This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2022-22948
Vendor: VMware
Product: vCenter Server
Added: 2024-07-17
Due Date: 2024-08-07
Description:
VMware vCenter Server contains an incorrect default file permissions vulnerability that allows a remote, privileged attacker to gain access to sensitive information.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-28995
Vendor: SolarWinds
Product: Serv-U
Added: 2024-07-17
Due Date: 2024-08-07
Description:
SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-34102
Vendor: Adobe
Product: Commerce and Magento Open Source
Added: 2024-07-17
Due Date: 2024-08-07
Description:
Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-36401
Vendor: OSGeo
Product: GeoServer
Added: 2024-07-15
Due Date: 2024-08-05
Description:
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-23692
Vendor: Rejetto
Product: HTTP File Server
Added: 2024-07-09
Due Date: 2024-07-30
Description:
Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-38080
Vendor: Microsoft
Product: Windows
Added: 2024-07-09
Due Date: 2024-07-30
Description:
Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-38112
Vendor: Microsoft
Product: Windows
Added: 2024-07-09
Due Date: 2024-07-30
Description:
Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-20399
Vendor: Cisco
Product: NX-OS
Added: 2024-07-02
Due Date: 2024-07-23
Description:
Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2020-13965
Vendor: Roundcube
Product: Webmail
Added: 2024-06-26
Due Date: 2024-07-17
Description:
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2022-2586
Vendor: Linux
Product: Kernel
Added: 2024-06-26
Due Date: 2024-07-17
Description:
Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges.
Required Action:
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CWEs:
CVE-2022-24816
Vendor: OSGeo
Product: JAI-EXT
Added: 2024-06-26
Due Date: 2024-07-17
Description:
OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-4358
Vendor: Progress
Product: Telerik Report Server
Added: 2024-06-13
Due Date: 2024-07-04
Description:
Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-26169
Vendor: Microsoft
Product: Windows
Added: 2024-06-13
Due Date: 2024-07-04
Description:
Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.
Required Action:
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CWEs:
CVE-2024-32896
Vendor: Android
Product: Pixel
Added: 2024-06-13
Due Date: 2024-07-04
Description:
Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2024-4577
Vendor: PHP Group
Product: PHP
Added: 2024-06-12
Due Date: 2024-07-03
Description:
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs: