, and only blocked GET and POST HTTP verbs. A remote attacker could use this flaw to gain access to sensitive information. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2010-1428


KEV entry: Microsoft Internet Explorer Privilege Escalation Vulnerability | Affected: Microsoft / Internet Explorer | Description: Microsoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-2817


KEV entry: Adobe Flash Player Integer Overflow Vulnerability | Affected: Adobe / Flash Player | Description: Integer overflow in Adobe Flash Player allows attackers to execute code. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2015-8651


KEV entry: Oracle JRE Unspecified Vulnerability | Affected: Oracle / Java Runtime Environment (JRE) | Description: Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-2423


KEV entry: Microsoft Windows Open Type Font Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-7256


KEV entry: Microsoft Silverlight Information Disclosure Vulnerability | Affected: Microsoft / Silverlight | Description: Microsoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-15 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2013-3896


KEV entry: QNAP NAS File Station Cross-Site Scripting Vulnerability | Affected: QNAP / Network Attached Storage (NAS) | Description: A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-19943


KEV entry: Microsoft Internet Explorer and Edge Information Disclosure Vulnerability | Affected: Microsoft / Internet Explorer and Edge | Description: An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-3351


KEV entry: Microsoft Internet Explorer Information Disclosure Vulnerability | Affected: Microsoft / Internet Explorer | Description: An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-0162


KEV entry: Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: The Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0005


KEV entry: QNAP NAS File Station Cross-Site Scripting Vulnerability | Affected: QNAP / Network Attached Storage (NAS) | Description: A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to inject malicious code. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-19953


KEV entry: Artifex Ghostscript Type Confusion Vulnerability | Affected: Artifex / Ghostscript | Description: Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-8291


KEV entry: Microsoft Windows Kernel Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-8611


KEV entry: Apple iOS Webkit Memory Corruption Vulnerability | Affected: Apple / iOS | Description: Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-4657


KEV entry: Microsoft Windows SMBv1 Information Disclosure Vulnerability | Affected: Microsoft / SMBv1 server | Description: The SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0147


KEV entry: QNAP NAS File Station Command Injection Vulnerability | Affected: QNAP / Network Attached Storage (NAS) | Description: A command injection vulnerability affecting QNAP NAS File Station could allow remote attackers to run commands. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-19949


KEV entry: Microsoft XML Core Services Information Disclosure Vulnerability | Affected: Microsoft / XML Core Services | Description: Microsoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0022


KEV entry: Kaseya VSA SQL Injection Vulnerability | Affected: Kaseya / Virtual System/Server Administrator (VSA) | Description: ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-18362


KEV entry: Apple iOS Memory Corruption Vulnerability | Affected: Apple / iOS | Description: A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-4656


KEV entry: Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability | Affected: Microsoft / Internet Explorer | Description: An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-3298


KEV entry: Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability | Affected: Cisco / Adaptive Security Appliance (ASA) | Description: A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-6367


KEV entry: Microsoft Windows Search Remote Code Execution Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-8543


KEV entry: Apple iOS Information Disclosure Vulnerability | Affected: Apple / iOS | Description: The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-4655


KEV entry: Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow Vulnerability | Affected: Cisco / Adaptive Security Appliance (ASA) | Description: A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute code. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2016-6366


KEV entry: Microsoft Internet Explorer Privilege Escalation Vulnerability | Affected: Microsoft / Internet Explorer | Description: A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0210


KEV entry: Microsoft Internet Explorer Memory Corruption Vulnerability | Affected: Microsoft / Internet Explorer | Description: Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-14 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2017-0149


KEV entry: Microsoft Windows Kernel Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-1027


KEV entry: Mozilla Firefox and Thunderbird Type Confusion Vulnerability | Affected: Mozilla / Firefox and Thunderbird | Description: Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-11707


KEV entry: Apple Multiple Products Memory Corruption Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-7286


KEV entry: Microsoft Windows SMB Information Disclosure Vulnerability | Affected: Microsoft / Windows | Description: An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-0703


