This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2022-26923
Vendor: Microsoft
Product: Active Directory
Added: 2022-08-18
Due Date: 2022-09-08
Description:
An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-21971
Vendor: Microsoft
Product: Windows
Added: 2022-08-18
Due Date: 2022-09-08
Description:
Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2017-15944
Vendor: Palo Alto Networks
Product: PAN-OS
Added: 2022-08-18
Due Date: 2022-09-08
Description:
Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.
Required Action:
Apply updates per vendor instructions.
CVE-2022-27925
Vendor: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Added: 2022-08-11
Due Date: 2022-09-01
Description:
Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-37042
Vendor: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Added: 2022-08-11
Due Date: 2022-09-01
Description:
Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-34713
Vendor: Microsoft
Product: Windows
Added: 2022-08-09
Due Date: 2022-08-30
Description:
A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.
Required Action:
Apply updates per vendor instructions.
CVE-2022-30333
Vendor: RARLAB
Product: UnRAR
Added: 2022-08-09
Due Date: 2022-08-30
Description:
RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-27924
Vendor: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Added: 2022-08-04
Due Date: 2022-08-25
Description:
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-26138
Vendor: Atlassian
Product: Confluence
Added: 2022-07-29
Due Date: 2022-08-19
Description:
Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-22047
Vendor: Microsoft
Product: Windows
Added: 2022-07-12
Due Date: 2022-08-02
Description:
Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-26925
Vendor: Microsoft
Product: Windows
Added: 2022-07-01
Due Date: 2022-07-22
Description:
Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.
Required Action:
Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
CWEs:
CVE-2022-29499
Vendor: Mitel
Product: MiVoice Connect
Added: 2022-06-27
Due Date: 2022-07-18
Description:
The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-30533
Vendor: Google
Product: Chromium PopupBlocker
Added: 2022-06-27
Due Date: 2022-07-18
Description:
Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-4034
Vendor: Red Hat
Product: Polkit
Added: 2022-06-27
Due Date: 2022-07-18
Description:
The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-30983
Vendor: Apple
Product: iOS and iPadOS
Added: 2022-06-27
Due Date: 2022-07-18
Description:
Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.
Required Action:
Apply updates per vendor instructions.
CWEs: