This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2018-19323
Vendor: GIGABYTE
Product: Multiple Products
Added: 2022-10-24
Due Date: 2022-11-14
Description:
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
Required Action:
Apply updates per vendor instructions.
CVE-2018-19322
Vendor: GIGABYTE
Product: Multiple Products
Added: 2022-10-24
Due Date: 2022-11-14
Description:
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2018-19321
Vendor: GIGABYTE
Product: Multiple Products
Added: 2022-10-24
Due Date: 2022-11-14
Description:
The GPCIDrv and GDrv low-level drivers in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
Required Action:
Apply updates per vendor instructions.
CVE-2018-19320
Vendor: GIGABYTE
Product: Multiple Products
Added: 2022-10-24
Due Date: 2022-11-14
Description:
The GDrv low-level driver in GIGABYTE App Center, AORUS Graphics Engine, XTREME Gaming Engine, and OC GURU II exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
Required Action:
Apply updates per vendor instructions.
CVE-2022-41352
Vendor: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Added: 2022-10-20
Due Date: 2022-11-10
Description:
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-3493
Vendor: Linux
Product: Kernel
Added: 2022-10-20
Due Date: 2022-11-10
Description:
The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-40684
Vendor: Fortinet
Product: Multiple Products
Added: 2022-10-11
Due Date: 2022-11-01
Description:
Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-41033
Vendor: Microsoft
Product: Windows COM+ Event System Service
Added: 2022-10-11
Due Date: 2022-11-01
Description:
Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-41082
Vendor: Microsoft
Product: Exchange Server
Added: 2022-09-30
Due Date: 2022-10-21
Description:
Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-41040
Vendor: Microsoft
Product: Exchange Server
Added: 2022-09-30
Due Date: 2022-10-21
Description:
Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-36804
Vendor: Atlassian
Product: Bitbucket Server and Data Center
Added: 2022-09-30
Due Date: 2022-10-21
Description:
Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-3236
Vendor: Sophos
Product: Firewall
Added: 2022-09-23
Due Date: 2022-10-14
Description:
A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-35405
Vendor: Zoho
Product: ManageEngine
Added: 2022-09-22
Due Date: 2022-10-13
Description:
Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus contain an unspecified vulnerability that allows for remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-40139
Vendor: Trend Micro
Product: Apex One and Apex One as a Service
Added: 2022-09-15
Due Date: 2022-10-06
Description:
Trend Micro Apex One and Apex One as a Service contain an improper validation of rollback mechanism components that could lead to remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2013-6282
Vendor: Linux
Product: Kernel
Added: 2022-09-15
Due Date: 2022-10-06
Description:
The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.
Required Action:
Apply updates per vendor instructions.
CWEs: