/ feedAn elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory. CISA required action: Apply updates per vendor instructions.
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC). CISA required action: Apply updates per vendor instructions.
In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server. CISA required action: Apply updates per vendor i…
Microsoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation. CISA required action: Apply updates per vendor instructions.
Microsoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution. CISA required action: Apply updates per vendor instructions.
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a pre-authorization arbitrary file read vulnerability in the /s/ endpoint. CISA required action: Apply updates p…
SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection. CISA required action: The impacted product is end-of-life and should be disconnected if still…
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution. CISA required action: The impacted product is…
Redis is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution. CISA required action: Apply updates per vendor instructions.
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers tha…
QNAP NAS running HBS 3 contains an improper authorization vulnerability which can allow remote attackers to log in to a device. CISA required action: Apply updates per vendor instructions.
Dell dbutil driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial-of-service (DoS), or information disclosure. CISA required action: Apply updates per vendor i…
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution. CISA required action: The impacted product is…
Microsoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.
An authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution. CISA required action: Apply updates per vendor instructions.
macOS Monterey contains an out-of-bounds read vulnerability that could allow an application to read kernel memory. CISA required action: Apply updates per vendor instructions.
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow for remote code execution. CISA required action: Apply updates per vendor instructions.
A remote code execution vulnerability exists in all series H/W revisions routers via the DDNS function in ncc2 binary file. CISA required action: The impacted product is end-of-life and should be disconnected if still…
macOS Monterey contains an out-of-bounds write vulnerability that could allow an application to execute arbitrary code with kernel privileges. CISA required action: Apply updates per vendor instructions.
Microsoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution. CISA required action: Apply updates per vendor instructions.