CISA Known Exploited Vulnerabilities Catalog

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework.Y

    7.8

    CVSS31
    CVE-2018-19320 - GIGABYTE Multiple Products Unspecified Vulnerability -

    Action Due Nov 14, 2022 Target Vendor : GIGABYTE

    Description : The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Known

    Notes : https://www.gigabyte.com/Support/Security/1801

    Alert Date: Oct 24, 2022 | 697 days ago

    9.8

    CVSS31
    CVE-2022-41352 - Zimbra Collaboration (ZCS) Arbitrary File Upload Vulnerability -

    Action Due Nov 10, 2022 Target Vendor : Zimbra

    Description : Zimbra Collaboration (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://wiki.zimbra.com/wiki/Security_Center

    Alert Date: Oct 20, 2022 | 701 days ago

    8.8

    CVSS31
    CVE-2021-3493 - Linux Kernel Privilege Escalation Vulnerability -

    Action Due Nov 10, 2022 Target Vendor : Linux

    Description : The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7c03e2cda4a584cadc398e8f6641ca9988a39d52

    Alert Date: Oct 20, 2022 | 701 days ago

    9.8

    CVSS31
    CVE-2022-40684 - Fortinet Multiple Products Authentication Bypass Vulnerability -

    Action Due Nov 01, 2022 Target Vendor : Fortinet

    Description : Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Known

    Notes : https://www.fortiguard.com/psirt/FG-IR-22-377

    Alert Date: Oct 11, 2022 | 710 days ago

    7.8

    CVSS31
    CVE-2022-41033 - Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability -

    Action Due Nov 01, 2022 Target Vendor : Microsoft

    Description : Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41033

    Alert Date: Oct 11, 2022 | 710 days ago

    8.0

    CVSS31
    CVE-2022-41082 - Microsoft Exchange Server Remote Code Execution Vulnerability -

    Action Due Oct 21, 2022 Target Vendor : Microsoft

    Description : Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Known

    Notes : https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/

    Alert Date: Sep 30, 2022 | 721 days ago

    8.8

    CVSS31
    CVE-2022-41040 - Microsoft Exchange Server Server-Side Request Forgery Vulnerability -

    Action Due Oct 21, 2022 Target Vendor : Microsoft

    Description : Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Known

    Notes : https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/

    Alert Date: Sep 30, 2022 | 721 days ago

    8.8

    CVSS31
    CVE-2022-36804 - Atlassian Bitbucket Server and Data Center Command Injection Vulnerability -

    Action Due Oct 21, 2022 Target Vendor : Atlassian

    Description : Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://jira.atlassian.com/browse/BSERV-13438

    Alert Date: Sep 30, 2022 | 721 days ago

    9.8

    CVSS31
    CVE-2022-3236 - Sophos Firewall Code Injection Vulnerability -

    Action Due Oct 14, 2022 Target Vendor : Sophos

    Description : A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce

    Alert Date: Sep 23, 2022 | 728 days ago

    9.8

    CVSS31
    CVE-2022-35405 - Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability -

    Action Due Oct 13, 2022 Target Vendor : Zoho

    Description : Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html

    Alert Date: Sep 22, 2022 | 729 days ago

    7.2

    CVSS31
    CVE-2022-40139 - Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability -

    Action Due Oct 06, 2022 Target Vendor : Trend Micro

    Description : Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://success.trendmicro.com/dcx/s/solution/000291528?language=en_US

    Alert Date: Sep 15, 2022 | 736 days ago

    7.2

    CVSS2
    CVE-2013-6282 - Linux Kernel Improper Input Validation Vulnerability -

    Action Due Oct 06, 2022 Target Vendor : Linux

    Description : The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8404663f81d212918ff85f493649a7991209fa04

    Alert Date: Sep 15, 2022 | 736 days ago

    7.2

    CVSS2
    CVE-2013-2597 - Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability -

    Action Due Oct 06, 2022 Target Vendor : Code Aurora

    Description : The Code Aurora audio calibration database (acdb) audio driver contains a stack-based buffer overflow vulnerability that allows for privilege escalation. Code Aurora is used in third-party products such as Qualcomm and Android.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://web.archive.org/web/20161226013354/https:/www.codeaurora.org/news/security-advisories/stack-based-buffer-overflow-acdb-audio-driver-cve-2013-2597

    Alert Date: Sep 15, 2022 | 736 days ago

    7.8

    CVSS31
    CVE-2013-2596 - Linux Kernel Integer Overflow Vulnerability -

    Action Due Oct 06, 2022 Target Vendor : Linux

    Description : Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fc9bbca8f650e5f738af8806317c0a041a48ae4a

    Alert Date: Sep 15, 2022 | 736 days ago

    7.2

    CVSS2
    CVE-2013-2094 - Linux Kernel Privilege Escalation Vulnerability -

    Action Due Oct 06, 2022 Target Vendor : Linux

    Description : Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8176cced706b5e5d15887584150764894e94e02f

    Alert Date: Sep 15, 2022 | 736 days ago

    7.8

    CVSS31
    CVE-2010-2568 - Microsoft Windows Remote Code Execution Vulnerability -

    Action Due Oct 06, 2022 Target Vendor : Microsoft

    Description : Microsoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-046

    Alert Date: Sep 15, 2022 | 736 days ago

    7.8

    CVSS31
    CVE-2022-37969 - Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability -

    Action Due Oct 05, 2022 Target Vendor : Microsoft

    Description : Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-37969

    Alert Date: Sep 14, 2022 | 737 days ago

    7.8

    CVSS31
    CVE-2022-32917 - Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability -

    Action Due Oct 05, 2022 Target Vendor : Apple

    Description : Apple kernel, which is included in iOS, iPadOS, and macOS, contains an unspecified vulnerability where an application may be able to execute code with kernel privileges.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://support.apple.com/en-us/HT213445, https://support.apple.com/en-us/HT213444

    Alert Date: Sep 14, 2022 | 737 days ago

    9.6

    CVSS31
    CVE-2022-3075 - Google Chromium Mojo Insufficient Data Validation Vulnerability -

    Action Due Sep 29, 2022 Target Vendor : Google

    Description : Google Chromium Mojo contains an insufficient data validation vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Unknown

    Notes : https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html, https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-3075

    Alert Date: Sep 08, 2022 | 743 days ago

    10.0

    CVSS31
    CVE-2022-27593 - QNAP Photo Station Externally Controlled Reference Vulnerability -

    Action Due Sep 29, 2022 Target Vendor : QNAP

    Description : Certain QNAP NAS running Photo Station with internet exposure contain an externally controlled reference to a resource vulnerability which can allow an attacker to modify system files. This vulnerability was observed being utilized in a Deadbolt ransomware campaign.

    Action : Apply updates per vendor instructions.

    Known To Be Used in Ransomware Campaigns? : Known

    Notes : https://www.qnap.com/en/security-advisory/qsa-22-24

    Alert Date: Sep 08, 2022 | 743 days ago
Showing 20 of 1180 Results

Filters