CISA Known Exploited Vulnerabilities Catalog
6.5
CVE-2021-30533 - Google Chromium PopupBlocker Security Bypass Vulnerability -
Action Due Jul 18, 2022 Target Vendor : Google
Description : Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
7.8
CVE-2021-4034 - Red Hat Polkit Out-of-Bounds Read and Write Vulnerability -
Action Due Jul 18, 2022 Target Vendor : Red Hat
Description : The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
7.8
CVE-2021-30983 - Apple iOS and iPadOS Buffer Overflow Vulnerability -
Action Due Jul 18, 2022 Target Vendor : Apple
Description : Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
7.8
CVE-2020-3837 - Apple Multiple Products Memory Corruption Vulnerability -
Action Due Jul 18, 2022 Target Vendor : Apple
Description : Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
7.8
CVE-2020-9907 - Apple Multiple Products Memory Corruption Vulnerability -
Action Due Jul 18, 2022 Target Vendor : Apple
Description : Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
7.8
CVE-2019-8605 - Apple Multiple Products Use-After-Free Vulnerability -
Action Due Jul 18, 2022 Target Vendor : Apple
Description : A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
7.8
CVE-2018-4344 - Apple Multiple Products Memory Corruption Vulnerability -
Action Due Jul 18, 2022 Target Vendor : Apple
Description : Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
7.8
CVE-2022-30190 - Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability -
Action Due Jul 05, 2022 Target Vendor : Microsoft
Description : A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
9.9
CVE-2021-38163 - SAP NetWeaver Unrestricted File Upload Vulnerability -
Action Due Jun 30, 2022 Target Vendor : SAP
Description : SAP NetWeaver contains a vulnerability that allows unrestricted file upload.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
9.8
CVE-2016-2386 - SAP NetWeaver SQL Injection Vulnerability -
Action Due Jun 30, 2022 Target Vendor : SAP
Description : SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
5.3
CVE-2016-2388 - SAP NetWeaver Information Disclosure Vulnerability -
Action Due Jun 30, 2022 Target Vendor : SAP
Description : The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
9.8
CVE-2019-7195 - QNAP Photo Station Path Traversal Vulnerability -
Action Due Jun 22, 2022 Target Vendor : QNAP
Description : QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
9.8
CVE-2019-7194 - QNAP Photo Station Path Traversal Vulnerability -
Action Due Jun 22, 2022 Target Vendor : QNAP
Description : QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
9.8
CVE-2019-7193 - QNAP QTS Improper Input Validation Vulnerability -
Action Due Jun 22, 2022 Target Vendor : QNAP
Description : QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
9.8
CVE-2019-7192 - QNAP Photo Station Improper Access Control Vulnerability -
Action Due Jun 22, 2022 Target Vendor : QNAP
Description : QNAP NAS devices running Photo Station contain an improper access control vulnerability allowing remote attackers to gain unauthorized access to the system.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
6.5
CVE-2019-5825 - Google Chromium V8 Out-of-Bounds Write Vulnerability -
Action Due Jun 22, 2022 Target Vendor : Google
Description : Google Chromium V8 Engine contains an out-of-bounds write vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
8.8
CVE-2019-15271 - Cisco RV Series Routers Deserialization of Untrusted Data Vulnerability -
Action Due Jun 22, 2022 Target Vendor : Cisco
Description : A deserialization of untrusted data vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an attacker to execute code with root privileges.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
8.8
CVE-2018-6065 - Google Chromium V8 Integer Overflow Vulnerability -
Action Due Jun 22, 2022 Target Vendor : Google
Description : Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
8.8
CVE-2018-4990 - Adobe Acrobat and Reader Double Free Vulnerability -
Action Due Jun 22, 2022 Target Vendor : Adobe
Description : Adobe Acrobat and Reader have a double free vulnerability that could lead to remote code execution.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
8.8
CVE-2018-17480 - Google Chromium V8 Out-of-Bounds Write Vulnerability -
Action Due Jun 22, 2022 Target Vendor : Google
Description : Google Chromium V8 Engine contains out-of-bounds write vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown