This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2022-28810
Vendor: Zoho
Product: ManageEngine
Added: 2023-03-07
Due Date: 2023-03-28
Description:
Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-33891
Vendor: Apache
Product: Spark
Added: 2023-03-07
Due Date: 2023-03-28
Description:
Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-35914
Vendor: Teclib
Product: GLPI
Added: 2023-03-07
Due Date: 2023-03-28
Description:
Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-36537
Vendor: ZK Framework
Product: AuUploader
Added: 2023-02-27
Due Date: 2023-03-20
Description:
ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-47986
Vendor: IBM
Product: Aspera Faspex
Added: 2023-02-21
Due Date: 2023-03-14
Description:
IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-41223
Vendor: Mitel
Product: MiVoice Connect
Added: 2023-02-21
Due Date: 2023-03-14
Description:
The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-40765
Vendor: Mitel
Product: MiVoice Connect
Added: 2023-02-21
Due Date: 2023-03-14
Description:
The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-46169
Vendor: Cacti
Product: Cacti
Added: 2023-02-16
Due Date: 2023-03-09
Description:
Cacti contains a command injection vulnerability that allows an unauthenticated user to execute code.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2023-21715
Vendor: Microsoft
Product: Office
Added: 2023-02-14
Due Date: 2023-03-07
Description:
Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2023-23376
Vendor: Microsoft
Product: Windows
Added: 2023-02-14
Due Date: 2023-03-07
Description:
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2023-23529
Vendor: Apple
Product: Multiple Products
Added: 2023-02-14
Due Date: 2023-03-07
Description:
Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2023-21823
Vendor: Microsoft
Product: Windows
Added: 2023-02-14
Due Date: 2023-03-07
Description:
Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2015-2291
Vendor: Intel
Product: Ethernet Diagnostics Driver for Windows
Added: 2023-02-10
Due Date: 2023-03-03
Description:
Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-24990
Vendor: TerraMaster
Product: TerraMaster OS
Added: 2023-02-10
Due Date: 2023-03-03
Description:
TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2023-0669
Vendor: Fortra
Product: GoAnywhere MFT
Added: 2023-02-10
Due Date: 2023-03-03
Description:
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
Required Action:
Apply updates per vendor instructions.
CWEs: