This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2023-22952
Vendor: SugarCRM
Product: Multiple Products
Added: 2023-02-02
Due Date: 2023-02-23
Description:
Multiple SugarCRM products contain a remote code execution vulnerability in the EmailTemplates. Using a specially crafted request, custom PHP code can be injected through the EmailTemplates.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2017-11357
Vendor: Telerik
Product: User Interface (UI) for ASP.NET AJAX
Added: 2023-01-26
Due Date: 2023-02-16
Description:
Telerik UI for ASP.NET AJAX contains an insecure direct object reference vulnerability in RadAsyncUpload that can result in file uploads in a limited location and/or remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-47966
Vendor: Zoho
Product: ManageEngine
Added: 2023-01-23
Due Date: 2023-02-13
Description:
Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.
Required Action:
Apply updates per vendor instructions.
CVE-2022-44877
Vendor: CWP
Product: Control Web Panel
Added: 2023-01-17
Due Date: 2023-02-07
Description:
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-41080
Vendor: Microsoft
Product: Exchange Server
Added: 2023-01-10
Due Date: 2023-01-31
Description:
Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.
Required Action:
Apply updates per vendor instructions.
CVE-2023-21674
Vendor: Microsoft
Product: Windows
Added: 2023-01-10
Due Date: 2023-01-31
Description:
Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2018-5430
Vendor: TIBCO
Product: JasperReports
Added: 2022-12-29
Due Date: 2023-01-19
Description:
TIBCO JasperReports Server contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2018-18809
Vendor: TIBCO
Product: JasperReports
Added: 2022-12-29
Due Date: 2023-01-19
Description:
TIBCO JasperReports Library contains a directory-traversal vulnerability that may allow web server users to access contents of the host system.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-42856
Vendor: Apple
Product: iOS
Added: 2022-12-14
Due Date: 2023-01-04
Description:
Apple iOS contains a type confusion vulnerability when processing maliciously crafted web content leading to code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-42475
Vendor: Fortinet
Product: FortiOS
Added: 2022-12-13
Due Date: 2023-01-03
Description:
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-44698
Vendor: Microsoft
Product: Defender
Added: 2022-12-13
Due Date: 2023-01-03
Description:
Microsoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-27518
Vendor: Citrix
Product: Application Delivery Controller (ADC) and Gateway
Added: 2022-12-13
Due Date: 2023-01-03
Description:
Citrix Application Delivery Controller (ADC) and Gateway, when configured with SAML SP or IdP configuration, contain an authentication bypass vulnerability that allows an attacker to execute code as administrator.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-26500
Vendor: Veeam
Product: Backup & Replication
Added: 2022-12-13
Due Date: 2023-01-03
Description:
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-26501
Vendor: Veeam
Product: Backup & Replication
Added: 2022-12-13
Due Date: 2023-01-03
Description:
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-4262
Vendor: Google
Product: Chromium V8
Added: 2022-12-05
Due Date: 2022-12-26
Description:
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required Action:
Apply updates per vendor instructions.
CWEs: