CISA Exploited Vulnerabilities

Vendor: Drupal | Product: Core | A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-04

Vendor: Kaseya | Product: Virtual System/Server Administrator (VSA) | Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-04

Vendor: Adobe | Product: Flash Player | Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS). | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Federal remediation due: 2022-05-04

Vendor: Adobe | Product: Flash Player | Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS). | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Federal remediation due: 2022-05-04

Vendor: Adobe | Product: Flash Player | Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Federal remediation due: 2022-05-04

Vendor: Microsoft | Product: Internet Explorer | Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS). | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-04

Vendor: Adobe | Product: Flash Player | Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Federal remediation due: 2022-05-04

Vendor: Adobe | Product: Flash Player | Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Federal remediation due: 2022-05-04

Vendor: Adobe | Product: Flash Player | Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely. | Required action: The impacted product is end-of-life and should be disconnected if still in use. | Federal remediation due: 2022-05-04

Vendor: WatchGuard | Product: Firebox and XTM | WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-02

Vendor: Microsoft | Product: Active Directory | Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-02

Vendor: Microsoft | Product: Active Directory | Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-02

Vendor: Google | Product: Pixel | Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-02

Vendor: Checkbox | Product: Checkbox Survey | Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. | Required action: Versions 6 and earlier for this product are end-of-life and must be removed from agency networks. Versions 7 and later are not considered vulnerable. | Federal remediation due: 2022-05-02

Vendor: Linux | Product: Kernel | Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-02

Vendor: QNAP | Product: QNAP Network-Attached Storage (NAS) | QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-02

Vendor: Telerik | Product: User Interface (UI) for ASP.NET AJAX | Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-05-02

Vendor: Sudo | Product: Sudo | Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-04-27

Vendor: Microsoft | Product: HTTP Protocol Stack | Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-04-27

Vendor: Microsoft | Product: SMBv1 server | The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-04-27