This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2019-11708
Vendor: Mozilla
Product: Firefox and Thunderbird
Added: 2022-05-23
Due Date: 2022-06-13
Description:
Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-8720
Vendor: WebKitGTK
Product: WebKitGTK
Added: 2022-05-23
Due Date: 2022-06-13
Description:
WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-18426
Vendor: Meta Platforms
Product: WhatsApp
Added: 2022-05-23
Due Date: 2022-06-13
Description:
A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-1385
Vendor: Microsoft
Product: Windows
Added: 2022-05-23
Due Date: 2022-06-13
Description:
A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-1130
Vendor: Microsoft
Product: Windows
Added: 2022-05-23
Due Date: 2022-06-13
Description:
A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2018-5002
Vendor: Adobe
Product: Flash Player
Added: 2022-05-23
Due Date: 2022-06-13
Description:
Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution.
Required Action:
The impacted product is end-of-life and should be disconnected if still in use.
CWEs:
CVE-2018-8589
Vendor: Microsoft
Product: Win32k
Added: 2022-05-23
Due Date: 2022-06-13
Description:
A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.
Required Action:
Apply updates per vendor instructions.
CVE-2022-30525
Vendor: Zyxel
Product: Multiple Firewalls
Added: 2022-05-16
Due Date: 2022-06-06
Description:
A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-22947
Vendor: VMware
Product: Spring Cloud Gateway
Added: 2022-05-16
Due Date: 2022-06-06
Description:
Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-1388
Vendor: F5
Product: BIG-IP
Added: 2022-05-10
Due Date: 2022-05-31
Description:
F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-1789
Vendor: Apple
Product: Multiple Products
Added: 2022-05-04
Due Date: 2022-05-25
Description:
A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2019-8506
Vendor: Apple
Product: Multiple Products
Added: 2022-05-04
Due Date: 2022-05-25
Description:
A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2014-4113
Vendor: Microsoft
Product: Win32k
Added: 2022-05-04
Due Date: 2022-05-25
Description:
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2014-0322
Vendor: Microsoft
Product: Internet Explorer
Added: 2022-05-04
Due Date: 2022-05-25
Description:
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2014-0160
Vendor: OpenSSL
Product: OpenSSL
Added: 2022-05-04
Due Date: 2022-05-25
Description:
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
Required Action:
Apply updates per vendor instructions.
CWEs: