/ feedSpring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. CISA required action: Apply updates per vendor instructions.
The SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets. CISA required action: Apply updates per vendor instructions.
Sudo contains an off-by-one error that can result in a heap-based buffer overflow, which allows for privilege escalation. CISA required action: Apply updates per vendor instructions.
Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX allows remote attackers to perform arbitrary file uploads or execute arbitrary code. CISA required action: Apply updates per vendor instructions.
QNAP NAS devices contain a command injection vulnerability which could allow attackers to perform remote code execution. CISA required action: Apply updates per vendor instructions.
Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escala…
Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. CISA required action: Versions 6 and earlier for this product…
Google Pixel contains a possible out-of-bounds write due to a logic error in the code that could lead to local escalation of privilege. CISA required action: Apply updates per vendor instructions.
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.
Microsoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.
WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via exposed management access. CISA required action: Apply updates…
Stack-based buffer overflow in Adobe Flash Player allows attackers to execute code remotely. CISA required action: The impacted product is end-of-life and should be disconnected if still in use.
Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code. CISA required action: The impacted product is end-of-life and should be disconnected if still in use.
Use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute code. CISA required action: The impacted product is end-of-life and should be disconnected if still in use.
Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code. CISA required action: The impacted product is end-of-life and should be disconnected if still in use.
Microsoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS). CISA required action: Apply updates per vendor instructions.
A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site. CISA required action: Apply updates per vendor instructions.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS). CISA required action…
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS). CISA required action: T…
Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. CISA required action: Apply updates per vendor instructions.