Skip to content

Commit db8e868

Browse files
aboutcode-automationaboutcode-automation
committed
Update KEV: Wed Jul 23 00:14:10 UTC 2025
Signed-off-by: AboutCode Automation <[email protected]>
1 parent 280410f commit db8e868

File tree

1 file changed

+94
-4
lines changed

1 file changed

+94
-4
lines changed

‎known_exploited_vulnerabilities.json‎

Lines changed: 94 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,99 @@
11
{
22
"title": "CISA Catalog of Known Exploited Vulnerabilities",
3-
"catalogVersion": "2025.07.20",
4-
"dateReleased": "2025-07-20T19:06:00.8332Z",
5-
"count": 1382,
3+
"catalogVersion": "2025.07.22",
4+
"dateReleased": "2025-07-22T17:01:26.7198Z",
5+
"count": 1388,
66
"vulnerabilities": [
7+
{
8+
"cveID": "CVE-2025-2775",
9+
"vendorProject": "SysAid",
10+
"product": "SysAid On-Prem",
11+
"vulnerabilityName": "SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability",
12+
"dateAdded": "2025-07-22",
13+
"shortDescription": "SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.",
14+
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
15+
"dueDate": "2025-08-12",
16+
"knownRansomwareCampaignUse": "Unknown",
17+
"notes": "https:\/\/documentation.sysaid.com\/docs\/24-40-60 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-2775",
18+
"cwes": [
19+
"CWE-611"
20+
]
21+
},
22+
{
23+
"cveID": "CVE-2025-2776",
24+
"vendorProject": "SysAid",
25+
"product": "SysAid On-Prem",
26+
"vulnerabilityName": "SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability",
27+
"dateAdded": "2025-07-22",
28+
"shortDescription": "SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.",
29+
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
30+
"dueDate": "2025-08-12",
31+
"knownRansomwareCampaignUse": "Unknown",
32+
"notes": "https:\/\/documentation.sysaid.com\/docs\/24-40-60 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-2776",
33+
"cwes": [
34+
"CWE-611"
35+
]
36+
},
37+
{
38+
"cveID": "CVE-2025-6558",
39+
"vendorProject": "Google",
40+
"product": "Chromium",
41+
"vulnerabilityName": "Google Chromium ANGLE and GPU Improper Input Validation Vulnerability",
42+
"dateAdded": "2025-07-22",
43+
"shortDescription": "Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.",
44+
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
45+
"dueDate": "2025-08-12",
46+
"knownRansomwareCampaignUse": "Unknown",
47+
"notes": "https:\/\/chromereleases.googleblog.com\/2025\/07\/stable-channel-update-for-desktop_15.html ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-6558",
48+
"cwes": [
49+
"CWE-20"
50+
]
51+
},
52+
{
53+
"cveID": "CVE-2025-54309",
54+
"vendorProject": "CrushFTP",
55+
"product": "CrushFTP",
56+
"vulnerabilityName": " CrushFTP Unprotected Alternate Channel Vulnerability",
57+
"dateAdded": "2025-07-22",
58+
"shortDescription": "CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.",
59+
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
60+
"dueDate": "2025-08-12",
61+
"knownRansomwareCampaignUse": "Unknown",
62+
"notes": "https:\/\/www.crushftp.com\/crush11wiki\/Wiki.jsp?page=CompromiseJuly2025 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-54309 ",
63+
"cwes": [
64+
"CWE-420"
65+
]
66+
},
67+
{
68+
"cveID": "CVE-2025-49704",
69+
"vendorProject": "Microsoft",
70+
"product": "SharePoint",
71+
"vulnerabilityName": "Microsoft SharePoint Code Injection Vulnerability",
72+
"dateAdded": "2025-07-22",
73+
"shortDescription": "Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. The update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704.",
74+
"requiredAction": "CISA recommends disconnecting public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS). For example, SharePoint Server 2013 and earlier versions are end-of-life and should be discontinued if still in use. For supported versions, please follow the mitigations according to CISA and vendor instructions. Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.",
75+
"dueDate": "2025-07-23",
76+
"knownRansomwareCampaignUse": "Unknown",
77+
"notes": "CISA Mitigation Instructions: https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/07\/20\/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770; https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/07\/22\/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities\/ ; https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-49704 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-49704",
78+
"cwes": [
79+
"CWE-94"
80+
]
81+
},
82+
{
83+
"cveID": "CVE-2025-49706",
84+
"vendorProject": "Microsoft",
85+
"product": "SharePoint",
86+
"vulnerabilityName": "Microsoft SharePoint Improper Authentication Vulnerability",
87+
"dateAdded": "2025-07-22",
88+
"shortDescription": "Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706.",
89+
"requiredAction": "CISA recommends disconnecting public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS). For example, SharePoint Server 2013 and earlier versions are end-of-life and should be discontinued if still in use. For supported versions, please follow the mitigations according to CISA and vendor instructions. Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.",
90+
"dueDate": "2025-07-23",
91+
"knownRansomwareCampaignUse": "Unknown",
92+
"notes": "CISA Mitigation Instructions: https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/07\/20\/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770; https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/07\/22\/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities\/ ; https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-49706 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-49706",
93+
"cwes": [
94+
"CWE-287"
95+
]
96+
},
797
{
898
"cveID": "CVE-2025-53770",
999
"vendorProject": "Microsoft",
@@ -14,7 +104,7 @@
14104
"requiredAction": "CISA recommends configuring AMSI integration in SharePoint and deploying Defender AV on all SharePoint servers. If AMSI cannot be enabled, CISA recommends disconnecting affected products that are public-facing on the internet from service until official mitigations are available. Once mitigations are provided, apply them according to CISA and vendor instructions. Follow the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. ",
15105
"dueDate": "2025-07-21",
16106
"knownRansomwareCampaignUse": "Unknown",
17-
"notes": "CISA Mitigation Instructions: https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/07\/20\/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770 ; https:\/\/msrc.microsoft.com\/blog\/2025\/07\/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770\/ ; https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-53770 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-53770",
107+
"notes": "CISA Mitigation Instructions: https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/07\/20\/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770; https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/07\/22\/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities\/ ; https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-53770 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-53770",
18108
"cwes": [
19109
"CWE-502"
20110
]

0 commit comments

Comments
 (0)