KEV entry: Apple Multiple Products Memory Corruption Vulnerability | Affected: Apple / Multiple Products | Description: Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-30883


KEV entry: Adobe Flash Player Stack-based Buffer Overflow Vulnerability | Affected: Adobe / Flash Player | Description: Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-5002


KEV entry: Google Chrome WebAudio Use-After-Free Vulnerability | Affected: Google / Chrome WebAudio | Description: Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-13720


KEV entry: Microsoft Windows Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-0880


KEV entry: WhatsApp Cross-Site Scripting Vulnerability | Affected: Meta Platforms / WhatsApp | Description: A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-18426


KEV entry: Microsoft Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-8589


KEV entry: WebKitGTK Memory Corruption Vulnerability | Affected: WebKitGTK / WebKitGTK | Description: WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-8720


KEV entry: Android Kernel Use-After-Free Vulnerability | Affected: Android / Kernel | Description: Android kernel contains a use-after-free vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-1048


KEV entry: Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-1385


KEV entry: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability | Affected: Mozilla / Firefox and Thunderbird | Description: Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-11708


KEV entry: Android Kernel Race Condition Vulnerability | Affected: Android / Kernel | Description: Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-0920


KEV entry: Microsoft Update Notification Manager Privilege Escalation Vulnerability | Affected: Microsoft / Update Notification Manager | Description: Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2020-0638


KEV entry: Microsoft Internet Explorer Information Disclosure Vulnerability | Affected: Microsoft / Internet Explorer | Description: An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-0676


KEV entry: Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-1130


KEV entry: Cisco IOS XR Open Port Vulnerability | Affected: Cisco / IOS XR | Description: Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-20821


KEV entry: Apple iOS Memory Corruption Vulnerability | Affected: Apple / iOS | Description: Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-7287


KEV entry: Google Chrome Blink Use-After-Free Vulnerability | Affected: Google / Chrome Blink | Description: Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-13 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-5786


KEV entry: VMware Spring Cloud Gateway Code Injection Vulnerability | Affected: VMware / Spring Cloud Gateway | Description: Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-06 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-22947


KEV entry: Zyxel Multiple Firewalls OS Command Injection Vulnerability | Affected: Zyxel / Multiple Firewalls | Description: A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. | Required action: Apply updates per vendor instructions. | Due date: 2022-06-06 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-30525


KEV entry: F5 BIG-IP Missing Authentication Vulnerability | Affected: F5 / BIG-IP | Description: F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-31 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-1388


KEV entry: Microsoft Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-25 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-4113


KEV entry: Apple Multiple Products Type Confusion Vulnerability | Affected: Apple / Multiple Products | Description: A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-25 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-1789


KEV entry: Apple Multiple Products Type Confusion Vulnerability | Affected: Apple / Multiple Products | Description: A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-25 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-8506


KEV entry: OpenSSL Information Disclosure Vulnerability | Affected: OpenSSL / OpenSSL | Description: The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-25 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-0160


KEV entry: Microsoft Internet Explorer Use-After-Free Vulnerability | Affected: Microsoft / Internet Explorer | Description: Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-25 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2014-0322


KEV entry: Linux Kernel Privilege Escalation Vulnerability | Affected: Linux / Kernel | Description: Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of "Dirty Pipe." | Required action: Apply updates per vendor instructions. | Due date: 2022-05-16 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-0847


KEV entry: WSO2 Multiple Products Unrestrictive Upload of File Vulnerability | Affected: WSO2 / Multiple Products | Description: Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-16 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-29464


KEV entry: Jenkins Script Security Plugin Sandbox Bypass Vulnerability | Affected: Jenkins / Script Security Plugin | Description: Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-16 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2019-1003029


KEV entry: Microsoft Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-16 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-41357


KEV entry: Microsoft Win32k Privilege Escalation Vulnerability | Affected: Microsoft / Win32k | Description: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-16 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2021-40450


KEV entry: Microsoft Windows User Profile Service Privilege Escalation Vulnerability | Affected: Microsoft / Windows | Description: Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-16 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2022-26904