This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2024-45195
Vendor: Apache
Product: OFBiz
Added: 2025-02-04
Due Date: 2025-02-25
Description:
Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-24085
Vendor: Apple
Product: Multiple Products
Added: 2025-01-29
Due Date: 2025-02-19
Description:
Apple iOS, macOS, and other Apple products contain a user-after-free vulnerability that could allow a malicious application to elevate privileges.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-23006
Vendor: SonicWall
Product: SMA1000 Appliances
Added: 2025-01-24
Due Date: 2025-02-14
Description:
SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a deserialization of untrusted data vulnerability, which can enable a remote, unauthenticated attacker to execute arbitrary OS commands.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2020-11023
Vendor: JQuery
Product: JQuery
Added: 2025-01-23
Due Date: 2025-02-13
Description:
JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-50603
Vendor: Aviatrix
Product: Controllers
Added: 2025-01-16
Due Date: 2025-02-06
Description:
Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-21335
Vendor: Microsoft
Product: Windows
Added: 2025-01-14
Due Date: 2025-02-04
Description:
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-21334
Vendor: Microsoft
Product: Windows
Added: 2025-01-14
Due Date: 2025-02-04
Description:
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-21333
Vendor: Microsoft
Product: Windows
Added: 2025-01-14
Due Date: 2025-02-04
Description:
Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-55591
Vendor: Fortinet
Product: FortiOS and FortiProxy
Added: 2025-01-14
Due Date: 2025-01-21
Description:
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that may allow an unauthenticated, remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2023-48365
Vendor: Qlik
Product: Sense
Added: 2025-01-13
Due Date: 2025-02-03
Description:
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-12686
Vendor: BeyondTrust
Product: Privileged Remote Access (PRA) and Remote Support (RS)
Added: 2025-01-13
Due Date: 2025-02-03
Description:
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2025-0282
Vendor: Ivanti
Product: Connect Secure, Policy Secure, and ZTA Gateways
Added: 2025-01-08
Due Date: 2025-01-15
Description:
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
Required Action:
Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
CWEs:
CVE-2020-2883
Vendor: Oracle
Product: WebLogic Server
Added: 2025-01-07
Due Date: 2025-01-28
Description:
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-55550
Vendor: Mitel
Product: MiCollab
Added: 2025-01-07
Due Date: 2025-01-28
Description:
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-41713
Vendor: Mitel
Product: MiCollab
Added: 2025-01-07
Due Date: 2025-01-28
Description:
Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs: