CISA Known Exploited Vulnerabilities (KEV)

CVE-2013-1675 - Mozilla Firefox Information Disclosure Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Mozilla

Description : Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2013-1675

CVE-2013-1347 - Microsoft Internet Explorer Remote Code Execution Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Microsoft

Description : This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2013-1347

CVE-2013-0641 - Adobe Reader Buffer Overflow Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Adobe

Description : A buffer overflow vulnerability exists in Adobe Reader which allows an attacker to perform remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2013-0641

CVE-2013-0640 - Adobe Reader and Acrobat Memory Corruption Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Adobe

Description : An memory corruption vulnerability exists in the acroform.dll in Adobe Reader that allows an attacker to perform remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2013-0640

CVE-2013-0632 - Adobe ColdFusion Authentication Bypass Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Adobe

Description : An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthorized user gaining administrative access.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2013-0632

CVE-2012-1856 - Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Microsoft

Description : The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2012-1856

CVE-2012-1723 - Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Oracle

Description : Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2012-1723

CVE-2012-1535 - Adobe Flash Player Arbitrary Code Execution Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Adobe

Description : Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code or cause a denial of service via crafted SWF content.

Action : The impacted product is end-of-life and should be disconnected if still in use.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2012-1535

CVE-2012-0507 - Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Oracle

Description : An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2012-0507

CVE-2011-1889 - Microsoft Forefront TMG Remote Code Execution Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Microsoft

Description : A remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2011-1889

CVE-2011-0611 - Adobe Flash Player Remote Code Execution Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Adobe

Description : Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.

Action : The impacted product is end-of-life and should be disconnected if still in use.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2011-0611

CVE-2010-3333 - Microsoft Office Stack-based Buffer Overflow Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Microsoft

Description : A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2010-3333

CVE-2010-0232 - Microsoft Windows Kernel Exception Handler Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Microsoft

Description : The kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2010-0232

CVE-2010-0188 - Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Adobe

Description : Unspecified vulnerability in Adobe Reader and Acrobat allows attackers to cause a denial of service or possibly execute arbitrary code.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2010-0188

CVE-2009-3129 - Microsoft Excel Featheader Record Memory Corruption Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Microsoft

Description : Microsoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2009-3129

CVE-2009-1123 - Microsoft Windows Improper Input Validation Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Microsoft

Description : The kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2009-1123

CVE-2008-3431 - Oracle VirtualBox Insufficient Input Validation Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Oracle

Description : An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2008-3431

CVE-2008-2992 - Adobe Reader and Acrobat Input Validation Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Adobe

Description : Adobe Acrobat and Reader contain an input validation issue in a JavaScript method that could potentially lead to remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2008-2992

CVE-2004-0210 - Microsoft Windows Privilege Escalation Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Microsoft

Description : A privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2004-0210

CVE-2002-0367 - Microsoft Windows Privilege Escalation Vulnerability -

Action Due Mar 24, 2022 Target Vendor : Microsoft

Description : smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2002-0367