CISA Known Exploited Vulnerabilities (KEV)

CVE-2023-23529 - Apple Multiple Products WebKit Type Confusion Vulnerability -

Action Due Mar 07, 2023 Target Vendor : Apple

Description : Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://support.apple.com/en-us/HT213635, https://support.apple.com/en-us/HT213633, https://support.apple.com/en-us/HT213638; https://nvd.nist.gov/vuln/detail/CVE-2023-23529

CVE-2015-2291 - Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability -

Action Due Mar 03, 2023 Target Vendor : Intel

Description : Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00051.html; https://nvd.nist.gov/vuln/detail/CVE-2015-2291

CVE-2022-24990 - TerraMaster OS Remote Command Execution Vulnerability -

Action Due Mar 03, 2023 Target Vendor : TerraMaster

Description : TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://forum.terra-master.com/en/viewtopic.php?t=3030; https://nvd.nist.gov/vuln/detail/CVE-2022-24990

CVE-2023-0669 - Fortra GoAnywhere MFT Remote Code Execution Vulnerability -

Action Due Mar 03, 2023 Target Vendor : Fortra

Description : Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : This CVE has a CISA AA located here: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a. Please see the AA for associated IOCs. Additional information is available at: https://my.goanywhere.com/webclient/DownloadProductFiles.xhtml. Fortra users must have an account in order to login and access the patch.; https://nvd.nist.gov/vuln/detail/CVE-2023-0669

CVE-2022-21587 - Oracle E-Business Suite Unspecified Vulnerability -

Action Due Feb 23, 2023 Target Vendor : Oracle

Description : Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://www.oracle.com/security-alerts/cpuoct2022.html; https://nvd.nist.gov/vuln/detail/CVE-2022-21587

CVE-2023-22952 - Multiple SugarCRM Products Remote Code Execution Vulnerability -

Action Due Feb 23, 2023 Target Vendor : SugarCRM

Description : Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/; https://nvd.nist.gov/vuln/detail/CVE-2023-22952

CVE-2017-11357 - Telerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability -

Action Due Feb 16, 2023 Target Vendor : Telerik

Description : Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://docs.telerik.com/devtools/aspnet-ajax/knowledge-base/asyncupload-insecure-direct-object-reference; https://nvd.nist.gov/vuln/detail/CVE-2017-11357

CVE-2022-47966 - Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability -

Action Due Feb 13, 2023 Target Vendor : Zoho

Description : Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html; https://nvd.nist.gov/vuln/detail/CVE-2022-47966

CVE-2022-44877 - CWP Control Web Panel OS Command Injection Vulnerability -

Action Due Feb 07, 2023 Target Vendor : CWP

Description : CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://control-webpanel.com/changelog#1669855527714-450fb335-6194; https://nvd.nist.gov/vuln/detail/CVE-2022-44877

CVE-2022-41080 - Microsoft Exchange Server Privilege Escalation Vulnerability -

Action Due Jan 31, 2023 Target Vendor : Microsoft

Description : Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41080; https://nvd.nist.gov/vuln/detail/CVE-2022-41080

CVE-2023-21674 - Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability -

Action Due Jan 31, 2023 Target Vendor : Microsoft

Description : Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21674; https://nvd.nist.gov/vuln/detail/CVE-2023-21674

CVE-2018-18809 - TIBCO JasperReports Library Directory Traversal Vulnerability -

Action Due Jan 19, 2023 Target Vendor : TIBCO

Description : TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://www.tibco.com/support/advisories/2019/03/tibco-security-advisory-march-6-2019-tibco-jasperreports-library-2018-18809; https://nvd.nist.gov/vuln/detail/CVE-2018-18809

CVE-2018-5430 - TIBCO JasperReports Server Information Disclosure Vulnerability -

Action Due Jan 19, 2023 Target Vendor : TIBCO

Description : TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-april-17-2018-tibco-jasperreports-2018-5430;https://nvd.nist.gov/vuln/detail/CVE-2018-5430

CVE-2022-42856 - Apple iOS Type Confusion Vulnerability -

Action Due Jan 04, 2023 Target Vendor : Apple

Description : Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://support.apple.com/en-us/HT213516; https://nvd.nist.gov/vuln/detail/CVE-2022-42856

CVE-2022-44698 - Microsoft Defender SmartScreen Security Feature Bypass Vulnerability -

Action Due Jan 03, 2023 Target Vendor : Microsoft

Description : Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698; https://nvd.nist.gov/vuln/detail/CVE-2022-44698

CVE-2022-26500 - Veeam Backup & Replication Remote Code Execution Vulnerability -

Action Due Jan 03, 2023 Target Vendor : Veeam

Description : The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://www.veeam.com/kb4288; https://nvd.nist.gov/vuln/detail/CVE-2022-26500

CVE-2022-26501 - Veeam Backup & Replication Remote Code Execution Vulnerability -

Action Due Jan 03, 2023 Target Vendor : Veeam

Description : The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://www.veeam.com/kb4288; https://nvd.nist.gov/vuln/detail/CVE-2022-26501

CVE-2022-42475 - Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability -

Action Due Jan 03, 2023 Target Vendor : Fortinet

Description : Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://www.fortiguard.com/psirt/FG-IR-22-398; https://nvd.nist.gov/vuln/detail/CVE-2022-42475

CVE-2022-27518 - Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability -

Action Due Jan 03, 2023 Target Vendor : Citrix

Description : Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://www.citrix.com/blogs/2022/12/13/critical-security-update-now-available-for-citrix-adc-citrix-gateway/; https://nvd.nist.gov/vuln/detail/CVE-2022-27518

CVE-2022-4262 - Google Chromium V8 Type Confusion Vulnerability -

Action Due Dec 26, 2022 Target Vendor : Google

Description : Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://chromereleases.googleblog.com/2022/12/stable-channel-update-for-desktop.html; https://nvd.nist.gov/vuln/detail/CVE-2022-4262