CISA adds 17 vulnerabilities to list of bugs exploited in attacks [UPDATE]

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/cisa-adds-17-vulnerabilities-to-list-of-bugs-exploited-in-attacks/

This week, the Cybersecurity and Infrastructure Security Agency (CISA) added seventeen actively exploited vulnerabilities to the 'Known Exploited Vulnerabilities Catalog.
The 'Known Exploited Vulnerabilities Catalog' is a list of vulnerabilities that have been seen abused by threat actors in attacks and that are required to be patched by Federal Civilian Executive Branch (FCEB) agencies.
"Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known CVEs that carry significant risk to the federal enterprise," explains CISA.
"BOD 22-01 requires FCEB agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information."

CVE Number	CVE Title	Required Action Due Date
CVE-2021-32648	October CMS Improper Authentication	2/1/2022
CVE-2021-21315	System Information Library for node.js Command Injection Vulnerability	2/1/2022
CVE-2021-21975	Server Side Request Forgery in vRealize Operations Manager API Vulnerability	2/1/2022
CVE-2021-22991	BIG-IP Traffic Microkernel Buffer Overflow Vulnerability	2/1/2022
CVE-2021-25296	Nagios XI OS Command Injection Vulnerability	2/1/2022
CVE-2021-25297	Nagios XI OS Command Injection Vulnerability	2/1/2022
CVE-2021-25298	Nagios XI OS Command Injection Vulnerability	2/1/2022
CVE-2021-33766	Microsoft Exchange Server Information Disclosure Vulnerability	2/1/2022
CVE-2021-40870	Aviatrix Controller Unrestricted Upload of File Vulnerability	2/1/2022
CVE-2021-35247	SolarWinds Serv-U Improper Input Validation Vulnerability	02/04/2022
CVE-2020-11978	Apache Airflow Command Injection Vulnerability	7/18/2022
CVE-2020-13671	Drupal Core Unrestricted Upload of File Vulnerability	7/18/2022
CVE-2020-13927	Apache Airflow Experimental API Authentication Bypass Vulnerability	7/18/2022
CVE-2020-14864	Oracle Corporate Business Intelligence Enterprise Edition Path Traversal Vulnerability	7/18/2022
CVE-2006-1547	Apache Struts 1 ActionForm Denial of Service Vulnerability	07/21/2022
CVE-2012-0391	Apache Struts 2 Improper Input Validation Vulnerability	07/21/2022
CVE-2018-8453	Microsoft Windows Win32k Privilege Escalation Vulnerability	07/21/2022

 

[silversurfer]

The US Cybersecurity & Infrastructure Security Agency (CISA) has added eight more flaws to its catalog of exploited vulnerabilities that are known to be used in attacks, and they're a mix of old and new. The goal of publishing these vulnerabilities is to raise awareness and remind federal organizations of their obligation to apply security updates by a specified strict deadline. As all of the vulnerabilities in the catalog are leveraged in active threats and current cyber-attacks, they carry a significant risk to organizations, allowing the takeover of mobile devices, network access, the ability to execute commands remotely. The eight flaws added by CISA last week are listed below:

CVE ID	Description	Patch Deadline
CVE-2022-22587	Apple IOMobileFrameBuffer Memory Corruption Vulnerability	2/11/2022
CVE-2021-20038	SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability	2/11/2022
CVE-2014-7169	GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability	7/28/2022
CVE-2014-6271	GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability	7/28/2022
CVE-2020-0787	Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability	7/28/2022
CVE-2014-1776	Microsoft Internet Explorer Use-After-Free Vulnerability	7/28/2022
CVE-2020-5722	Grandstream Networks UCM6200 Series SQL Injection Vulnerability	7/28/2022
CVE-2017-5689	Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability	7/28/2022

CISA adds 8 vulnerabilities to list of actively exploited bugs

The US Cybersecurity & Infrastructure Security Agency (CISA) has added eight more flaws to its catalog of exploited vulnerabilities that are known to be used in attacks, and they're a mix of old and new.

www.bleepingcomputer.com