This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2023-44487
Vendor: IETF
Product: HTTP/2
Added: 2023-10-10
Due Date: 2023-10-31
Description:
HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).
Required Action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2023-22515
Vendor: Atlassian
Product: Confluence Data Center and Server
Added: 2023-10-05
Due Date: 2023-10-13
Description:
Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.
CVE-2023-40044
Vendor: Progress
Product: WS_FTP Server
Added: 2023-10-05
Due Date: 2023-10-26
Description:
Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2023-42824
Vendor: Apple
Product: iOS and iPadOS
Added: 2023-10-05
Due Date: 2023-10-26
Description:
Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-42793
Vendor: JetBrains
Product: TeamCity
Added: 2023-10-04
Due Date: 2023-10-25
Description:
JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2023-28229
Vendor: Microsoft
Product: Windows CNG Key Isolation Service
Added: 2023-10-04
Due Date: 2023-10-25
Description:
Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2023-4211
Vendor: Arm
Product: Mali GPU Kernel Driver
Added: 2023-10-03
Due Date: 2023-10-24
Description:
Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2023-5217
Vendor: Google
Product: Chromium libvpx
Added: 2023-10-02
Due Date: 2023-10-23
Description:
Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2018-14667
Vendor: Red Hat
Product: JBoss RichFaces Framework
Added: 2023-09-28
Due Date: 2023-10-19
Description:
Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2023-41991
Vendor: Apple
Product: Multiple Products
Added: 2023-09-25
Due Date: 2023-10-16
Description:
Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2023-41992
Vendor: Apple
Product: Multiple Products
Added: 2023-09-25
Due Date: 2023-10-16
Description:
Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2023-41993
Vendor: Apple
Product: Multiple Products
Added: 2023-09-25
Due Date: 2023-10-16
Description:
Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2023-41179
Vendor: Trend Micro
Product: Apex One and Worry-Free Business Security
Added: 2023-09-21
Due Date: 2023-10-12
Description:
Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-28434
Vendor: MinIO
Product: MinIO
Added: 2023-09-19
Due Date: 2023-10-10
Description:
MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs:
CVE-2022-22265
Vendor: Samsung
Product: Mobile Devices
Added: 2023-09-18
Due Date: 2023-10-09
Description:
Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution.
Required Action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CWEs: