CISA Exploited Vulnerabilities

Vendor: VMware | Product: vRealize Operations Manager API | Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-02-01

Vendor: Npm package | Product: System Information Library for Node.JS | In this vulnerability, an attacker can send a malicious payload that will exploit the name parameter. After successful exploitation, attackers can execute remote. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-02-01

Vendor: F5 | Product: BIG-IP Traffic Management Microkernel | The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-02-01

Vendor: Oracle | Product: Intelligence Enterprise Edition | Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-18

Vendor: Drupal | Product: Drupal core | Improper sanitization in the extension file names is present in Drupal core. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-18

Vendor: Apache | Product: Airflow | A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-18

Vendor: Apache | Product: Airflow's Experimental API | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-18

Vendor: VMware | Product: vCenter Server | Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-01-24

Vendor: Hikvision | Product: Security cameras web server | A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-01-24

Vendor: Google | Product: Chrome Media | Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-10

Vendor: Microsoft | Product: Win32k | A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-10

Vendor: Microsoft | Product: WinVerifyTrust function | A remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-10

Vendor: Oracle | Product: WebLogic Server | Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-10

Vendor: Synacor | Product: Zimbra Collaboration Suite (ZCS) | Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-10

Vendor: Fortinet | Product: FortiOS and FortiProxy | An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-10

Vendor: Fortinet | Product: FortiOS and FortiProxy | A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-10

Vendor: Palo Alto Networks | Product: PAN-OS | Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-10

Vendor: Exim | Product: Mail Transfer Agent (MTA) | Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-10

Vendor: IBM | Product: WebSphere Application Server and Server Hypervisor Edition | Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-10

Vendor: Primetek | Product: Primefaces Application | Primetek Primefaces is vulnerable to a weak encryption flaw resulting in remote code execution | Required action: Apply updates per vendor instructions. | Federal remediation due: 2022-07-10