CISA Known Exploited Vulnerabilities (KEV)

CVE-2019-0752 - Microsoft Internet Explorer Type Confusion Vulnerability -

Action Due Aug 15, 2022 Target Vendor : Microsoft

Description : A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-0752

CVE-2018-8174 - Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability -

Action Due Aug 15, 2022 Target Vendor : Microsoft

Description : A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2018-8174

CVE-2018-20250 - WinRAR Absolute Path Traversal Vulnerability -

Action Due Aug 15, 2022 Target Vendor : RARLAB

Description : WinRAR Absolute Path Traversal vulnerability leads to Remote Code Execution

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2018-20250

CVE-2018-15982 - Adobe Flash Player Use-After-Free Vulnerability -

Action Due Aug 15, 2022 Target Vendor : Adobe

Description : Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability

Action : The impacted product is end-of-life and should be disconnected if still in use.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2018-15982

CVE-2014-1761 - Microsoft Word Memory Corruption Vulnerability -

Action Due Aug 15, 2022 Target Vendor : Microsoft

Description : Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2014-1761

CVE-2017-9841 - PHPUnit Command Injection Vulnerability -

Action Due Aug 15, 2022 Target Vendor : PHPUnit

Description : PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2017-9841

CVE-2013-3906 - Microsoft Graphics Component Memory Corruption Vulnerability -

Action Due Aug 15, 2022 Target Vendor : Microsoft

Description : Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2013-3906

CVE-2022-24086 - Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability -

Action Due Mar 01, 2022 Target Vendor : Adobe

Description : Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2022-24086

CVE-2022-22620 - Apple iOS, iPadOS, and macOS Webkit Use-After-Free Vulnerability -

Action Due Feb 25, 2022 Target Vendor : Apple

Description : Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2022-22620

CVE-2018-1000861 - Jenkins Stapler Web Framework Deserialization of Untrusted Data Vulnerability -

Action Due Aug 10, 2022 Target Vendor : Jenkins

Description : A code execution vulnerability exists in the Stapler web framework used by Jenkins

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2018-1000861

CVE-2017-9791 - Apache Struts 1 Improper Input Validation Vulnerability -

Action Due Aug 10, 2022 Target Vendor : Apache

Description : The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2017-9791

CVE-2017-8464 - Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability -

Action Due Aug 10, 2022 Target Vendor : Microsoft

Description : Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2017-8464

CVE-2017-10271 - Oracle Corporation WebLogic Server Remote Code Execution Vulnerability -

Action Due Aug 10, 2022 Target Vendor : Oracle

Description : Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2017-10271

CVE-2017-0263 - Microsoft Win32k Privilege Escalation Vulnerability -

Action Due Aug 10, 2022 Target Vendor : Microsoft

Description : Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2017-0263

CVE-2017-0262 - Microsoft Office Remote Code Execution Vulnerability -

Action Due Aug 10, 2022 Target Vendor : Microsoft

Description : A remote code execution vulnerability exists in Microsoft Office.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2017-0262

CVE-2017-0145 - Microsoft SMBv1 Remote Code Execution Vulnerability -

Action Due Aug 10, 2022 Target Vendor : Microsoft

Description : The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2017-0145

CVE-2017-0144 - Microsoft SMBv1 Remote Code Execution Vulnerability -

Action Due Aug 10, 2022 Target Vendor : Microsoft

Description : The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2017-0144

CVE-2016-3088 - Apache ActiveMQ Improper Input Validation Vulnerability -

Action Due Aug 10, 2022 Target Vendor : Apache

Description : The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2016-3088

CVE-2015-1635 - Microsoft HTTP.sys Remote Code Execution Vulnerability -

Action Due Aug 10, 2022 Target Vendor : Microsoft

Description : Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2015-1635

CVE-2015-1130 - Apple OS X Authentication Bypass Vulnerability -

Action Due Aug 10, 2022 Target Vendor : Apple

Description : The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2015-1130