CISA Known Exploited Vulnerabilities

This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).

CVE-2024-7971

Google Chromium V8 Type Confusion Vulnerability

Vendor: Google

Product: Chromium V8

Added: 2024-08-26

Due Date: 2024-09-16

Description:

Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-843

CVE-2024-39717

Versa Director Dangerous File Type Upload Vulnerability

Vendor: Versa

Product: Director

Added: 2024-08-23

Due Date: 2024-09-13

Description:

The Versa Director GUI contains an unrestricted upload of file with dangerous type vulnerability that allows administrators with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin privileges to customize the user interface. The “Change Favicon” (Favorite Icon) enables the upload of a .png file, which can be exploited to upload a malicious file with a .png extension disguised as an image.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-434

CVE-2021-31196

Microsoft Exchange Server Information Disclosure Vulnerability

Vendor: Microsoft

Product: Exchange Server

Added: 2024-08-21

Due Date: 2024-09-11

Description:

Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2022-0185

Linux Kernel Heap-Based Buffer Overflow Vulnerability

Vendor: Linux

Product: Kernel

Added: 2024-08-21

Due Date: 2024-09-11

Description:

Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.

Required Action:

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

CWEs:

CWE-190

CVE-2021-33045

Dahua IP Camera Authentication Bypass Vulnerability

Vendor: Dahua

Product: IP Camera Firmware

Added: 2024-08-21

Due Date: 2024-09-11

Description:

Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-287

CVE-2021-33044

Dahua IP Camera Authentication Bypass Vulnerability

Vendor: Dahua

Product: IP Camera Firmware

Added: 2024-08-21

Due Date: 2024-09-11

Description:

Dahua IP cameras and related products contain an authentication bypass vulnerability when the NetKeyboard type argument is specified by the client during authentication.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-287

CVE-2024-23897

Ransomware

Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Vendor: Jenkins

Product: Jenkins Command Line Interface (CLI)

Added: 2024-08-19

Due Date: 2024-09-09

Description:

Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-27

CVE-2024-28986

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Vendor: SolarWinds

Product: Web Help Desk

Added: 2024-08-15

Due Date: 2024-09-05

Description:

SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-502

CVE-2024-38107

Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability

Vendor: Microsoft

Product: Windows

Added: 2024-08-13

Due Date: 2024-09-03

Description:

Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-416

CVE-2024-38106

Microsoft Windows Kernel Privilege Escalation Vulnerability

Vendor: Microsoft

Product: Windows

Added: 2024-08-13

Due Date: 2024-09-03

Description:

Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-591

CVE-2024-38193

Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability

Vendor: Microsoft

Product: Windows

Added: 2024-08-13

Due Date: 2024-09-03

Description:

Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-416

CVE-2024-38213

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Vendor: Microsoft

Product: Windows

Added: 2024-08-13

Due Date: 2024-09-03

Description:

Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-693

CVE-2024-38178

Microsoft Windows Scripting Engine Memory Corruption Vulnerability

Vendor: Microsoft

Product: Windows

Added: 2024-08-13

Due Date: 2024-09-03

Description:

Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-843

CVE-2024-38189

Microsoft Project Remote Code Execution Vulnerability

Vendor: Microsoft

Product: Project

Added: 2024-08-13

Due Date: 2024-09-03

Description:

Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-20

CVE-2024-32113

Apache OFBiz Path Traversal Vulnerability

Vendor: Apache

Product: OFBiz

Added: 2024-08-07

Due Date: 2024-08-28

Description:

Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.

Required Action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWEs:

CWE-22