CISA Known Exploited Vulnerabilities (KEV)

CVE-2021-21975 - VMware Server Side Request Forgery in vRealize Operations Manager API -

Action Due Feb 01, 2022 Target Vendor : VMware

Description : Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-21975

CVE-2021-21315 - System Information Library for Node.JS Command Injection -

Action Due Feb 01, 2022 Target Vendor : Npm package

Description : In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-21315

CVE-2021-22991 - F5 BIG-IP Traffic Management Microkernel Buffer Overflow -

Action Due Feb 01, 2022 Target Vendor : F5

Description : The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-22991

CVE-2020-14864 - Oracle Business Intelligence Enterprise Edition Path Transversal -

Action Due Jul 18, 2022 Target Vendor : Oracle

Description : Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2020-14864

CVE-2020-13671 - Drupal core Un-restricted Upload of File -

Action Due Jul 18, 2022 Target Vendor : Drupal

Description : Improper sanitization in the extension file names is present in Drupal core.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2020-13671

CVE-2020-11978 - Apache Airflow Command Injection -

Action Due Jul 18, 2022 Target Vendor : Apache

Description : A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2020-11978

CVE-2021-32648 - October CMS Improper Authentication -

Action Due Feb 01, 2022 Target Vendor : October CMS

Description : In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-32648

CVE-2021-40870 - Aviatrix Controller Unrestricted Upload of File -

Action Due Feb 01, 2022 Target Vendor : Aviatrix

Description : Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-40870

CVE-2021-33766 - Microsoft Exchange Server Information Disclosure -

Action Due Feb 01, 2022 Target Vendor : Microsoft

Description : Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-33766

CVE-2020-13927 - Apache Airflow's Experimental API Authentication Bypass -

Action Due Jul 18, 2022 Target Vendor : Apache

Description : The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2020-13927

CVE-2021-22017 - VMware vCenter Server Improper Access Control -

Action Due Jan 24, 2022 Target Vendor : VMware

Description : Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-22017

CVE-2021-36260 - Hikvision Improper Input Validation -

Action Due Jan 24, 2022 Target Vendor : Hikvision

Description : A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2021-36260

CVE-2020-6572 - Google Chrome Media Prior to 81.0.4044.92 Use-After-Free Vulnerability -

Action Due Jul 10, 2022 Target Vendor : Google

Description : Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2020-6572

CVE-2019-1458 - Microsoft Win32k Privilege Escalation Vulnerability -

Action Due Jul 10, 2022 Target Vendor : Microsoft

Description : A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-1458

CVE-2013-3900 - Microsoft WinVerifyTrust function Remote Code Execution -

Action Due Jul 10, 2022 Target Vendor : Microsoft

Description : A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2013-3900

CVE-2019-2725 - Oracle WebLogic Server, Injection -

Action Due Jul 10, 2022 Target Vendor : Oracle

Description : Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-2725

CVE-2018-13382 - Fortinet FortiOS and FortiProxy Improper Authorization -

Action Due Jul 10, 2022 Target Vendor : Fortinet

Description : An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2018-13382

CVE-2018-13383 - Fortinet FortiOS and FortiProxy Out-of-bounds Write -

Action Due Jul 10, 2022 Target Vendor : Fortinet

Description : A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2018-13383

CVE-2019-1579 - Palo Alto Networks PAN-OS Remote Code Execution Vulnerability -

Action Due Jul 10, 2022 Target Vendor : Palo Alto Networks

Description : Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Known

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-1579

CVE-2019-10149 - Exim Mail Transfer Agent (MTA) Improper Input Validation -

Action Due Jul 10, 2022 Target Vendor : Exim

Description : Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

Action : Apply updates per vendor instructions.

Known To Be Used in Ransomware Campaigns? : Unknown

Notes : https://nvd.nist.gov/vuln/detail/CVE-2019-10149