CISA Known Exploited Vulnerabilities Catalog
9.8
CVE-2022-47966 - Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability -
Action Due Feb 13, 2023 Target Vendor : Zoho
Description : Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html; https://nvd.nist.gov/vuln/detail/CVE-2022-47966
9.8
CVE-2022-44877 - CWP Control Web Panel OS Command Injection Vulnerability -
Action Due Feb 07, 2023 Target Vendor : CWP
Description : CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://control-webpanel.com/changelog#1669855527714-450fb335-6194; https://nvd.nist.gov/vuln/detail/CVE-2022-44877
9.8
CVE-2022-41080 - Microsoft Exchange Server Privilege Escalation Vulnerability -
Action Due Jan 31, 2023 Target Vendor : Microsoft
Description : Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41080; https://nvd.nist.gov/vuln/detail/CVE-2022-41080
8.8
CVE-2023-21674 - Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability -
Action Due Jan 31, 2023 Target Vendor : Microsoft
Description : Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21674; https://nvd.nist.gov/vuln/detail/CVE-2023-21674
6.5
CVE-2018-18809 - TIBCO JasperReports Library Directory Traversal Vulnerability -
Action Due Jan 19, 2023 Target Vendor : TIBCO
Description : TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809; https://nvd.nist.gov/vuln/detail/CVE-2018-18809
8.8
CVE-2018-5430 - TIBCO JasperReports Server Information Disclosure Vulnerability -
Action Due Jan 19, 2023 Target Vendor : TIBCO
Description : TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430;https://nvd.nist.gov/vuln/detail/CVE-2018-5430
8.8
CVE-2022-42856 - Apple iOS Type Confusion Vulnerability -
Action Due Jan 04, 2023 Target Vendor : Apple
Description : Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://support.apple.com/en-us/HT213516; https://nvd.nist.gov/vuln/detail/CVE-2022-42856
5.4
CVE-2022-44698 - Microsoft Defender SmartScreen Security Feature Bypass Vulnerability -
Action Due Jan 03, 2023 Target Vendor : Microsoft
Description : Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698; https://nvd.nist.gov/vuln/detail/CVE-2022-44698
8.8
CVE-2022-26500 - Veeam Backup & Replication Remote Code Execution Vulnerability -
Action Due Jan 03, 2023 Target Vendor : Veeam
Description : The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://www.veeam.com/kb4288; https://nvd.nist.gov/vuln/detail/CVE-2022-26500
9.8
CVE-2022-26501 - Veeam Backup & Replication Remote Code Execution Vulnerability -
Action Due Jan 03, 2023 Target Vendor : Veeam
Description : The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://www.veeam.com/kb4288; https://nvd.nist.gov/vuln/detail/CVE-2022-26501
9.8
CVE-2022-42475 - Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability -
Action Due Jan 03, 2023 Target Vendor : Fortinet
Description : Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.fortiguard.com/psirt/FG-IR-22-398; https://nvd.nist.gov/vuln/detail/CVE-2022-42475
9.8
CVE-2022-27518 - Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability -
Action Due Jan 03, 2023 Target Vendor : Citrix
Description : Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.citrix.com/blogs/2022/12/13/critical-security-update-now-available-for-citrix-adc-citrix-gateway/; https://nvd.nist.gov/vuln/detail/CVE-2022-27518
8.8
CVE-2022-4262 - Google Chromium V8 Type Confusion Vulnerability -
Action Due Dec 26, 2022 Target Vendor : Google
Description : Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html; https://nvd.nist.gov/vuln/detail/CVE-2022-4262
9.8
CVE-2021-35587 - Oracle Fusion Middleware Unspecified Vulnerability -
Action Due Dec 19, 2022 Target Vendor : Oracle
Description : Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.oracle.com/security-alerts/cpujan2022.html; https://nvd.nist.gov/vuln/detail/CVE-2021-35587
9.6
CVE-2022-4135 - Google Chromium GPU Heap Buffer Overflow Vulnerability -
Action Due Dec 19, 2022 Target Vendor : Google
Description : Google Chromium GPU contains a heap buffer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html; https://nvd.nist.gov/vuln/detail/CVE-2022-4135
5.4
CVE-2022-41049 - Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability -
Action Due Dec 09, 2022 Target Vendor : Microsoft
Description : Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41049; https://nvd.nist.gov/vuln/detail/CVE-2022-41049
5.4
CVE-2022-41091 - Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability -
Action Due Dec 09, 2022 Target Vendor : Microsoft
Description : Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41091; https://nvd.nist.gov/vuln/detail/CVE-2022-41091
7.8
CVE-2022-41073 - Microsoft Windows Print Spooler Privilege Escalation Vulnerability -
Action Due Dec 09, 2022 Target Vendor : Microsoft
Description : Microsoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41073; https://nvd.nist.gov/vuln/detail/CVE-2022-41073
7.8
CVE-2022-41125 - Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability -
Action Due Dec 09, 2022 Target Vendor : Microsoft
Description : Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41125; https://nvd.nist.gov/vuln/detail/CVE-2022-41125
8.8
CVE-2022-41128 - Microsoft Windows Scripting Languages Remote Code Execution Vulnerability -
Action Due Dec 09, 2022 Target Vendor : Microsoft
Description : Microsoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.
Action : Apply updates per vendor instructions.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41128; https://nvd.nist.gov/vuln/detail/CVE-2022-41128