This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2023-23376
Vendor: Microsoft
Product: Windows
Added: 2023-02-14
Due Date: 2023-03-07
Description:
Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2023-23529
Vendor: Apple
Product: Multiple Products
Added: 2023-02-14
Due Date: 2023-03-07
Description:
Apple iOS, MacOS, Safari and iPadOS WebKit contain a type confusion vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2023-21823
Vendor: Microsoft
Product: Windows
Added: 2023-02-14
Due Date: 2023-03-07
Description:
Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2015-2291
Vendor: Intel
Product: Ethernet Diagnostics Driver for Windows
Added: 2023-02-10
Due Date: 2023-03-03
Description:
Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service (DoS).
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-24990
Vendor: TerraMaster
Product: TerraMaster OS
Added: 2023-02-10
Due Date: 2023-03-03
Description:
TerraMaster OS contains a remote command execution vulnerability that allows an unauthenticated user to execute commands on the target endpoint.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2023-0669
Vendor: Fortra
Product: GoAnywhere MFT
Added: 2023-02-10
Due Date: 2023-03-03
Description:
Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vulnerability in the License Response Servlet due to deserializing an attacker-controlled object.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-21587
Vendor: Oracle
Product: E-Business Suite
Added: 2023-02-02
Due Date: 2023-02-23
Description:
Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2023-22952
Vendor: SugarCRM
Product: Multiple Products
Added: 2023-02-02
Due Date: 2023-02-23
Description:
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2017-11357
Vendor: Telerik
Product: User Interface (UI) for ASP.NET AJAX
Added: 2023-01-26
Due Date: 2023-02-16
Description:
Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-47966
Vendor: Zoho
Product: ManageEngine
Added: 2023-01-23
Due Date: 2023-02-13
Description:
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
Required Action:
Apply updates per vendor instructions.
CVE-2022-44877
Vendor: CWP
Product: Control Web Panel
Added: 2023-01-17
Due Date: 2023-02-07
Description:
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-41080
Vendor: Microsoft
Product: Exchange Server
Added: 2023-01-10
Due Date: 2023-01-31
Description:
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
Required Action:
Apply updates per vendor instructions.
CVE-2023-21674
Vendor: Microsoft
Product: Windows
Added: 2023-01-10
Due Date: 2023-01-31
Description:
Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2018-5430
Vendor: TIBCO
Product: JasperReports
Added: 2022-12-29
Due Date: 2023-01-19
Description:
TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2018-18809
Vendor: TIBCO
Product: JasperReports
Added: 2022-12-29
Due Date: 2023-01-19
Description:
TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
Required Action:
Apply updates per vendor instructions.
CWEs: