CISA Known Exploited Vulnerabilities

CVE-2024-38112 is a spoofing vulnerability in the Microsoft Windows MSHTML Platform that impacts confidentiality, integrity, and availability. It has a high severity with a CVSS score of 7.5 and is known to be exploited in the wild. The vulnerability requires user interaction and has a high attack complexity. No specific affected versions or patch information is provided in the available data.

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that are passed to specific configuration CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected configuration CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root. Note: To successfully exploit this vulnerability on a Cisco NX-OS device, an attacker must have Administrator credentials. The following Cisco devices already allow administrative users to access the underlying operating system through the bash-shell feature, so, for these devices, this vulnerability does not grant any additional privileges: Nexus 3000 Series Switches Nexus 7000 Series Switches that are running Cisco NX-OS Software releases 8.1(1) and later Nexus 9000 Series Switches in standalone NX-OS mode

CVE-2020-13965 is a high-severity cross-site scripting (XSS) vulnerability in Roundcube Webmail. It allows a remote attacker to manipulate data by sending a malicious XML attachment. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

CVE-2022-2586 is a use-after-free vulnerability in the Linux Kernel's nft_object component that allows local attackers to escalate privileges. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

OSGeo GeoServer JAI-EXT contains a code injection vulnerability (CVE-2022-24816) that can lead to remote code execution when Jiffle scripts are accepted via network requests in programs using jt-jiffle. This vulnerability has been exploited in the wild and is considered high severity.

there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2024-26169 is a high-severity vulnerability in the Microsoft Windows Error Reporting Service that allows a local attacker with user-level permissions to escalate privileges to SYSTEM level. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. It involves improper privilege management, enabling unauthorized privilege escalation without user interaction.

In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver allows a local non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.This issue affects Bifrost GPU Kernel Driver: from r34p0 through r40p0; Valhall GPU Kernel Driver: from r34p0 through r40p0.

CVE-2017-3506 is an OS command injection vulnerability in Oracle WebLogic Server, part of the Fusion Middleware suite. It allows attackers to execute arbitrary code by sending a specially crafted HTTP request containing a malicious XML document. This vulnerability has been exploited in the wild. Oracle released patches for affected versions as part of their April 2017 Critical Patch Update and strongly recommends applying these patches promptly.

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.

Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Apache Flink contains an improper access control vulnerability (CVE-2020-17519) that allows an attacker to read any file on the local filesystem of the JobManager via its REST interface. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)