CISA Exploited Vulnerabilities

Vendor: Microsoft | Product: Windows | An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-06-13

Vendor: Microsoft | Product: Windows | A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-06-13

Vendor: Google | Product: Chrome WebAudio | Google Chrome WebAudio contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-06-13

Vendor: Mozilla | Product: Firefox and Thunderbird | Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-06-13

Vendor: Mozilla | Product: Firefox and Thunderbird | Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-06-13

Vendor: WebKitGTK | Product: WebKitGTK | WebKitGTK contains a memory corruption vulnerability which can allow an attacker to perform remote code execution. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-06-13

Vendor: Meta Platforms | Product: WhatsApp | A vulnerability in WhatsApp Desktop when paired with WhatsApp for iPhone allows cross-site scripting and local file reading. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-06-13

Vendor: Microsoft | Product: Windows | A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-06-13

Vendor: Microsoft | Product: Windows | A privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-06-13

Vendor: Adobe | Product: Flash Player | Adobe Flash Player have a stack-based buffer overflow vulnerability that could lead to remote code execution. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Federal remediation due: 2022-06-13

Vendor: Microsoft | Product: Win32k | A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-06-13

Vendor: Zyxel | Product: Multiple Firewalls | A command injection vulnerability in the CGI program of some Zyxel firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-06-06

Vendor: VMware | Product: Spring Cloud Gateway | Spring Cloud Gateway applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-06-06

Vendor: F5 | Product: BIG-IP | F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-31

Vendor: Apple | Product: Multiple Products | A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-25

Vendor: Apple | Product: Multiple Products | A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-25

Vendor: Microsoft | Product: Win32k | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-25

Vendor: Microsoft | Product: Internet Explorer | Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-25

Vendor: OpenSSL | Product: OpenSSL | The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-25

Vendor: WSO2 | Product: Multiple Products | Multiple WSO2 products allow for unrestricted file upload, resulting in remote code execution. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-16