Past incidents from 2024

Palo Alto Networks PAN-OS ✓Patched

Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. Added to the CISA KEV catalog on 2024-12-30.

Acclaim Systems USAHERDS ✓Patched

Acclaim Systems USAHERDS contains a hard-coded credentials vulnerability that could allow an attacker to achieve remote code execution on the system that runs the application. The MachineKey must be obtained via a separate vulnerability or other channel. Added to the CISA KEV catalog on 2024-12-23. CVE-2021-44207 was assigned before 2024; the KEV listing came in 2024.

NUUO NVRmini Devices ✕No patch yet

NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command. Added to the CISA KEV catalog on 2024-12-18. CVE-2018-14933 was assigned before 2024; the KEV listing came in 2024.

NUUO NVRmini2 Devices ✕No patch yet

NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users. Added to the CISA KEV catalog on 2024-12-18. CVE-2022-23227 was assigned before 2024; the KEV listing came in 2024.

Reolink RLC-410W IP Camera ◐Partly patched

Reolink RLC-410W IP cameras contain an authenticated OS command injection vulnerability in the device network settings functionality. Added to the CISA KEV catalog on 2024-12-18. CVE-2021-40407 was assigned before 2024; the KEV listing came in 2024.

Reolink Multiple IP Cameras ◐Partly patched

Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W IP cameras contain an authenticated OS command injection vulnerability. This vulnerability allows an authenticated admin to use the "TestEmail" functionality to inject and run OS commands as root. Added to the CISA KEV catalog on 2024-12-18. CVE-2019-11001 was assigned before 2024; the KEV listing came in 2024.

Microsoft Windows ✓Patched

Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges. Added to the CISA KEV catalog on 2024-12-10.

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) ✓Patched

Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.

ultralytics (PyPI) ✓Patched

Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable.

Cleo Multiple Products ✓Patched

Two unauthenticated file-write bugs in Cleo Harmony, VLTrader and LexiCom managed file transfer software (CVE-2024-50623 and CVE-2024-55956) were mass-exploited in December 2024 to plant a Java backdoor and steal data. Huntress saw exploitation from 2024-12-03 against systems already patched to 5.8.0.21; Cleo shipped 5.8.0.24 for the second bug. The Clop ransomware gang claimed the attacks. Added to the CISA KEV catalog on 2024-12-13, 2024-12-17. CISA lists known use in ransomware campaigns.

North Grid Proself ✓Patched

North Grid Proself Enterprise/Standard, Gateway, and Mail Sanitize contain an improper restriction of XML External Entity (XXE) reference vulnerability, which could allow a remote, unauthenticated attacker to conduct an XXE attack. Added to the CISA KEV catalog on 2024-12-03. CVE-2023-45727 was assigned before 2024; the KEV listing came in 2024.

@solana/web3.js (npm) ✓Patched

A publish-access account for @solana/web3.js was compromised. Malicious versions 1.95.6 and 1.95.7, live on npm from 15:20 to 20:25 UTC on 2024-12-03, exfiltrated private key material from apps and bots that handle keys directly. Non-custodial wallets were generally not affected. Fixed in 1.95.8.

Zyxel Multiple Firewalls ✓Patched

Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL. Added to the CISA KEV catalog on 2024-12-03. CISA lists known use in ransomware campaigns.

ProjectSend ✓Patched

ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript. Added to the CISA KEV catalog on 2024-12-03.

Array Networks AG/vxAG ArrayOS ✓Patched

Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway. Added to the CISA KEV catalog on 2024-11-25. CISA lists known use in ransomware campaigns. CVE-2023-28461 was assigned before 2024; the KEV listing came in 2024.

Apple Multiple Products ✓Patched

CVE-2024-44308: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to arbitrary code execution. CVE-2024-44309: Apple iOS, macOS, and other Apple products contain an unspecified vulnerability when processing maliciously crafted web content that may lead to a cross-site scripting (XSS) attack. Added to the CISA KEV catalog on 2024-11-21.

Palo Alto Networks PAN-OS ✓Patched

CVE-2024-0012: Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. CVE-2024-9474: Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. Added to the CISA KEV catalog on 2024-11-18. CISA lists known use in ransomware campaigns.

