Exploited vulnerabilities (CISA KEV)

CVE-2022-20775 High · 7.8 KEV High · 55 CWE-22 Sep 30, 2022

Cisco SD-WAN Path Traversal Vulnerability

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF

CVE-2022-3075 Critical · 9.6 KEV High · 59 CWE-20 Sep 26, 2022

Google Chromium Mojo Insufficient Data Validation Vulnerability

Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

CVE-2022-2856 Medium · 6.5 KEV High · 52 CWE-20 Sep 26, 2022

Google Chromium Intents Insufficient Input Validation Vulnerability

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page.

CVE-2022-3038 High · 8.8 KEV High · 56 CWE-416 Sep 26, 2022

Google Chromium Network Service Use-After-Free Vulnerability

Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2022-41352 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Sep 25, 2022

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.

CVE-2022-3236 Critical · 9.8 KEV High · 64 Public exploit CWE-94 Sep 23, 2022

Sophos Firewall Code Injection Vulnerability

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older.

CVE-2022-39197 Medium · 6.1 KEV High · 59 Public exploit CWE-79 Sep 21, 2022

Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability

An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the payload (or create a new payload with the extracted information and then modify that username field to be malformed).

CVE-2022-32917 High · 7.8 KEV High · 55 CWE-787 Sep 20, 2022

Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability

The issue was addressed with improved bounds checks. This issue is fixed in macOS Monterey 12.6, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Big Sur 11.7. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..

CVE-2022-40139 High · 7.2 KEV High · 54 Sep 19, 2022

Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability

Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.

CVE-2022-35914 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-74 Sep 19, 2022

Teclib GLPI Remote Code Execution Vulnerability

/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.

CVE-2022-37969 High · 7.8 KEV Urgent · 72 Public exploit Ransomware CWE-787 Sep 13, 2022

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2022-27593 Critical · 9.1 KEV Urgent · 77 Public exploit Ransomware CWE-610 Sep 8, 2022

QNAP Photo Station Externally Controlled Reference Vulnerability

An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later