CISA Known Exploited Vulnerabilities (KEV)

CVE-2019-5786 - Google Chrome Blink Use-After-Free Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Google

Description : Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-5786

CVE-2019-0880 - Microsoft Windows Privilege Escalation Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Microsoft

Description : A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-0880

CVE-2019-13720 - Google Chrome WebAudio Use-After-Free Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Google

Description : Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-13720

CVE-2019-11707 - Mozilla Firefox and Thunderbird Type Confusion Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Mozilla

Description : Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-11707

CVE-2019-11708 - Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Mozilla

Description : Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-11708

CVE-2019-8720 - WebKitGTK Memory Corruption Vulnerability -

Action Due Jun 13, 2022 Target Vendor : WebKitGTK

Description : WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-8720

CVE-2019-1385 - Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Microsoft

Description : A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-1385

CVE-2019-1130 - Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Microsoft

Description : A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-1130

CVE-2018-5002 - Adobe Flash Player Stack-based Buffer Overflow Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Adobe

Description : Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.

Action : The impacted product is end-of-life and should be disconnected if still in use.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2018-5002

CVE-2022-20821 - Cisco IOS XR Open Port Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Cisco

Description : Cisco IOS XR software health check opens TCP port 6379 by default on activation. An attacker can connect to the Redis instance on the open port and allow access to the Redis instance that is running within the NOSi container.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2022-20821

CVE-2021-30883 - Apple Multiple Products Memory Corruption Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Apple

Description : Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-30883

CVE-2019-0703 - Microsoft Windows SMB Information Disclosure Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Microsoft

Description : An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-0703

CVE-2019-18426 - WhatsApp Cross-Site Scripting Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Meta Platforms

Description : A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-18426

CVE-2018-8589 - Microsoft Win32k Privilege Escalation Vulnerability -

Action Due Jun 13, 2022 Target Vendor : Microsoft

Description : A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2018-8589

CVE-2022-30525 - Zyxel Multiple Firewalls OS Command Injection Vulnerability -

Action Due Jun 06, 2022 Target Vendor : Zyxel

Description : A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2022-30525

CVE-2022-22947 - VMware Spring Cloud Gateway Code Injection Vulnerability -

Action Due Jun 06, 2022 Target Vendor : VMware

Description : Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2022-22947

CVE-2022-1388 - F5 BIG-IP Missing Authentication Vulnerability -

Action Due May 31, 2022 Target Vendor : F5

Description : F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2022-1388

CVE-2021-1789 - Apple Multiple Products Type Confusion Vulnerability -

Action Due May 25, 2022 Target Vendor : Apple

Description : A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-1789

CVE-2014-4113 - Microsoft Win32k Privilege Escalation Vulnerability -

Action Due May 25, 2022 Target Vendor : Microsoft

Description : Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2014-4113

CVE-2014-0322 - Microsoft Internet Explorer Use-After-Free Vulnerability -

Action Due May 25, 2022 Target Vendor : Microsoft

Description : Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2014-0322