Oracle Agile Product Lifecycle Management (PLM) ✓Patched

Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure. Added to the CISA KEV catalog on 2024-11-21.

US telecommunications carriers –No fix needed

PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.

Metabase ✓Patched

Metabase contains a local file inclusion vulnerability in the custom map support in the API to read GeoJSON formatted data. Added to the CISA KEV catalog on 2024-11-12. CVE-2021-41277 was assigned before 2024; the KEV listing came in 2024.

Microsoft Windows ✓Patched

CVE-2024-43451: Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user. CVE-2024-49039: Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions. Added to the CISA KEV catalog on 2024-11-12. CISA lists known use in ransomware campaigns.

Atlassian Jira Server and Data Center ✓Patched

Atlassian Jira Server and Data Center contain a path traversal vulnerability that allows a remote attacker to read particular files in the /WEB-INF/web.xml endpoint. Added to the CISA KEV catalog on 2024-11-12. CVE-2021-26086 was assigned before 2024; the KEV listing came in 2024.

Cisco Adaptive Security Appliance (ASA) ✓Patched

Cisco Adaptive Security Appliance (ASA) contains a cross-site scripting (XSS) vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter. Added to the CISA KEV catalog on 2024-11-12. CVE-2014-2120 was assigned before 2024; the KEV listing came in 2024.

Nostromo nhttpd ✓Patched

Nostromo nhttpd contains a directory traversal vulnerability in the http_verify() function in a non-chrooted nhttpd server allowing for remote code execution. Added to the CISA KEV catalog on 2024-11-07. CVE-2019-16278 was assigned before 2024; the KEV listing came in 2024.

Android Framework ✓Patched

Android Framework contains an unspecified vulnerability that allows for privilege escalation. Added to the CISA KEV catalog on 2024-11-07.

@lottiefiles/lottie-player (npm) ✓Patched

A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.

CyberPersons CyberPanel ✓Patched

CVE-2024-51567: CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root. CVE-2024-51378: CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property. Added to the CISA KEV catalog on 2024-11-07, 2024-12-04. CISA lists known use in ransomware campaigns.

Fortinet FortiManager ✓Patched

Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Added to the CISA KEV catalog on 2024-10-23.

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) ✓Patched

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain a missing release of resource after effective lifetime vulnerability that could allow an unauthenticated, remote attacker to cause a denial-of-service (DoS) of the RAVPN service. Added to the CISA KEV catalog on 2024-10-24.

ScienceLogic SL1 ✓Patched

ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component. Added to the CISA KEV catalog on 2024-10-21.

Mozilla Firefox ✓Patched

Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process. Added to the CISA KEV catalog on 2024-10-15. CISA lists known use in ransomware campaigns.

Internet Archive (archive.org) –No fix needed

Attackers defaced archive.org with a JavaScript alert and stole a 6.4GB user authentication database: 31 million unique email addresses, screen names and bcrypt-hashed passwords. The newest record was from 2024-09-28. The data was shared with Have I Been Pwned. Around the same time the site was knocked offline by DDoS attacks.

Microsoft Windows ✓Patched

CVE-2024-43572: Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution. CVE-2024-43573: Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality. Added to the CISA KEV catalog on 2024-10-08.

Qualcomm Multiple Chipsets ✓Patched

Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory. Added to the CISA KEV catalog on 2024-10-08.

Synacor Zimbra Collaboration Suite (ZCS) ✓Patched

Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands. Added to the CISA KEV catalog on 2024-10-03.

D-Link DIR-820 Router ✕No patch yet

D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp. Added to the CISA KEV catalog on 2024-09-30. CVE-2023-25280 was assigned before 2024; the KEV listing came in 2024.

DrayTek Multiple Vigor Routers ✓Patched

DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used. Added to the CISA KEV catalog on 2024-09-30. CVE-2020-15415 was assigned before 2024; the KEV listing came in 2024.

SAP Commerce Cloud ✓Patched

SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection. Added to the CISA KEV catalog on 2024-09-30. CVE-2019-0344 was assigned before 2024; the KEV listing came in 2024.

Microsoft SQL Server ✓Patched

Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account. Added to the CISA KEV catalog on 2024-09-18. CISA lists known use in ransomware campaigns. CVE-2020-0618 was assigned before 2024; the KEV listing came in 2024.

Oracle ADF Faces ✓Patched

Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2022-21445 was assigned before 2024; the KEV listing came in 2024.

Oracle WebLogic Server ✓Patched

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution. Added to the CISA KEV catalog on 2024-09-18. CVE-2020-14644 was assigned before 2024; the KEV listing came in 2024.

PTZOptics PT30X-SDI/NDI Cameras ✓Patched

CVE-2024-8956: PTZOptics PT30X-SDI/NDI cameras contain an insecure direct object reference (IDOR) vulnerability that allows a remote, attacker to bypass authentication for the /cgi-bin/param.cgi CGI script. If combined with CVE-2024-8957, this can lead to remote code execution as root. CVE-2024-8957: PTZOptics PT30X-SDI/NDI cameras contain an OS command injection vulnerability that allows a remote, authenticated attacker to escalate privileges to root via a crafted payload with the ntp_addr parameter of the /cgi-bin/param.cgi CGI script. Added to the CISA KEV catalog on 2024-11-04.

VMware vCenter Server ✓Patched

CVE-2024-38812: VMware vCenter Server contains a heap-based buffer overflow vulnerability in the implementation of the DCERPC protocol. This vulnerability could allow an attacker with network access to the vCenter Server to execute remote code by sending a specially crafted packet. CVE-2024-38813: VMware vCenter contains an improper check for dropped privileges vulnerability. This vulnerability could allow an attacker with network access to the vCenter Server to escalate privileges to root by sending a specially crafted packet. Added to the CISA KEV catalog on 2024-11-20.

Adobe Flash Player ✕No patch yet

CVE-2013-0643: Adobe Flash Player contains an incorrect default permissions vulnerability in the Firefox sandbox that allows a remote attacker to execute arbitrary code via crafted SWF content. CVE-2013-0648: Adobe Flash Player contains an unspecified vulnerability in the ExternalInterface ActionScript functionality that allows a remote attacker to execute arbitrary code via crafted SWF content. CVE-2014-0497: Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code. CVE-2014-0502: Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code. Added to the CISA KEV catalog on 2024-09-17. CVE-2013-0643, CVE-2013-0648, CVE-2014-0497, CVE-2014-0502 were assigned before 2024; the KEV listing came in 2024.

Ivanti Cloud Services Appliance / Cloud Services Appliance (CSA) ✓Patched

Four Ivanti Cloud Services Appliance (CSA) bugs were exploited in 2024: a command injection (CVE-2024-8190), a path traversal admin bypass (CVE-2024-8963), and later a SQL injection and another command injection (CVE-2024-9379, CVE-2024-9380). FortiGuard Incident Response found a suspected nation-state actor chaining them. CSA 4.6 was end-of-life; Ivanti urged upgrading to CSA 5.0. Added to the CISA KEV catalog on 2024-09-13, 2024-09-19, 2024-10-09.

Microsoft Windows ✓Patched

Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112. Added to the CISA KEV catalog on 2024-09-16.

Microsoft Publisher, Windows ✓Patched

CVE-2024-38014: Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges. CVE-2024-38217: Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging. CVE-2024-38226: Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files. Added to the CISA KEV catalog on 2024-09-10.

ImageMagick ✓Patched

ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code via shell metacharacters in a crafted image. Added to the CISA KEV catalog on 2024-09-09. CVE-2016-3714 was assigned before 2024; the KEV listing came in 2024.

Linux Kernel ✓Patched

Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges. Added to the CISA KEV catalog on 2024-09-09. CISA lists known use in ransomware campaigns. CVE-2017-1000253 was assigned before 2024; the KEV listing came in 2024.

Veeam Backup & Replication ✓Patched

Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution. Added to the CISA KEV catalog on 2024-10-17. CISA lists known use in ransomware campaigns.

DrayTek VigorConnect ✓Patched

CVE-2021-20123: Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. CVE-2021-20124: Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Added to the CISA KEV catalog on 2024-09-03. CVE-2021-20123, CVE-2021-20124 were assigned before 2024; the KEV listing came in 2024.

Progress WhatsUp Gold ✓Patched

Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user. Added to the CISA KEV catalog on 2024-09-16. CISA lists known use in ransomware campaigns.

SonicWall SonicOS ✓Patched

SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash. Added to the CISA KEV catalog on 2024-09-09. CISA lists known use in ransomware campaigns.

Versa Director ✓Patched

The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image. Added to the CISA KEV catalog on 2024-08-23.

Dahua IP Camera Firmware ✓Patched

CVE-2021-33044: Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication. CVE-2021-33045: Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication. Added to the CISA KEV catalog on 2024-08-21. CVE-2021-33044, CVE-2021-33045 were assigned before 2024; the KEV listing came in 2024.

SolarWinds Web Help Desk ✓Patched

SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data. Added to the CISA KEV catalog on 2024-10-15.

Google Chromium V8 ✓Patched

Google Chromium V8 contains an inappropriate implementation vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-08-28.

Google Chromium V8 ✓Patched

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-08-26.

Linux Kernel ✓Patched

Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges. Added to the CISA KEV catalog on 2024-08-21. CVE-2022-0185 was assigned before 2024; the KEV listing came in 2024.

Microsoft Exchange Server ✓Patched

Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-08-21. CVE-2021-31196 was assigned before 2024; the KEV listing came in 2024.

Kingsoft WPS Office ✓Patched

Kingsoft WPS Office contains a path traversal vulnerability in promecefpluginhost.exe on Windows that allows an attacker to load an arbitrary Windows library. Added to the CISA KEV catalog on 2024-09-03.

Ivanti Virtual Traffic Manager ✓Patched

Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account. Added to the CISA KEV catalog on 2024-09-24.

LiteSpeed Cache (WordPress plugin) ✓Patched

A weak hash in the LiteSpeed Cache plugin's role-simulation feature let unauthenticated attackers brute-force a value and become administrator on WordPress sites. The plugin had 5+ million installs. Fixed in 6.4.

SolarWinds Web Help Desk ✓Patched

SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution. Added to the CISA KEV catalog on 2024-08-15.

Microsoft Project, Windows ✓Patched

CVE-2024-38106: Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition. CVE-2024-38107: Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges. CVE-2024-38178: Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL. CVE-2024-38189: Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file. CVE-2024-38193: Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. CVE-2024-38213: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file. Added to the CISA KEV catalog on 2024-08-13.

National Public Data –No fix needed

Data stolen from background-check broker National Public Data, nearly 2.7 billion plaintext records with names, mailing addresses and Social Security numbers of people in the US, was leaked for free on a hacking forum. It had first been offered for sale in April 2024 by an actor called USDoD.

Apache OFBiz ✓Patched

Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker. Added to the CISA KEV catalog on 2024-08-27.

Microsoft Windows ✓Patched

Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script. Added to the CISA KEV catalog on 2024-08-05. CVE-2018-0824 was assigned before 2024; the KEV listing came in 2024.

Acronis Cyber Infrastructure (ACI) ✓Patched

Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords. Added to the CISA KEV catalog on 2024-07-29. CVE-2023-45249 was assigned before 2024; the KEV listing came in 2024.

Microsoft Internet Explorer ✕No patch yet

Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object. Added to the CISA KEV catalog on 2024-07-23. CVE-2012-4792 was assigned before 2024; the KEV listing came in 2024.

VMware vCenter Server ✓Patched

VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information. Added to the CISA KEV catalog on 2024-07-17. CVE-2022-22948 was assigned before 2024; the KEV listing came in 2024.

Palo Alto Networks Expedition ✓Patched

CVE-2024-5910: Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data. CVE-2024-9463: Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. CVE-2024-9465: Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system. Added to the CISA KEV catalog on 2024-11-07, 2024-11-14.

ServiceNow Utah, Vancouver, and Washington DC Now Platform ✓Patched

CVE-2024-4879: ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely. CVE-2024-5217: ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely. Added to the CISA KEV catalog on 2024-07-29.

Microsoft SharePoint ✓Patched

Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-10-22. CISA lists known use in ransomware campaigns.

Microsoft Windows ✓Patched

CVE-2024-38080: Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. CVE-2024-38112: Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability. Added to the CISA KEV catalog on 2024-07-09.

Twilio Authy ✓Patched

Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy. Added to the CISA KEV catalog on 2024-07-23.

OSGeo GeoServer ✓Patched

OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input. Added to the CISA KEV catalog on 2024-07-15.

OpenSSH sshd (glibc-based Linux) ✓Patched

Qualys found a signal handler race condition in OpenSSH's sshd on glibc-based Linux that can give an unauthenticated attacker remote code execution as root. It is a regression of CVE-2006-5051 that came back in OpenSSH 8.5p1 (October 2020). Exploitation is difficult, but Qualys counted over 14 million potentially vulnerable internet-exposed servers. Fixed in OpenSSH 9.8p1.

Cisco NX-OS ✓Patched

Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device. Added to the CISA KEV catalog on 2024-07-02.

OSGeo JAI-EXT ✓Patched

OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution. Added to the CISA KEV catalog on 2024-06-26. CVE-2022-24816 was assigned before 2024; the KEV listing came in 2024.

Roundcube Webmail ✓Patched

Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment. Added to the CISA KEV catalog on 2024-06-26. CVE-2020-13965 was assigned before 2024; the KEV listing came in 2024.

polyfill.io CDN ✓Patched

The polyfill.io domain and GitHub account were bought in February 2024 by a Chinese company. The CDN, embedded via cdn.polyfill.io on more than 100,000 sites, then served malicious JavaScript that redirected some mobile visitors to a sports betting site. Sansec exposed it on 2024-06-25. Cloudflare began rewriting polyfill.io links to its own mirror, and Namecheap put the domain on hold.

VMware ESXi ✓Patched

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD. Added to the CISA KEV catalog on 2024-07-30. CISA lists known use in ransomware campaigns.

Adobe Commerce and Magento Open Source ✓Patched

Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-07-17.

Android Pixel ✓Patched

Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation. Added to the CISA KEV catalog on 2024-06-13.

Microsoft Windows ✓Patched

Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation. Added to the CISA KEV catalog on 2024-10-15. CISA lists known use in ransomware campaigns.

Microsoft Windows ✓Patched

Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges. Added to the CISA KEV catalog on 2024-12-16.

Android Kernel ✓Patched

Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS. Added to the CISA KEV catalog on 2024-08-07.

Arm Mali GPU Kernel Driver ✓Patched

Arm Bifrost and Valhall GPU kernel drivers contain a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory. Added to the CISA KEV catalog on 2024-06-12.

Roundcube Webmail ✓Patched

RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code. Added to the CISA KEV catalog on 2024-10-24.

PHP Group PHP ✓Patched

A bypass of the old CVE-2012-1823 fix: on Windows, PHP's 'Best-Fit' character mapping let attackers inject arguments into PHP running in CGI mode (including default XAMPP setups) and execute code remotely. Found by Orange Tsai (DEVCORE) and fixed in PHP 8.3.8, 8.2.20 and 8.1.29. Exploitation, including by ransomware operators, followed within days. Added to the CISA KEV catalog on 2024-06-12. CISA lists known use in ransomware campaigns.

SolarWinds Serv-U ✓Patched

SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine. Added to the CISA KEV catalog on 2024-07-17.

Oracle WebLogic Server ✓Patched

Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document. Added to the CISA KEV catalog on 2024-06-03. CVE-2017-3506 was assigned before 2024; the KEV listing came in 2024.

Ivanti Endpoint Manager (EPM) ✓Patched

Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code. Added to the CISA KEV catalog on 2024-10-02.

Rejetto HTTP File Server ✓Patched

Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request. Added to the CISA KEV catalog on 2024-07-09. CISA lists known use in ransomware campaigns.

Hugging Face Spaces –No fix needed

Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.

Progress Telerik Report Server ✓Patched

Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. Added to the CISA KEV catalog on 2024-06-13.

Check Point Quantum Security Gateways ✓Patched

Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.

Google Chromium V8 ✓Patched

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-05-28.

Apache Flink ✓Patched

Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface. Added to the CISA KEV catalog on 2024-05-23. CVE-2020-17519 was assigned before 2024; the KEV listing came in 2024.

Justice AV Solutions Viewer ✓Patched

Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server. Added to the CISA KEV catalog on 2024-05-29.

NextGen Healthcare Mirth Connect ✓Patched

NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request. Added to the CISA KEV catalog on 2024-05-20. CISA lists known use in ransomware campaigns. CVE-2023-43208 was assigned before 2024; the KEV listing came in 2024.

D-Link DIR-600 Router ✕No patch yet

D-Link DIR-600 routers contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to change router configurations by hijacking an existing administrator session. Added to the CISA KEV catalog on 2024-05-16. CVE-2014-100005 was assigned before 2024; the KEV listing came in 2024.

D-Link DIR-605 Router ✕No patch yet

D-Link DIR-605 routers contain an information disclosure vulnerability that allows attackers to obtain a username and password by forging a post request to the /getcfg.php page. Added to the CISA KEV catalog on 2024-05-16. CVE-2021-40655 was assigned before 2024; the KEV listing came in 2024.

Google Chromium V8 ✓Patched

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. Added to the CISA KEV catalog on 2024-05-20.

Google Chromium V8 ✓Patched

Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-05-16.

Microsoft DWM Core Library, Windows ✓Patched

CVE-2024-30040: Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass. CVE-2024-30051: Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges. Added to the CISA KEV catalog on 2024-05-14. CISA lists known use in ransomware campaigns.

Google Chromium ✓Patched

Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-05-13.

Apache OFBiz ✓Patched

Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. Added to the CISA KEV catalog on 2024-08-07.

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) ✓Patched

Cisco Talos disclosed ArcaneDoor, a state-sponsored campaign against perimeter devices that exploited two Cisco Adaptive Security Appliance and Firepower Threat Defense zero-days: a denial of service (CVE-2024-20353) and a persistent local code execution bug (CVE-2024-20359), used to plant the Line Dancer and Line Runner implants. Added to the CISA KEV catalog on 2024-04-24.

Dropbox Sign –No fix needed

A threat actor got into the Dropbox Sign (formerly HelloSign) production environment through a compromised service account in an automated system-configuration tool. It accessed customer emails, usernames, phone numbers, hashed passwords, API keys, OAuth tokens and MFA data. Dropbox reset passwords, logged users out and coordinated rotation of all API keys and OAuth tokens. It found no access to documents or payment information.

Microsoft Windows ✓Patched

Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions. Added to the CISA KEV catalog on 2024-04-23. CVE-2022-38028 was assigned before 2024; the KEV listing came in 2024.

Apache HugeGraph-Server ✓Patched

Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code. Added to the CISA KEV catalog on 2024-09-18.

CrushFTP ✓Patched

CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS). Added to the CISA KEV catalog on 2024-04-24.

Palo Alto Networks PAN-OS ✓Patched

A command injection in the GlobalProtect feature of PAN-OS let unauthenticated attackers run code as root on Palo Alto firewalls (CVSS 10). Volexity caught an actor it tracks as UTA0218, assessed as likely state-backed, exploiting it as a zero-day, and Palo Alto's Unit 42 tracked the activity as Operation MidnightEclipse. Hotfixes shipped from mid-April 2024. Added to the CISA KEV catalog on 2024-04-12. CISA lists known use in ransomware campaigns.

Microsoft SmartScreen Prompt ✓Patched

Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file. Added to the CISA KEV catalog on 2024-04-30.

D-Link Multiple NAS Devices ✕No patch yet

CVE-2024-3272: D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution. CVE-2024-3273: D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution. Added to the CISA KEV catalog on 2024-04-11.

Android Pixel ✓Patched

CVE-2024-29745: Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices. CVE-2024-29748: Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app. Added to the CISA KEV catalog on 2024-04-04.

Microsoft SharePoint Server ✓Patched

Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely. Added to the CISA KEV catalog on 2024-03-26. CISA lists known use in ransomware campaigns. CVE-2023-24955 was assigned before 2024; the KEV listing came in 2024.

Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) ✓Patched

Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) contains a code injection vulnerability that allows an unauthenticated user to execute malicious code with limited permissions (nobody). Added to the CISA KEV catalog on 2024-03-25. CISA lists known use in ransomware campaigns. CVE-2021-44529 was assigned before 2024; the KEV listing came in 2024.

Nice Linear eMerge E3-Series ✓Patched

Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution. Added to the CISA KEV catalog on 2024-03-25. CVE-2019-7256 was assigned before 2024; the KEV listing came in 2024.

Adobe ColdFusion ✓Patched

Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel. Added to the CISA KEV catalog on 2024-12-16.

Fortinet FortiClient EMS ✓Patched

Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests. Added to the CISA KEV catalog on 2024-03-25. CISA lists known use in ransomware campaigns. CVE-2023-48788 was assigned before 2024; the KEV listing came in 2024.

Microsoft Windows ✓Patched

Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. Added to the CISA KEV catalog on 2024-06-13. CISA lists known use in ransomware campaigns.

Sunhillo SureLine ✓Patched

Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi. Added to the CISA KEV catalog on 2024-03-05. CVE-2021-36380 was assigned before 2024; the KEV listing came in 2024.

Apple Multiple Products ✓Patched

CVE-2024-23225: Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS kernel contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. CVE-2024-23296: Apple iOS, iPadOS, macOS, tvOS, and watchOS RTKit contain a memory corruption vulnerability that allows an attacker with arbitrary kernel read and write capability to bypass kernel memory protections. Added to the CISA KEV catalog on 2024-03-06.

Android Pixel ✓Patched

Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information. Added to the CISA KEV catalog on 2024-03-05. CVE-2023-21237 was assigned before 2024; the KEV listing came in 2024.

JetBrains TeamCity ✓Patched

JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. Added to the CISA KEV catalog on 2024-03-07. CISA lists known use in ransomware campaigns.

Microsoft Streaming Service ✓Patched

Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Added to the CISA KEV catalog on 2024-02-29. CVE-2023-29360 was assigned before 2024; the KEV listing came in 2024.

Progress Kemp LoadMaster ✓Patched

Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. Added to the CISA KEV catalog on 2024-11-18.

ConnectWise ScreenConnect ✓Patched

ConnectWise ScreenConnect before 23.9.8 had a trivially exploitable authentication bypass (CVE-2024-1709, CVSS 10) and a path traversal (CVE-2024-1708), reported to ConnectWise on 2024-02-19. Attackers could create an admin account on self-hosted servers and then push code to every managed endpoint. Exploitation began within days, including by ransomware groups. Cloud instances were patched by ConnectWise; on-premise servers had to update to 23.9.8. Added to the CISA KEV catalog on 2024-02-22. CISA lists known use in ransomware campaigns.

Fortinet Multiple Products ✓Patched

Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. Added to the CISA KEV catalog on 2024-10-09.

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) ✓Patched

Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) contain an information disclosure vulnerability. An attacker could retrieve memory contents on an affected device, which could lead to the disclosure of confidential information due to a buffer tracking issue when the software parses invalid URLs that are requested from the web services interface. This vulnerability affects only specific AnyConnect and WebVPN configurations. Added to the CISA KEV catalog on 2024-02-15. CISA lists known use in ransomware campaigns. CVE-2020-3259 was assigned before 2024; the KEV listing came in 2024.

Microsoft Exchange Server ✓Patched

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. Added to the CISA KEV catalog on 2024-02-15.

Microsoft Windows ✓Patched

Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation. Added to the CISA KEV catalog on 2024-03-04. CISA lists known use in ransomware campaigns.

Microsoft Windows ✓Patched

CVE-2024-21351: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both. CVE-2024-21412: Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass. Added to the CISA KEV catalog on 2024-02-13. CISA lists known use in ransomware campaigns.

Roundcube Webmail ✓Patched

Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages. Added to the CISA KEV catalog on 2024-02-12. CVE-2023-43770 was assigned before 2024; the KEV listing came in 2024.

Fortinet FortiOS ✓Patched

Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests. Added to the CISA KEV catalog on 2024-02-09. CISA lists known use in ransomware campaigns.

Google Chromium V8 ✓Patched

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-02-06. CVE-2023-4762 was assigned before 2024; the KEV listing came in 2024.

Linux Kernel ✓Patched

Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.

Jenkins Command Line Interface (CLI) ✓Patched

Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. Added to the CISA KEV catalog on 2024-08-19. CISA lists known use in ransomware campaigns.

Apple Multiple Products ✓Patched

Apple iOS, iPadOS, macOS, tvOS, and Safari WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing. Added to the CISA KEV catalog on 2024-01-23.

VMware vCenter Server ✓Patched

VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol that allows an attacker to conduct remote code execution. Added to the CISA KEV catalog on 2024-01-22. CVE-2023-34048 was assigned before 2024; the KEV listing came in 2024.

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core ✓Patched

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core contain an authentication bypass vulnerability that allows unauthorized users to access restricted functionality or resources of the application. Added to the CISA KEV catalog on 2024-01-18. CISA lists known use in ransomware campaigns. CVE-2023-35082 was assigned before 2024; the KEV listing came in 2024.

Citrix NetScaler ADC and NetScaler Gateway ✓Patched

CVE-2023-6548: Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP. CVE-2023-6549: Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Added to the CISA KEV catalog on 2024-01-17. CVE-2023-6548, CVE-2023-6549 were assigned before 2024; the KEV listing came in 2024.

Atlassian Confluence Data Center and Server ✓Patched

Atlassian Confluence Data Center and Server contain an unauthenticated OGNL template injection vulnerability that can lead to remote code execution. Added to the CISA KEV catalog on 2024-01-24. CISA lists known use in ransomware campaigns. CVE-2023-22527 was assigned before 2024; the KEV listing came in 2024.

Google Chromium V8 ✓Patched

Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. Added to the CISA KEV catalog on 2024-01-17.

Laravel Framework ✓Patched

Laravel Framework contains a deserialization of untrusted data vulnerability, allowing for remote command execution. This vulnerability may only be exploited if a malicious user has accessed the application encryption key (APP_KEY environment variable). Added to the CISA KEV catalog on 2024-01-16. CVE-2018-15133 was assigned before 2024; the KEV listing came in 2024.

GitLab CE/EE ✓Patched

GitLab Community and Enterprise Editions contain an improper access control vulnerability. This allows an attacker to trigger password reset emails to be sent to an unverified email address to ultimately facilitate an account takeover. Added to the CISA KEV catalog on 2024-05-01. CVE-2023-7028 was assigned before 2024; the KEV listing came in 2024.

Microsoft corporate email (Microsoft 365) –No fix needed

Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.

Ivanti Connect Secure and Policy Secure / Connect Secure, Policy Secure, and Neurons ✓Patched

Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.

Microsoft SharePoint Server ✓Patched

Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges. Added to the CISA KEV catalog on 2024-01-10. CISA lists known use in ransomware campaigns. CVE-2023-29357 was assigned before 2024; the KEV listing came in 2024.

Apple Multiple Products ✓Patched

Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a time-of-check/time-of-use (TOCTOU) memory corruption vulnerability that allows an attacker with read and write capabilities to bypass Pointer Authentication. Added to the CISA KEV catalog on 2024-01-31. CVE-2022-48618 was assigned before 2024; the KEV listing came in 2024.

Adobe ColdFusion ✓Patched

CVE-2023-29300: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CVE-2023-38203: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. Added to the CISA KEV catalog on 2024-01-08. CISA lists known use in ransomware campaigns. CVE-2023-29300, CVE-2023-38203 were assigned before 2024; the KEV listing came in 2024.

D-Link DSL-2750B Devices ✓Patched

D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter. Added to the CISA KEV catalog on 2024-01-08. CVE-2016-20017 was assigned before 2024; the KEV listing came in 2024.

Apache Superset ✓Patched

Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-27524 was assigned before 2024; the KEV listing came in 2024.

Apple Multiple Products ✓Patched

Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-41990 was assigned before 2024; the KEV listing came in 2024.

Joomla! ✓Patched

Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-23752 was assigned before 2024; the KEV listing came in 2024.

Linux Kernel ✓Patched

Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges. Added to the CISA KEV catalog on 2024-06-26. CVE-2022-2586 was assigned before 2024; the KEV listing came in 2024.

Google Chromium WebRTC ✓Patched

Google Chromium WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using WebRTC, including but not limited to Google Chrome. Added to the CISA KEV catalog on 2024-01-02. CVE-2023-7024 was assigned before 2024; the KEV listing came in 2024.

Spreadsheet::ParseExcel ✓Patched

Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic. Added to the CISA KEV catalog on 2024-01-02. CVE-2023-7101 was assigned before 2024; the KEV listing came in 2024.