This dashboard displays the latest vulnerabilities published by the Cybersecurity & Infrastructure Security Agency (CISA).
CVE-2013-3906
Vendor: Microsoft
Product: Graphics Component
Added: 2022-02-15
Due Date: 2022-08-15
Description:
Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2022-22620
Vendor: Apple
Product: iOS, iPadOS, and macOS
Added: 2022-02-11
Due Date: 2022-02-25
Description:
Apple iOS, iPadOS, and macOS WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2021-36934
Vendor: Microsoft
Product: Windows
Added: 2022-02-10
Due Date: 2022-02-24
Description:
If a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2020-0796
Vendor: Microsoft
Product: SMBv3
Added: 2022-02-10
Due Date: 2022-08-10
Description:
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2018-1000861
Vendor: Jenkins
Product: Jenkins Stapler Web Framework
Added: 2022-02-10
Due Date: 2022-08-10
Description:
A code execution vulnerability exists in the Stapler web framework used by Jenkins
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2017-9791
Vendor: Apache
Product: Struts 1
Added: 2022-02-10
Due Date: 2022-08-10
Description:
The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2017-8464
Vendor: Microsoft
Product: Windows
Added: 2022-02-10
Due Date: 2022-08-10
Description:
Windows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK file
Required Action:
Apply updates per vendor instructions.
CVE-2017-10271
Vendor: Oracle
Product: WebLogic Server
Added: 2022-02-10
Due Date: 2022-08-10
Description:
Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.
Required Action:
Apply updates per vendor instructions.
CVE-2017-0263
Vendor: Microsoft
Product: Win32k
Added: 2022-02-10
Due Date: 2022-08-10
Description:
Microsoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2017-0262
Vendor: Microsoft
Product: Office
Added: 2022-02-10
Due Date: 2022-08-10
Description:
A remote code execution vulnerability exists in Microsoft Office.
Required Action:
Apply updates per vendor instructions.
CVE-2017-0145
Vendor: Microsoft
Product: SMBv1
Added: 2022-02-10
Due Date: 2022-08-10
Description:
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2017-0144
Vendor: Microsoft
Product: SMBv1
Added: 2022-02-10
Due Date: 2022-08-10
Description:
The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2016-3088
Vendor: Apache
Product: ActiveMQ
Added: 2022-02-10
Due Date: 2022-08-10
Description:
The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request
Required Action:
Apply updates per vendor instructions.
CWEs:
CVE-2015-2051
Vendor: D-Link
Product: DIR-645 Router
Added: 2022-02-10
Due Date: 2022-08-10
Description:
D-Link DIR-645 Wired/Wireless Router allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
Required Action:
The impacted product is end-of-life and should be disconnected if still in use.
CWEs:
CVE-2015-1635
Vendor: Microsoft
Product: HTTP.sys
Added: 2022-02-10
Due Date: 2022-08-10
Description:
Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.
Required Action:
Apply updates per vendor instructions.
CWEs: