This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2022-29499
Vendor: Mitel
Product: MiVoice Connect
Added: 2022-06-27
Due Date: 2022-07-18
Description:
The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-30533
Vendor: Google
Product: Chromium PopupBlocker
Added: 2022-06-27
Due Date: 2022-07-18
Description:
Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-4034
Vendor: Red Hat
Product: Polkit
Added: 2022-06-27
Due Date: 2022-07-18
Description:
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-30983
Vendor: Apple
Product: iOS and iPadOS
Added: 2022-06-27
Due Date: 2022-07-18
Description:
Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2020-3837
Vendor: Apple
Product: Multiple Products
Added: 2022-06-27
Due Date: 2022-07-18
Description:
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2020-9907
Vendor: Apple
Product: Multiple Products
Added: 2022-06-27
Due Date: 2022-07-18
Description:
Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-8605
Vendor: Apple
Product: Multiple Products
Added: 2022-06-27
Due Date: 2022-07-18
Description:
A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2018-4344
Vendor: Apple
Product: Multiple Products
Added: 2022-06-27
Due Date: 2022-07-18
Description:
Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-30190
Vendor: Microsoft
Product: Windows
Added: 2022-06-14
Due Date: 2022-07-05
Description:
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-38163
Vendor: SAP
Product: NetWeaver
Added: 2022-06-09
Due Date: 2022-06-30
Description:
SAP NetWeaver contains a vulnerability that allows unrestricted file upload.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2016-2386
Vendor: SAP
Product: NetWeaver
Added: 2022-06-09
Due Date: 2022-06-30
Description:
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2016-2388
Vendor: SAP
Product: NetWeaver
Added: 2022-06-09
Due Date: 2022-06-30
Description:
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-7195
Vendor: QNAP
Product: Photo Station
Added: 2022-06-08
Due Date: 2022-06-22
Description:
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-7194
Vendor: QNAP
Product: Photo Station
Added: 2022-06-08
Due Date: 2022-06-22
Description:
QNAP devices running Photo Station contain an external control of file name or path vulnerability allowing remote attackers to access or modify system files.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-7193
Vendor: QNAP
Product: QTS
Added: 2022-06-08
Due Date: 2022-06-22
Description:
QNAP QTS contains an improper input validation vulnerability allowing remote attackers to inject code on the system.
Required Action:
Apply updates per vendor instructions.
CWEs: