This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2022-0543
Vendor: Redis
Product: Debian-specific Redis Servers
Added: 2022-03-28
Due Date: 2022-04-18
Description:
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-38646
Vendor: Microsoft
Product: Office
Added: 2022-03-28
Due Date: 2022-04-18
Description:
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.
Required Action:
Apply updates per vendor instructions.
CVE-2021-34486
Vendor: Microsoft
Product: Windows
Added: 2022-03-28
Due Date: 2022-04-18
Description:
Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-26085
Vendor: Atlassian
Product: Confluence Server
Added: 2022-03-28
Due Date: 2022-04-18
Description:
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-20028
Vendor: SonicWall
Product: Secure Remote Access (SRA)
Added: 2022-03-28
Due Date: 2022-04-18
Description:
SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.
Required Action:
The impacted product is end-of-life and should be disconnected if still in use.
CWEs:
CVE-2019-7483
Vendor: SonicWall
Product: SMA100
Added: 2022-03-28
Due Date: 2022-04-18
Description:
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2018-8440
Vendor: Microsoft
Product: Windows
Added: 2022-03-28
Due Date: 2022-04-18
Description:
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).
Required Action:
Apply updates per vendor instructions.
CVE-2018-8406
Vendor: Microsoft
Product: DirectX Graphics Kernel (DXGKRNL)
Added: 2022-03-28
Due Date: 2022-04-18
Description:
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2018-8405
Vendor: Microsoft
Product: DirectX Graphics Kernel (DXGKRNL)
Added: 2022-03-28
Due Date: 2022-04-18
Description:
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2017-0213
Vendor: Microsoft
Product: Windows
Added: 2022-03-28
Due Date: 2022-04-18
Description:
Microsoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.
Required Action:
Apply updates per vendor instructions.
CVE-2017-0059
Vendor: Microsoft
Product: Internet Explorer
Added: 2022-03-28
Due Date: 2022-04-18
Description:
Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2017-0037
Vendor: Microsoft
Product: Edge and Internet Explorer
Added: 2022-03-28
Due Date: 2022-04-18
Description:
Microsoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2016-7201
Vendor: Microsoft
Product: Edge
Added: 2022-03-28
Due Date: 2022-04-18
Description:
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2016-7200
Vendor: Microsoft
Product: Edge
Added: 2022-03-28
Due Date: 2022-04-18
Description:
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2016-0189
Vendor: Microsoft
Product: Internet Explorer
Added: 2022-03-28
Due Date: 2022-04-18
Description:
The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
Required Action:
Apply updates per vendor instructions.
CWEs: