CISA Known Exploited Vulnerabilities Catalog
9.8
CVE-2022-47986 - IBM Aspera Faspex Code Execution Vulnerability -
Action Due Mar 14, 2023 Target Vendor : IBM
Description : IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://exchange.xforce.ibmcloud.com/vulnerabilities/243512?_ga=2.189195179.1800390251.1676559338-700333034.1676325890
6.8
CVE-2022-41223 - Mitel MiVoice Connect Code Injection Vulnerability -
Action Due Mar 14, 2023 Target Vendor : Mitel
Description : The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008
6.8
CVE-2022-40765 - Mitel MiVoice Connect Command Injection Vulnerability -
Action Due Mar 14, 2023 Target Vendor : Mitel
Description : The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0007
9.8
CVE-2022-46169 - Cacti Command Injection Vulnerability -
Action Due Mar 09, 2023 Target Vendor : Cacti
Description : Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf
7.3
CVE-2023-21715 - Microsoft Office Publisher Security Feature Bypass Vulnerability -
Action Due Mar 07, 2023 Target Vendor : Microsoft
Description : Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21715
7.8
CVE-2023-23376 - Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability -
Action Due Mar 07, 2023 Target Vendor : Microsoft
Description : Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23376
8.8
CVE-2023-23529 - Apple Multiple Products WebKit Type Confusion Vulnerability -
Action Due Mar 07, 2023 Target Vendor : Apple
Description : WebKit in Apple iOS, MacOS, Safari and iPadOS contains a type confusion vulnerability that may lead to code execution.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://support.apple.com/en-us/HT213635, https://support.apple.com/en-us/HT213633, https://support.apple.com/en-us/HT213638
7.8
CVE-2023-21823 - Microsoft Windows Graphic Component Privilege Escalation Vulnerability -
Action Due Mar 07, 2023 Target Vendor : Microsoft
Description : Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21823
7.8
CVE-2015-2291 - Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability -
Action Due Mar 03, 2023 Target Vendor : Intel
Description : Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00051.html
7.5
CVE-2022-24990 - TerraMaster OS Remote Command Execution Vulnerability -
Action Due Mar 03, 2023 Target Vendor : TerraMaster
Description : TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://forum.terra-master.com/en/viewtopic.php?t=3030
7.2
CVE-2023-0669 - Fortra GoAnywhere MFT Remote Code Execution Vulnerability -
Action Due Mar 03, 2023 Target Vendor : Fortra
Description : Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://my.goanywhere.com/webclient/DownloadProductFiles.xhtml. Fortra users must have an account in order to login and access the patch.
9.8
CVE-2022-21587 - Oracle E-Business Suite Unspecified Vulnerability -
Action Due Feb 23, 2023 Target Vendor : Oracle
Description : Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://www.oracle.com/security-alerts/cpuoct2022.html
8.8
CVE-2023-22952 - Multiple SugarCRM Products Remote Code Execution Vulnerability -
Action Due Feb 23, 2023 Target Vendor : SugarCRM
Description : Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/
9.8
CVE-2017-11357 - Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability -
Action Due Feb 16, 2023 Target Vendor : Telerik
Description : Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/asyncupload-insecure-direct-object-reference
9.8
CVE-2022-47966 - Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability -
Action Due Feb 13, 2023 Target Vendor : Zoho
Description : Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html
9.8
CVE-2022-44877 - CWP Control Web Panel OS Command Injection Vulnerability -
Action Due Feb 07, 2023 Target Vendor : CWP
Description : CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://control-webpanel.com/changelog#1669855527714-450fb335-6194
9.8
CVE-2022-41080 - Microsoft Exchange Server Privilege Escalation Vulnerability -
Action Due Jan 31, 2023 Target Vendor : Microsoft
Description : Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41080
8.8
CVE-2023-21674 - Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability -
Action Due Jan 31, 2023 Target Vendor : Microsoft
Description : Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21674
8.8
CVE-2018-5430 - TIBCO JasperReports Server Information Disclosure Vulnerability -
Action Due Jan 19, 2023 Target Vendor : TIBCO
Description : TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430
6.5
CVE-2018-18809 - TIBCO JasperReports Library Directory Traversal Vulnerability -
Action Due Jan 19, 2023 Target Vendor : TIBCO
Description : TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809