This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2022-27924
Vendor: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Added: 2022-08-04
Due Date: 2022-08-25
Description:
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-26138
Vendor: Atlassian
Product: Confluence
Added: 2022-07-29
Due Date: 2022-08-19
Description:
Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-22047
Vendor: Microsoft
Product: Windows
Added: 2022-07-12
Due Date: 2022-08-02
Description:
Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-26925
Vendor: Microsoft
Product: Windows
Added: 2022-07-01
Due Date: 2022-07-22
Description:
Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.
Required Action:
Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
CWEs:
CVE-2022-29499
Vendor: Mitel
Product: MiVoice Connect
Added: 2022-06-27
Due Date: 2022-07-18
Description:
The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-30533
Vendor: Google
Product: Chromium PopupBlocker
Added: 2022-06-27
Due Date: 2022-07-18
Description:
Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-4034
Vendor: Red Hat
Product: Polkit
Added: 2022-06-27
Due Date: 2022-07-18
Description:
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-30983
Vendor: Apple
Product: iOS and iPadOS
Added: 2022-06-27
Due Date: 2022-07-18
Description:
Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2020-3837
Vendor: Apple
Product: Multiple Products
Added: 2022-06-27
Due Date: 2022-07-18
Description:
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2020-9907
Vendor: Apple
Product: Multiple Products
Added: 2022-06-27
Due Date: 2022-07-18
Description:
Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-8605
Vendor: Apple
Product: Multiple Products
Added: 2022-06-27
Due Date: 2022-07-18
Description:
A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2018-4344
Vendor: Apple
Product: Multiple Products
Added: 2022-06-27
Due Date: 2022-07-18
Description:
Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-30190
Vendor: Microsoft
Product: Windows
Added: 2022-06-14
Due Date: 2022-07-05
Description:
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-38163
Vendor: SAP
Product: NetWeaver
Added: 2022-06-09
Due Date: 2022-06-30
Description:
SAP NetWeaver contains a vulnerability that allows unrestricted file upload.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2016-2386
Vendor: SAP
Product: NetWeaver
Added: 2022-06-09
Due Date: 2022-06-30
Description:
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Required Action:
Apply updates per vendor instructions.
CWEs: