Exploited vulnerabilities (CISA KEV)

CVE-2022-24706 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-1188 Apr 26, 2022

Apache CouchDB Insecure Default Initialization of Resource Vulnerability

In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.

CVE-2022-29499 Critical · 9.8 KEV Urgent · 73 Ransomware CWE-20 Apr 25, 2022

Mitel MiVoice Connect Data Validation Vulnerability

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

CVE-2022-27924 High · 7.5 KEV Urgent · 73 Public exploit Ransomware CWE-74 Apr 20, 2022

Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance. These memcache commands becomes unescaped, causing an overwrite of arbitrary cached entries.

CVE-2022-27925 High · 7.2 KEV Urgent · 89 Public exploit Ransomware CWE-22 Apr 20, 2022

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

CVE-2022-27926 Medium · 6.1 KEV High · 57 Public exploit CWE-79 Apr 20, 2022

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

CVE-2022-21445 Critical · 9.8 KEV High · 69 Public exploit CWE-502 Apr 19, 2022

Oracle ADF Faces Deserialization of Untrusted Data Vulnerability

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Development Framework (ADF). Successful attacks of this vulnerability can result in takeover of Oracle Application Development Framework (ADF). Note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2022-29464 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Apr 18, 2022

WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

CVE-2022-28810 Medium · 6.8 KEV High · 65 Public exploit CWE-78 Apr 18, 2022

Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.

CVE-2022-26904 High · 7.0 KEV High · 68 Public exploit CWE-362 Apr 15, 2022

Microsoft Windows User Profile Service Privilege Escalation Vulnerability

Windows User Profile Service Elevation of Privilege Vulnerability

CVE-2022-24521 High · 7.8 KEV Urgent · 71 Public exploit Ransomware CWE-787 Apr 15, 2022

Microsoft Windows CLFS Driver Privilege Escalation Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2022-24816 Critical · 10.0 KEV Urgent · 73 Public exploit CWE-94 Apr 13, 2022

OSGeo GeoServer JAI-EXT Code Injection Vulnerability

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

CVE-2022-22960 High · 7.8 KEV High · 68 Public exploit CWE-732 Apr 13, 2022

VMware Multiple Products Privilege Escalation Vulnerability

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.

CVE-2022-22954 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-94 Apr 11, 2022

VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

CVE-2022-0609 High · 8.8 KEV High · 66 CWE-416 Apr 4, 2022

Google Chromium Animation Use-After-Free Vulnerability

Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2022-22965 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-94 Apr 1, 2022

Spring Framework JDK 9+ Remote Code Execution Vulnerability

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

CVE-2022-22963 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-917 Apr 1, 2022

VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.