CISA Known Exploited Vulnerabilities Catalog
7.8
CVE-2021-25487 - Samsung Mobile Devices Out-of-Bounds Read Vulnerability -
Action Due Jul 20, 2023 Target Vendor : Samsung
Description : Samsung mobile devices contain an out-of-bounds read vulnerability within the modem interface driver due to a lack of boundary checking of a buffer in set_skb_priv(), leading to remote code execution by dereference of an invalid function pointer.
Action : Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10
5.5
CVE-2021-25489 - Samsung Mobile Devices Improper Input Validation Vulnerability -
Action Due Jul 20, 2023 Target Vendor : Samsung
Description : Samsung mobile devices contain an improper input validation vulnerability within the modem interface driver that results in a format string bug leading to kernel panic.
Action : Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=10
6.4
CVE-2021-25394 - Samsung Mobile Devices Race Condition Vulnerability -
Action Due Jul 20, 2023 Target Vendor : Samsung
Description : Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.
Action : Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5
6.4
CVE-2021-25395 - Samsung Mobile Devices Race Condition Vulnerability -
Action Due Jul 20, 2023 Target Vendor : Samsung
Description : Samsung mobile devices contain a race condition vulnerability within the MFC charger driver that leads to a use-after-free allowing for a write given a radio privilege is compromised.
Action : Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=5
6.7
CVE-2021-25371 - Samsung Mobile Devices Unspecified Vulnerability -
Action Due Jul 20, 2023 Target Vendor : Samsung
Description : Samsung mobile devices contain an unspecified vulnerability within DSP driver that allows attackers to load ELF libraries inside DSP.
Action : Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=3
6.7
CVE-2021-25372 - Samsung Mobile Devices Improper Boundary Check Vulnerability -
Action Due Jul 20, 2023 Target Vendor : Samsung
Description : Samsung mobile devices contain an improper boundary check vulnerability within DSP driver that allows for out-of-bounds memory access.
Action : Apply updates per vendor instructions or discontinue use of the product if updates are unavailable
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://security.samsungmobile.com/securityUpdate.smsb?year=2021&month=3
7.8
CVE-2023-32434 - Apple Multiple Products Integer Overflow Vulnerability -
Action Due Jul 14, 2023 Target Vendor : Apple
Description : Apple iOS. iPadOS, macOS, and watchOS contain an integer overflow vulnerability that could allow an application to execute code with kernel privileges.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://support.apple.com/en-us/HT213808, https://support.apple.com/en-us/HT213812, https://support.apple.com/en-us/HT213809, https://support.apple.com/en-us/HT213810, https://support.apple.com/en-us/HT213813, https://support.apple.com/en-us/HT213811, https://support.apple.com/en-us/HT213814
8.8
CVE-2023-32435 - Apple Multiple Products WebKit Memory Corruption Vulnerability -
Action Due Jul 14, 2023 Target Vendor : Apple
Description : Apple iOS, iPadOS, macOS, and Safari WebKit contain a memory corruption vulnerability that leads to code execution when processing web content.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://support.apple.com/en-us/HT213670, https://support.apple.com/en-us/HT213671, https://support.apple.com/en-us/HT213676, https://support.apple.com/en-us/HT213811
8.8
CVE-2023-32439 - Apple Multiple Products WebKit Type Confusion Vulnerability -
Action Due Jul 14, 2023 Target Vendor : Apple
Description : Apple iOS, iPadOS, macOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://support.apple.com/en-us/HT213813, https://support.apple.com/en-us/HT213811, https://support.apple.com/en-us/HT213814, https://support.apple.com/en-us/HT213816
3.9
CVE-2023-20867 - VMware Tools Authentication Bypass Vulnerability -
Action Due Jul 14, 2023 Target Vendor : VMware
Description : VMware Tools contains an authentication bypass vulnerability in the vgauth module. A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. An attacker must have root access over ESXi to exploit this vulnerability.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.vmware.com/security/advisories/VMSA-2023-0013.html
9.8
CVE-2023-27992 - Zyxel Multiple NAS Devices Command Injection Vulnerability -
Action Due Jul 14, 2023 Target Vendor : Zyxel
Description : Multiple Zyxel network-attached storage (NAS) devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products
9.8
CVE-2023-20887 - Vmware Aria Operations for Networks Command Injection Vulnerability -
Action Due Jul 13, 2023 Target Vendor : VMware
Description : VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.vmware.com/security/advisories/VMSA-2023-0012.html
6.1
CVE-2020-35730 - Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability -
Action Due Jul 13, 2023 Target Vendor : Roundcube
Description : Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://roundcube.net/news/2020/12/27/security-updates-1.4.10-1.3.16-and-1.2.13
9.8
CVE-2020-12641 - Roundcube Webmail Remote Code Execution Vulnerability -
Action Due Jul 13, 2023 Target Vendor : Roundcube
Description : Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://roundcube.net/news/2020/04/29/security-updates-1.4.4-1.3.11-and-1.2.10
9.8
CVE-2021-44026 - Roundcube Webmail SQL Injection Vulnerability -
Action Due Jul 13, 2023 Target Vendor : Roundcube
Description : Roundcube Webmail is vulnerable to SQL injection via search or search_params.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released
7.5
CVE-2016-9079 - Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability -
Action Due Jul 13, 2023 Target Vendor : Mozilla
Description : Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/#CVE-2016-9079
7.8
CVE-2016-0165 - Microsoft Win32k Privilege Escalation Vulnerability -
Action Due Jul 13, 2023 Target Vendor : Microsoft
Description : Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-039
9.8
CVE-2023-27997 - Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability -
Action Due Jul 04, 2023 Target Vendor : Fortinet
Description : Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.fortiguard.com/psirt/FG-IR-23-097
8.8
CVE-2023-3079 - Google Chromium V8 Type Confusion Vulnerability -
Action Due Jun 28, 2023 Target Vendor : Google
Description : Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://chromereleases.googleblog.com/2023/06/stable-channel-update-for-desktop.html
9.8
CVE-2023-33009 - Zyxel Multiple Firewalls Buffer Overflow Vulnerability -
Action Due Jun 26, 2023 Target Vendor : Zyxel
Description : Zyxel ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, and ZyWALL/USG firewalls contain a buffer overflow vulnerability in the notification function that could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and remote code execution on an affected device.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-buffer-overflow-vulnerabilities-of-firewalls