This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2020-0638
Vendor: Microsoft
Product: Update Notification Manager
Added: 2022-05-23
Due Date: 2022-06-13
Description:
Microsoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.
Required Action:
Apply updates per vendor instructions.
CVE-2019-7286
Vendor: Apple
Product: Multiple Products
Added: 2022-05-23
Due Date: 2022-06-13
Description:
Apple iOS, macOS, watchOS, and tvOS contain a memory corruption vulnerability that could allow for privilege escalation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-7287
Vendor: Apple
Product: iOS
Added: 2022-05-23
Due Date: 2022-06-13
Description:
Apple iOS contains a memory corruption vulnerability which could allow an attacker to perform remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-0676
Vendor: Microsoft
Product: Internet Explorer
Added: 2022-05-23
Due Date: 2022-06-13
Description:
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.
Required Action:
Apply updates per vendor instructions.
CVE-2019-5786
Vendor: Google
Product: Chrome Blink
Added: 2022-05-23
Due Date: 2022-06-13
Description:
Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-0703
Vendor: Microsoft
Product: Windows
Added: 2022-05-23
Due Date: 2022-06-13
Description:
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.
Required Action:
Apply updates per vendor instructions.
CVE-2019-0880
Vendor: Microsoft
Product: Windows
Added: 2022-05-23
Due Date: 2022-06-13
Description:
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.
Required Action:
Apply updates per vendor instructions.
CVE-2019-13720
Vendor: Google
Product: Chrome WebAudio
Added: 2022-05-23
Due Date: 2022-06-13
Description:
Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-11707
Vendor: Mozilla
Product: Firefox and Thunderbird
Added: 2022-05-23
Due Date: 2022-06-13
Description:
Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-11708
Vendor: Mozilla
Product: Firefox and Thunderbird
Added: 2022-05-23
Due Date: 2022-06-13
Description:
Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-8720
Vendor: WebKitGTK
Product: WebKitGTK
Added: 2022-05-23
Due Date: 2022-06-13
Description:
WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-18426
Vendor: Meta Platforms
Product: WhatsApp
Added: 2022-05-23
Due Date: 2022-06-13
Description:
A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-1385
Vendor: Microsoft
Product: Windows
Added: 2022-05-23
Due Date: 2022-06-13
Description:
A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-1130
Vendor: Microsoft
Product: Windows
Added: 2022-05-23
Due Date: 2022-06-13
Description:
A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2018-5002
Vendor: Adobe
Product: Flash Player
Added: 2022-05-23
Due Date: 2022-06-13
Description:
Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.
Required Action:
The impacted product is end-of-life and should be disconnected if still in use.
CWEs: